Register (or refresh) a device for web push
The body is the browser's `PushSubscription.toJSON()`. Idempotent on the endpoint, which must be https on a known push service (FCM, Mozilla, Apple, WNS) resolving to public addresses — anything else is 400 `push_endpoint_not_allowed`. The device's user agent is read from the request. Past the device limit, a new device is 429.
Sends a real request with your token. Prefer a read-only token; it is kept in this browser's storage.
The body is the browser's PushSubscription.toJSON(). Idempotent on the endpoint, which must be https on a known push service (FCM, Mozilla, Apple, WNS) resolving to public addresses — anything else is 400 push_endpoint_not_allowed. The device's user agent is read from the request. Past the device limit, a new device is 429.
AuthorizationBearer <token>A personal access token (rsk_…) or a Supabase access token.
application/json- body
endpoint*stringThe push service URL the browser gave: https on fcm.googleapis.com, updates.push.services.mozilla.com, web.push.apple.com or *.notify.windows.com
^https:\/\/.*starts_withlength <= 2048expirationTime?number|nullkeys*device_name?|nullSaved
application/json- response
endpoint*stringcurl -X PUT 'https://www.ressource.social/api/v1/push-subscriptions' \ -H 'Content-Type: application/json' \ -d '{ "endpoint": "string", "keys": { "p256dh": "string", "auth": "string" }}'{ "endpoint": "string"}Forget a device POST
Idempotent: an unknown endpoint is also a 204.
Who reacted to a source, as one tab lists them GET
No thread field: the owner sees every reaction, anyone else the public projection. `organization_id`: that community's members (the caller must be one, 403 otherwise). `is_note=false`: reactors in none of the source's communities, plus the caller. A private reactor the caller is not connected to comes back `masked`, with no user. `counts` are this tab's; `mine` is the caller's own reaction. Not paginated — one per person who reacted. A source the caller cannot open is 404.