Documentation

The NEXORA API is versioned under /api/v1 and speaks JSON. Sign-in uses an HttpOnly session cookie. Token access for external tools is planned. Endpoints under /me need a signed-in account with a verified email address.

The complete API is described as an OpenAPI 3.1 document at /api/v1/openapi.json, with every request body and query string taken from the same schemas the server validates with. Code generators and API clients can read it directly. The list below is built from the same source.

Privacy

Profile fields a developer keeps private are removed on the server and returned as null. Profiles that are not public answer 404, exactly like profiles that do not exist. Lists return items, page, pageSize, total and totalPages.

Projects

Projects are visible to everyone only when they are public and published. Drafts and private projects exist only for their accepted team members: for everyone else every endpoint answers 404, and they never appear in lists, counts or search. Images of such projects are not served to outsiders either.

The trending sort ranks by activity from people outside each project in the last seven days: every like and every distinct commenter counts 1, every bookmark and follow counts 2. Projects without such activity are left out.

Teams and workspaces

A team is public or private. Private teams, and their requests, answer 404 to everyone who is not an accepted member. Every team has one workspace, and a workspace is always members-only, whether its team is public or private. An invitation that is not accepted yet grants nothing. Workspace changes are written to the activity feed in the same transaction; the same events are delivered live to members who have the workspace open.

Community

Posts are always public while their author's account is active. Hashtags (#name, starting with a letter) and mentions (@username) are read from the title and text; a mention only counts for developers with a public profile. The top sort shows posts from the last seven days with the most likes, then the most comments. Trending hashtags count different people, so one person repeating a tag cannot push it up. Saved posts are private.

Messages

Conversations are between two people and exist only for them: every endpoint answers 404 to anyone else, and no public endpoint returns messages. Who may start a conversation follows the recipient's "Who may message you" setting; once the recipient has replied, the conversation stays open.

Realtime

Live updates come from a separate WebSocket service. Browsers connect with their session cookie; the service accepts only NEXORA's own origin and checks membership for every event. Events are signals that carry ids: notification, message (conversationId, messageId, change), read, typing, presence and workspace (teamSlug, activityId, event). Clients then load the data through this API. Clients may send typing (conversationId), presence.watch (conversationIds), workspace.watch and workspace.unwatch (teamSlug). Online status is shown only between people who share a conversation, and never for people who switched off "Show activity".

NEXORA AI

The assistant runs on the server with Anthropic's API; the key never reaches the browser. When no key is configured, /ai/status reports configured: false and sending answers 503 with AI_NOT_CONFIGURED; nothing is answered in its place. Sending a message returns application/x-ndjson: a user line with your saved message, delta lines with text as it is written, then done (with the saved answer and usage) or error. Closing the connection stops the answer and keeps the text so far. Each person has a daily limit of messages and tokens, counted per UTC day, and one answer at a time. A project is sent along only when you shared it under AI project access and attached it to the conversation. Answers are never run or tested.

Coding challenges

Submissions never run on the application server. They are queued in Redis and run by a separate worker, each in a fresh container without network, with a read-only file system, 256 MB of memory, one CPU, at most 64 processes and a time limit per test. Expected values never enter the container; the worker compares the results outside it. Results of hidden tests show only whether they passed. Poll /submissions/:id until the status is PASSED, FAILED, ERROR or TIMED_OUT. Each challenge pays its points once per person, at the first passing submission.

Reputation

Reputation is challenge points plus achievement points; nothing else counts. Every achievement is earned once, and its rule counts different people, projects, difficulty levels or weeks, so repeating an action earns nothing. The rules are listed on Achievements.

Moderation and administration

Anyone with a verified account can report a profile, project, comment, team, collaboration request, post or a message they received. Moderators and admins review reports per piece of content: they can dismiss them, or confirm them and remove the content or suspend its author. The author is told that something was removed and why, without the moderator's name. Suspended accounts cannot sign in, and everything they published is hidden until the suspension is lifted. Admins also change roles, configure the platform (registration, community posting, challenge submissions, an announcement and AI limits) and read the audit log. Every moderation action is written to the audit log. All of this is checked on the server for every request.

Analytics

A profile or project page counts a view once per viewer and day, sent by the page after it loaded. Owners and team members viewing their own pages are not counted. Viewers are recorded only as a hash with a salt that is deleted after two days, so nobody can tell who viewed anything, and the same person cannot be followed across days. /me/analytics returns only your own numbers: views, new followers, and likes, saves, comments and follows on projects you own or maintain.

Errors

Failed requests return a status code and a body with error.code, error.message and, for invalid input, error.fields. Rate-limited requests include a Retry-After header.

Endpoints