All endpoints

List recent activity across posts, bugs, features, org uploads, and public workflows and web automations.

Session is read if present (to compute the viewer's own vote on each item) but not required. A Bearer token without community:read is silently treated as anonymous rather than rejected. Workflow and web automation items are public or official library items; their url points at /library/{workflows|automations}/{slug}, and votes on them go to /api/community/library/{id}/vote.

File a bug report.

title 1-100 chars, description 1-1000 chars.

Update a bug's status and/or severity.

At least one field required.

Delete a bug report.

Upvote, downvote, or clear your vote on a bug.

0 removes an existing vote. Idempotent upsert per (bug, user).

Post a comment on a bug.

body 1-1000 chars.

Delete your own comment (or any comment, as a moderator/admin).

Attach a label to a bug.

Idempotent: attaching an already-attached label is a no-op.

Detach a label from a bug.

Create a new label.

name 1-30 chars; color is a #rrggbb hex string; 409 if the name is already taken.

Submit a feature request.

title 1-100 chars, description 1-1000 chars.

Delete a feature request.

Change a feature request's status.

Upvote, downvote, or clear your vote on a feature request.

Upload an org definition (JSON matching the org schema).

orgJson is validated against a Zod schema before insert. The request also needs a numeric Content-Length header under ~1 MB — a chunked-transfer client with no Content-Length is rejected outright, regardless of the actual body size.

Update an org's name, tagline, description, body, or banner image.

Requires ownership (or moderator/admin). Limits: name 1-100 chars, tagline ≤150, description ≤1000, body ≤20000. bannerUrl must start with /api/images/org/ or be null; empty strings on tagline/description/body are coerced to null.

Delete an org upload.

Upvote, downvote, or clear your vote on an org.

Post a comment on an org.

body 1-1000 chars.

Delete your own comment (or any comment, as a moderator/admin).

Upload an image (used for the org body and/or banner).

Upload a run's output files (Markdown and/or HTML).

label is optional despite the field existing — a blank or missing label is stored as null.

Delete a run and its files.

Requires ownership of the run (or moderator/admin).

Fetch a run output file's raw content.

Unauthenticated: anyone with the file id can view it, same as the linked org.

Create a post.

title 1-100 chars, body 1-2000 chars.

Upvote, downvote, or clear your vote on a post.

Post a comment on a blog post.

slug must match a real post; body 1-1000 chars.

Delete your own comment (or any comment, as a moderator/admin).

Get the authenticated user's id, username, name, and avatar URL.

avatarUrl (when set) is /api/images/avatar/<key>?v=<updatedAt ms> — the query param is a cache-buster, not part of the key.

Update your profile: name, tagline, job, tags, and social links.

name required, 1-100 chars. tagline ≤140, jobTitle ≤80, company ≤80. Up to 10 tags (1-24 chars, alnum/underscore/hyphen). githubUrl/linkedinUrl must be https and match their platform's domain; twitterUrl accepts twitter.com or x.com (or a subdomain of either); websiteUrl just needs to be https.

Upload a new avatar image.

Stored at a fixed per-user key (avatars/<userId>) — re-uploading overwrites the previous image.

Set or change your username (required once, during onboarding).

3-24 chars, letters/numbers/underscore/hyphen; must be unique — a taken username is a 400, not a 409 (see /docs/errors).

List all users.

Admin-only — a moderator token gets 403 here.

Block or unblock a user.

blockedAt is an ISO timestamp when blocking, null when unblocking.

Change a user's role.

List library items.

scope=mine needs library:read (401 without credentials). Item: { id, kind, slug, name, description, version, visibility, tags, owner: { id, username, name }, sha256, size, meta, score (net community votes), created_at, updated_at, url, artifact_url }. The community workflow and web automation galleries (/community/workflows, /community/automations) are this list with scope=public and sort=latest|popular. Community gallery orgs are listed as public kind=org items with meta.gallery = true.

Get one item by id, or by kind and slug (/api/library/items/automation/instagram).

A private item is 404 unless the caller is its owner (session, or a token with library:read).

Download the artifact: an .mpkg for automations, JSON for workflows and orgs.

Downloading needs a login (a session or a token with library:read); anonymous callers get 401 'Log in to monoes.me to download'. Browsing (list, item, versions) is open to everyone. Verify X-Content-SHA256 before installing.

List an item's versions, newest first.

Publish a new item.

The server validates the file: automations are .mpkg zips with a valid automation.json (≤ 20 MB; the item version is automation.json's); workflows are MonoAgent workflow exports (≤ 20 MB); orgs must pass the org schema (≤ 500 KB). meta is derived from the file. At most 30 uploads per hour (429).

Publish a new version of an item you own.

The version must be newer than the current one (409 version_conflict). Earlier versions stay downloadable.

Edit an item you own.

Only admins move items into or out of 'official'. Gallery orgs are edited on the org gallery instead (409 gallery_org).

Delete an item and all its versions (owner or admin).

Upvote, downvote, or clear your vote on a public or official library item.

Community conventions: errors are { error: string }. Private items and gallery orgs are 404 here; gallery orgs use /api/community/orgs/{id}/vote.

Comment on a public or official library item.

Delete a comment on a library item (its author, a moderator or an admin).

Who the token belongs to, and what it was granted.

Requires a session or any valid token (401 otherwise). MonoAgent uses it to show who is logged in.