api

api

kiln's account service is a JSON API at https://kiln.raya.ac/api/v1. private routes use a bearer session token (Authorization: Bearer <token>), obtained from register or login and stored in the app's keychain. browser sessions use the same token in an HttpOnly, Secure, SameSite=Lax cookie. errors are always {"error":{"code":"...","message":"..."}}.

auth

  • POST /auth/register — {handle,password,displayName?} returns account, session, recoveryCode
  • POST /auth/login — {handle,password} returns account, session
  • POST /auth/logout — {} returns ok
  • POST /auth/password — {currentPassword,newPassword} returns account, session
  • POST /auth/recover — {handle,recoveryCode,newPassword} returns account, session, recoveryCode

account

  • GET /me — the account
  • PATCH /profile — {displayName?,bio?,location?,website?,accent?}
  • PATCH /settings — {usageSharingEnabled?,publicUsageEnabled?,chatSharingDefault?}
  • GET /sessions — signed-in devices
  • POST /sessions/revoke — {id} or {others:true}
  • GET /export — account, usage events and readmes
  • POST /account/delete — {password}

usage

  • POST /usage/events — one measured snapshot; returns eventId and duplicate
  • GET /usage/history?limit&before — events and nextBefore
  • GET /usage/aggregate — counts, models, estimatedSpend, cachedSpend, noncachedSpend

readmes and social

  • POST /readmes — {title,body,trainingConsent:true,sourceChatId?,tags?}
  • GET /readmes — your readmes
  • PATCH /readmes/{id} — {enabled?,title?,body?,tags?}
  • DELETE /readmes/{id}
  • POST /readmes/{id}/like and DELETE /readmes/{id}/like — liked, likeCount
  • POST /follows/{handle} and DELETE /follows/{handle} — following, followers

sharing a readme is explicit and consent-gated: the server rejects a create without trainingConsent: true. only user and assistant text is published, and readmes are revocable at any time.

public pages

/, /explore, /readmes, /r/<slug>, /tags, /tags/<tag>, /u/<handle>, /feed, /followers/<handle>, /following/<handle>, /search, /docs, /api, /stats, /changelog, /about, /readmes.xml, /sitemap.xml, /robots.txt, /healthz.

limits: 600 requests/min/peer, 300/min/account, login and recovery 30/15min/peer, registration 5/hour/peer.