The AI Agents API manages bot creation and configuration. Each bot is a user profile of type Service with a configuration profile that includes tools, triggers, and scope. Global bots operate in the global scope; group bots operate within a group scope.
Wellesley Platform API (1.0)
Wellesley is a decentralized social platform built on top of ActivityPub. It operates as a federation of independent servers that exchange data using standard ActivityPub messages alongside custom extensions. The platform strives for Mastodon compatibility while introducing additional capabilities such as Groups, Forums, rich media, AI agents, and fine-grained access control.
This API provides full access to the platform's functionality including user and account management, posting and feeds, group creation and moderation, notifications, real-time streaming, search, federated content delivery, AI agent configuration, and platform administration. Most endpoints accept and return JSON. Pagination follows cursor-based patterns using Link headers.
Authentication: Endpoints that require authentication expect an Authorization header with a valid access token. Unauthenticated requests to protected endpoints will receive a 401 response.
RBAC (Role-Based Access Control): Some endpoints are protected by RBAC permissions. When an endpoint description mentions "RBAC: requires ...", the caller must hold the listed permission(s) in addition to being authenticated. Requests that lack the required permissions will receive a 403 response. RBAC permissions are scoped to resources (e.g., Group, Post, User) and actions (e.g., Read, Write, Moderate), and are assigned through roles.
Download OpenAPI description
Languages
Servers
Mock server
https://docs.wellesley.social/_mock/openapi
Simple setup, all in one. Digital Ocean
https://dust.allroads.social
Simple setup, db is separate. Digital Ocean
https://meteor.allroads.social
Endpoints for viewing AI providers and configuring per-scope API keys. Providers are catalog entries synced from models.dev. Use scope='global' for platform-wide configuration (requires AIProviders permissions) or a group TypeId for group-specific configuration (requires GroupAIProviders permissions).
Operations
Administrative endpoints for account and user management. Provides comprehensive tools for managing user accounts, including creation, deletion, role assignment, password management, state changes, and user impersonation for bot accounts. Requires Users.Manage permission unless otherwise noted on individual endpoints.
Operations
Administrative APIs for managing domain blocks. Provides endpoints to block specific domains with different severity levels (SUSPEND, LIMIT, NOOP), update existing blocks, unblock domains, and list currently blocked domains. Domain blocks prevent or limit federation with specified domains. Write operations require Federation.Manage permission; read operations require Federation.Read or Federation.Manage permission.
Operations
Administrative endpoints for managing domain allowlists. When domain allowlisting is enabled, only domains in this list can federate with the instance. Write operations require Federation.Manage permission; read operations require Federation.Read or Federation.Manage permission.
Operations
Administrative endpoints for managing the email domain allowlist used during user registration. When enabled, only email addresses from allowed domains can sign up. Write operations require AdminSettings.Manage permission; read operations require AdminSettings.Read or AdminSettings.Manage permission.
Operations
Administrative endpoints for managing FASP (Fediverse Auxiliary Service Provider) provider registrations and default capability assignments. Allows accepting, declining, and blocking providers, as well as configuring which provider is the default for each capability. Read operations require Federation.Read or Federation.Manage permission; write operations require Federation.Manage permission.
Operations
Administrative endpoints for monitoring and managing federation with other ActivityPub instances. Provides metrics on connected domains, user counts, post statistics, and federation health monitoring including sliding window performance metrics for inbox processing. Requires Federation.Read or Federation.Manage permission.
Operations
Administrative endpoints for configuring a remote link preview service provider. This service fetches rich link previews (title, description, image) for URLs shared in posts. The provider must support the 'link_preview' FASP capability. Requires AdminSettings.Manage permission.
Operations
Administrative endpoints for managing user signup requests. Provides tools for reviewing, approving, rejecting, and managing signup requests in the moderation queue. Supports workflow for manual account approval when enabled. Read operations require Signups.Read or Signups.Manage permission; write operations require Signups.Manage permission.
Operations
Administrative endpoints for managing file uploads and media storage. Provides tools for monitoring user storage usage, searching uploaded files, and managing upload processing jobs. Supports queue management for async upload processing workflows. Requires Uploads.Read permission.
Operations
Endpoints for managing forum categories within groups. Categories organize forum discussions into topics, allowing structured content browsing. Each forum must have at least one category. Most management operations require the GroupForum.Manage RBAC permission (group admin/moderator). Read operations are accessible according to group visibility settings.
Operations
Administrative endpoints for managing vector embeddings used in AI-powered features such as semantic search and content recommendations. Provides tools for enabling/disabling embeddings, configuring the embedding model, estimating costs, and managing batch recalculation jobs. Requires AdminSettings.Manage permission.
Operations
Administration endpoints for managing FASP (Fediverse Auxiliary Service Provider) registrations and capabilities. Handles the FASP registration workflow: providers register via POST, admins confirm registration, and capabilities are activated or deactivated. Also provides debug and backfill request tools. The registration endpoint is publicly accessible; all other endpoints require the Federation.Manage RBAC permission.
Operations
FASP (Fediverse Auxiliary Service Provider) data sharing endpoints implementing the FASP data sharing protocol v0. Allows FASP providers to subscribe to content lifecycle events and trends, request backfills of historical data, and manage their subscriptions. All requests are authenticated using FASP Ed25519 HTTP signature verification, not user authentication. Not intended to be called directly by client applications.
Debug endpoints for FASP (Fediverse Auxiliary Service Provider) integration testing. Allows FASP providers to submit debug callback responses and administrators to view and manage callback logs. The POST endpoint uses FASP Ed25519 HTTP signature authentication; the GET and DELETE endpoints are currently unauthenticated and intended for admin use only.
Endpoints for managing discussion forums within groups. Each group can have one forum that organizes discussions into categories and tags. Forums are auto-created on first access if the group does not already have one. Management operations (update, delete) require the GroupForum.Manage RBAC permission (group admin/moderator). Read operations follow group visibility settings.
Operations
Endpoints for managing applications available to groups. Applications are installable modules that extend group functionality. Group admins can add or remove applications from their groups. The global apps list shows all available applications at the GROUP entry point, while per-group lists show only applications installed for that specific group. Management operations require the GroupApps.Manage RBAC permission.
Operations
API endpoints for managing channels within groups. Channels are specialized accounts that enable organized content distribution within groups. They support hierarchical organization with primary and auto-subscribe channels, privacy controls inherited from parent groups, and both scoped (group-specific) and global usernames for discovery. Group admins manage channels while members follow.
Operations
API endpoints for managing group invitations. Group owners and admins can invite users to join their groups. Invitees can accept or reject invitations. Creating invitations requires the GroupMembers.Invite RBAC permission. Accepting, rejecting, and viewing personal invitations require standard authentication.
Operations
API endpoints for group join workflows. Users can request to join a group, and group admins can approve or reject join requests. Join behavior depends on the group's join mode: OPEN (instant), APPROVAL (requires admin approval), or INVITE_ONLY (requires invitation). Groups may also have entry questions that must be answered before joining. Admin operations (listing, approving, rejecting requests) require the GroupMembers.Manage RBAC permission. All endpoints require authentication.
Operations
API endpoints for managing group membership. Provides functionality to add, update, and remove members from groups, as well as retrieve membership information. Supports both local and federated groups through ActivityPub protocol. Access control is enforced based on group privacy settings and user permissions.
Operations
Request
Retrieves all groups that the currently authenticated user is a member of. Returns both public and private groups since the user is requesting their own memberships. Returns full Group objects with complete group details. Results are paginated. This is a convenience endpoint equivalent to calling /groups/member/{userId}/groups with your own user ID.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups?lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}' \
-H 'Authorization: YOUR_API_KEY_HERE'List of groups the current user is a member of
group metadata including color
- PUBLIC - Open Content. Content and membership are viewable by anyone.
- PRIVATE - Members-Only Content. Outsiders cannot see posts or members unless they join.
Enum"PUBLIC""PRIVATE"
- VISIBLE - The group is listed openly. It shows up in search results or directory listings, no matter if it's privacy is PUBLIC or PRIVATE.
- UNLISTED - The group does not appear in public lists or searches but is accessible via direct link.
- HIDDEN - The group is completely hidden and invite-only. Shared links will return 404 for non-members.
Enum"VISIBLE""UNLISTED""HIDDEN"
- OPEN - Anyone can join the group immediately without approval.
- APPROVAL - User requests must be approved by a group admin or moderator.
- INVITE_ONLY - Only users with an invitation from a member can join.
Enum"OPEN""APPROVAL""INVITE_ONLY"
Whether the current viewer can manage this group (owner, admin, or moderator)
ID of the forum associated with this group
Example: "us_01hxcvk1hjexere4pvtrj0ymqq"
Response
application/json
[ { "stats": { … }, "meta": { … }, "privacy": "PUBLIC", "visibility": "VISIBLE", "joinMode": "OPEN", "location": { … }, "timezone": { … }, "isMember": true, "pin": 0, "canManage": true, "isOwner": true, "roles": [ … ], "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupName": "string", "domain": "string", "local": true, "displayName": "string", "summary": "string", "uri": "http://example.com", "publicKey": "string", "forumId": "us_01hxcvk1hjexere4pvtrj0ymqq", "fields": { … }, "type": "CHANNEL", "membersUrl": "string", "banner": { … }, "avatar": { … }, "deletedAt": "2022-03-10T16:15:50Z", "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z", "refreshedAt": "2022-03-10T16:15:50Z", "secret": true } ]
Request
Retrieves all group memberships for the specified user. Privacy rules apply: requesting your own memberships returns all groups (public and private), while requesting another user's memberships returns only their public group memberships. Results are paginated.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/member/{userId}
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/member/{userId}
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/member/{userId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/member/us_01hxcvk1hjexere4pvtrj0ymqq?lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}' \
-H 'Authorization: YOUR_API_KEY_HERE'Response
application/json
[ { "groupName": "string", "groupDisplayName": "string", "username": "string", "displayName": "string", "domain": "string", "local": true, "groupAvatar": { … }, "userAvatar": { … }, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "memberId": "us_01hxcvk1hjexere4pvtrj0ymqq", "roles": [ … ], "meta": { … }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" } ]
Request
Retrieves all groups where the specified user is a member. Privacy rules apply: requesting your own groups returns all groups (public and private), while requesting another user's groups returns public groups and private groups where the viewer is also a member. Returns full Group objects rather than membership records. Results are paginated.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/member/{userId}/groups
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/member/{userId}/groups
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/member/{userId}/groups
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/member/us_01hxcvk1hjexere4pvtrj0ymqq/groups?lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}' \
-H 'Authorization: YOUR_API_KEY_HERE'List of groups the user is a member of
group metadata including color
- PUBLIC - Open Content. Content and membership are viewable by anyone.
- PRIVATE - Members-Only Content. Outsiders cannot see posts or members unless they join.
Enum"PUBLIC""PRIVATE"
- VISIBLE - The group is listed openly. It shows up in search results or directory listings, no matter if it's privacy is PUBLIC or PRIVATE.
- UNLISTED - The group does not appear in public lists or searches but is accessible via direct link.
- HIDDEN - The group is completely hidden and invite-only. Shared links will return 404 for non-members.
Enum"VISIBLE""UNLISTED""HIDDEN"
- OPEN - Anyone can join the group immediately without approval.
- APPROVAL - User requests must be approved by a group admin or moderator.
- INVITE_ONLY - Only users with an invitation from a member can join.
Enum"OPEN""APPROVAL""INVITE_ONLY"
Whether the current viewer can manage this group (owner, admin, or moderator)
ID of the forum associated with this group
Example: "us_01hxcvk1hjexere4pvtrj0ymqq"
Response
application/json
[ { "stats": { … }, "meta": { … }, "privacy": "PUBLIC", "visibility": "VISIBLE", "joinMode": "OPEN", "location": { … }, "timezone": { … }, "isMember": true, "pin": 0, "canManage": true, "isOwner": true, "roles": [ … ], "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupName": "string", "domain": "string", "local": true, "displayName": "string", "summary": "string", "uri": "http://example.com", "publicKey": "string", "forumId": "us_01hxcvk1hjexere4pvtrj0ymqq", "fields": { … }, "type": "CHANNEL", "membersUrl": "string", "banner": { … }, "avatar": { … }, "deletedAt": "2022-03-10T16:15:50Z", "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z", "refreshedAt": "2022-03-10T16:15:50Z", "secret": true } ]
Request
Retrieves all groups that were created by the currently authenticated user account. This returns groups where the user is the owner, not just a member. A single user account can own and manage multiple groups. Returns full Group objects with complete group details including private groups owned by the user. Results are paginated.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/owned
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/owned
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/owned
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/owned?lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}' \
-H 'Authorization: YOUR_API_KEY_HERE'List of groups owned by the current user
group metadata including color
- PUBLIC - Open Content. Content and membership are viewable by anyone.
- PRIVATE - Members-Only Content. Outsiders cannot see posts or members unless they join.
Enum"PUBLIC""PRIVATE"
- VISIBLE - The group is listed openly. It shows up in search results or directory listings, no matter if it's privacy is PUBLIC or PRIVATE.
- UNLISTED - The group does not appear in public lists or searches but is accessible via direct link.
- HIDDEN - The group is completely hidden and invite-only. Shared links will return 404 for non-members.
Enum"VISIBLE""UNLISTED""HIDDEN"
- OPEN - Anyone can join the group immediately without approval.
- APPROVAL - User requests must be approved by a group admin or moderator.
- INVITE_ONLY - Only users with an invitation from a member can join.
Enum"OPEN""APPROVAL""INVITE_ONLY"
Whether the current viewer can manage this group (owner, admin, or moderator)
ID of the forum associated with this group
Example: "us_01hxcvk1hjexere4pvtrj0ymqq"
Response
application/json
[ { "stats": { … }, "meta": { … }, "privacy": "PUBLIC", "visibility": "VISIBLE", "joinMode": "OPEN", "location": { … }, "timezone": { … }, "isMember": true, "pin": 0, "canManage": true, "isOwner": true, "roles": [ … ], "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupName": "string", "domain": "string", "local": true, "displayName": "string", "summary": "string", "uri": "http://example.com", "publicKey": "string", "forumId": "us_01hxcvk1hjexere4pvtrj0ymqq", "fields": { … }, "type": "CHANNEL", "membersUrl": "string", "banner": { … }, "avatar": { … }, "deletedAt": "2022-03-10T16:15:50Z", "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z", "refreshedAt": "2022-03-10T16:15:50Z", "secret": true } ]
Request
Retrieves the list of all members in the specified group as GroupMember objects. Public groups are accessible to all authenticated users, Private groups accessible to members only. Supports sorting by join time, posts, relationship to current user, domain, displayName, username, createdAfter, or entityType. Supports filtering by role, domain, displayName, username, createdAfter, and entityType. Supports pagination. If no filter parameters are provided, returns all members.
Security
header
Query
Filter members who joined after this date
Example: createdAfter=2022-03-10T16:15:50Z
Entity type to filter by (USER, BOT, APPLICATION, GROUP_CHANNEL)
Enum"USER""BOT""APPLICATION""GROUP_CHANNEL"
Sort field (case-insensitive)
Enum"JOIN""POSTS""FOLLOWERS""FOLLOWING""RELATIONS""DOMAIN""DISPLAY_NAME""USERNAME""CREATED_AT""ACTOR_TYPE"
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/members
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/members
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/members
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/members?createdAfter=2022-03-10T16%3A15%3A50Z&displayName=string&domain=string&entityType=USER&limit=0&offset=0&order=ASC&role=MEMBER&sort=JOIN&username=string' \
-H 'Authorization: YOUR_API_KEY_HERE'Response
application/json
[ { "groupName": "string", "groupDisplayName": "string", "username": "string", "displayName": "string", "domain": "string", "local": true, "groupAvatar": { … }, "userAvatar": { … }, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "memberId": "us_01hxcvk1hjexere4pvtrj0ymqq", "roles": [ … ], "meta": { … }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" } ]
Request
Performs an administrative search for group members with multiple filter criteria. Requires GroupMembers.Moderate permission. Can search by roles, actor type, status, country, domain, display name, username, IP address, or join date. Supports sorting by join time, display name, username, number of posts, or country. Results include detailed member information including statistics, last activity, and location data.
RBAC: requires GroupMembers.Moderate
Security
header
Query
Filter members who joined after this date
Example: createdAfter=2022-03-10T16:15:50Z
Entity type to filter by (USER, BOT, APPLICATION, GROUP_CHANNEL)
Enum"USER""BOT""APPLICATION""GROUP_CHANNEL"
Get older records (records with IDs less than this value) Alias maxId/max_id
Example: lastId=?lastId=${data.last().id}
Role filter: ADMIN for admin roles, MEMBER for regular members
Enum"MEMBER""ADMIN"
Get newer records (records with IDs greater than this value) Alias minId/min_id
Example: untilId=?untilId=${data.first().id}
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/members/search
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/members/search
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/members/search
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/members/search?country=string&createdAfter=2022-03-10T16%3A15%3A50Z&displayName=string&domain=string&entityType=USER&ip=string&lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&role=MEMBER&roles=string&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}&username=string' \
-H 'Authorization: YOUR_API_KEY_HERE'Paginated list of group member search results with total count
List of group member search results matching the search criteria
Group member metadata
Last active in the group (timestamp of latest post, comment, like, repost etc)
Example: "2022-03-10T16:15:50Z"
Member statistics in the group
Response
application/json
{ "list": [ { … } ], "total": 0 }
Request
Updates the role, status, or metadata of an existing group member. For local groups, the update is applied immediately. For federated groups, an ActivityPub message is sent to the remote server to request the update. Requires GroupMembers.Manage permission for the target group.
RBAC: requires GroupMembers.Manage
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/members/{memberId}
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/members/{memberId}
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/members/{memberId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X PUT \
https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/members/us_01hxcvk1hjexere4pvtrj0ymqq \
-H 'Authorization: YOUR_API_KEY_HERE' \
-H 'Content-Type: application/json' \
-d '{
"role": "string",
"meta": {
"description": "string"
}
}'Response
application/json
{ "groupName": "string", "groupDisplayName": "string", "username": "string", "displayName": "string", "domain": "string", "local": true, "groupAvatar": { "uploadId": "up_kjhwieuy2387928371", "uploaderId": "us_97234khddqdkuhqwij", "ownerId": "us_97234khddqdkuhqwij", "attachedToId": "pt_97234khddqdkuhqwij", "uploadType": "video", "meta": { … }, "size": 0, "files": [ … ], "tags": [ … ], "error": "string", "cached": true, "logs": "string", "remote": true, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }, "userAvatar": { "uploadId": "up_kjhwieuy2387928371", "uploaderId": "us_97234khddqdkuhqwij", "ownerId": "us_97234khddqdkuhqwij", "attachedToId": "pt_97234khddqdkuhqwij", "uploadType": "video", "meta": { … }, "size": 0, "files": [ … ], "tags": [ … ], "error": "string", "cached": true, "logs": "string", "remote": true, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "memberId": "us_01hxcvk1hjexere4pvtrj0ymqq", "roles": [ "string" ], "meta": { "description": "string" }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }
Request
Removes the specified user from the group. For local groups, the membership is deleted immediately. For federated groups, an ActivityPub message is sent to request removal. Requires GroupMembers.Manage permission. An optional reason can be provided for audit logging.
RBAC: requires GroupMembers.Manage
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/members/{memberId}
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/members/{memberId}
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/members/{memberId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X DELETE \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/members/us_01hxcvk1hjexere4pvtrj0ymqq?reason=Violation+of+community+guidelines' \
-H 'Authorization: YOUR_API_KEY_HERE'Response
application/json
true
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/members/{newOwnerId}/transfer-ownership
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/members/{newOwnerId}/transfer-ownership
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/members/{newOwnerId}/transfer-ownership
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/members/us_01hxcvk1hjexere4pvtrj0ymqq/transfer-ownership \
-H 'Authorization: YOUR_API_KEY_HERE'Response
application/json
{ "groupName": "string", "groupDisplayName": "string", "username": "string", "displayName": "string", "domain": "string", "local": true, "groupAvatar": { "uploadId": "up_kjhwieuy2387928371", "uploaderId": "us_97234khddqdkuhqwij", "ownerId": "us_97234khddqdkuhqwij", "attachedToId": "pt_97234khddqdkuhqwij", "uploadType": "video", "meta": { … }, "size": 0, "files": [ … ], "tags": [ … ], "error": "string", "cached": true, "logs": "string", "remote": true, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }, "userAvatar": { "uploadId": "up_kjhwieuy2387928371", "uploaderId": "us_97234khddqdkuhqwij", "ownerId": "us_97234khddqdkuhqwij", "attachedToId": "pt_97234khddqdkuhqwij", "uploadType": "video", "meta": { … }, "size": 0, "files": [ … ], "tags": [ … ], "error": "string", "cached": true, "logs": "string", "remote": true, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "memberId": "us_01hxcvk1hjexere4pvtrj0ymqq", "roles": [ "string" ], "meta": { "description": "string" }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/membership
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/membership
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/membership
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X DELETE \
https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/membership \
-H 'Authorization: YOUR_API_KEY_HERE'Request
Returns the membership information for the authenticated user in the specified group. Returns a MembershipInfo object with state indicating: MEMBER (active member), PENDING_JOIN (has pending join request), PENDING_INVITE (has pending invite), or NONE (no relationship). Authentication is required.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/membership
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/membership
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/membership
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/membership \
-H 'Authorization: YOUR_API_KEY_HERE'Response
application/json
{ "state": "MEMBER", "member": { "groupName": "string", "groupDisplayName": "string", "username": "string", "displayName": "string", "domain": "string", "local": true, "groupAvatar": { … }, "userAvatar": { … }, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "memberId": "us_01hxcvk1hjexere4pvtrj0ymqq", "roles": [ … ], "meta": { … }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" }, "joinRequest": { "groupJoinRequestId": "us_01hxcvk1hjexere4pvtrj0ymqq", "userId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "username": "string", "displayName": "string", "avatarId": "us_01hxcvk1hjexere4pvtrj0ymqq", "answerToken": "string", "status": "PENDING", "reason": "Approved - meets community guidelines", "createdAt": "2025-09-17T12:43:53.395287Z", "updatedAt": "2025-09-17T12:43:53.395287Z" }, "invite": { "groupInviteId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "inviterId": "us_01hxcvk1hjexere4pvtrj0ymqq", "inviteeId": "us_01hxcvk1hjexere4pvtrj0ymqq", "status": "PENDING", "message": "string", "email": "string", "inviterName": "string", "inviterDisplayName": "string", "inviterAvatar": { … }, "inviteeName": "string", "inviteeDisplayName": "string", "inviteeAvatar": { … }, "groupName": "string", "groupDisplayName": "string", "groupAvatar": { … }, "createdAt": "2022-03-10T16:15:50Z", "updatedAt": "2022-03-10T16:15:50Z" } }
Request
Retrieves the list of all members in the specified group. Public groups are accessible to all authenticated users, Private groups accessible to members only. Supports sorting by join time, posts, or relationship to current user. Supports role filtering and pagination.
Security
header
- Mock serverhttps://docs.wellesley.social/_mock/openapi/api/v1/groups/{groupId}/users
- Simple setup, all in one. Digital Oceanhttps://dust.allroads.social/api/v1/groups/{groupId}/users
- Simple setup, db is separate. Digital Oceanhttps://meteor.allroads.social/api/v1/groups/{groupId}/users
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://docs.wellesley.social/_mock/openapi/api/v1/groups/gr_01hz1f0kw36f82k9s4nzpc4s33n/users?lastId=%3FlastId%3D%24{data.last%28%29.id}&limit=0&offset=0&order=ASC&role=MEMBER&sort=JOIN&sortBy=string&sortOrder=string&untilId=%3FuntilId%3D%24{data.first%28%29.id}' \
-H 'Authorization: YOUR_API_KEY_HERE'List of users who are members of the group
Registration mode:
- REGULAR - just regular state
- SENSITIVE - all media attachments are flagged as sensitive, i.e. all user's posts should be marked as sensitive, old posts and all future ones.
- LIMITED - all user's old and future posts should be set maximum to followers only unless user set it to direct himself. non-followers should not be notified, i.e. if user mentions non-follower we do not create notification.
- SUSPENDED - User can login, but cannot do anything in his account except to read, cannot change anything, cannot create new posts or comments etc. All his posts are marked as deleted, but we do not delete them just yet. User is scheduled to be deleted in one month. During this month it is possible to restore it via admin.
Enum"REGULAR""SENSITIVE""LIMITED""SUSPENDED"
Entity type: USER, BOT, APPLICATION, GROUP_CHANNEL
Enum"USER""BOT""APPLICATION""GROUP_CHANNEL"
Group ID if this is a group channel, group user or category.
Example: "us_01hxcvk1hjexere4pvtrj0ymqq"
- PUBLIC - Channel is visible to everyone and can be followed by anyone.
- PRIVATE - Channel is visible only to group members and can only be followed by group members.
Enum"PUBLIC""PRIVATE"
Types that an Actor can be assigned. Coincide with ActivityPub Actor types:
- APPLICATION: Apps will have this type
- GROUP: Interest Groups and Generic Groups wil have this type
- ORGANIZATION: Formal Organizations such as Companies, Institutions, etc. will have this type
- PERSON: Individual people will have this type
- SERVICE: Bots, Services, and other automated tools which are not also Apps will have this type
Enum"Application""Group""Organization""Person""Service"
Follow approval mode: AUTO_APPROVE, MANUALLY_APPROVES, or UNKNOWN
Enum"AUTO_APPROVE""MANUALLY_APPROVES""UNKNOWN"
Whether this is a channel or a user. Deprecated: use 'entityType' instead.
Response
application/json
[ { "id": "us_01hxcvk1hjexere4pvtrj0ymqq", "username": "john_smith", "domain": "wlsly1.net", "local": true, "displayName": "John Smith", "uri": "https://wlsly1.net/users/john_smith", "avatar": { … }, "createdAt": "2022-03-10T16:15:50Z", "state": "REGULAR", "relationship": { … }, "entityType": "USER", "appMeta": {}, "groupId": "us_01hxcvk1hjexere4pvtrj0ymqq", "groupPrivacy": "PUBLIC", "groupUserName": "string", "actorType": "Application", "channel": true, "deleted": true, "groupAvatar": { … }, "groupName": "string", "groupDisplayName": "string", "followApproval": "AUTO_APPROVE", "groupPrimary": true, "groupAutoSubscribe": true } ]
API endpoints for managing group entry questions. Groups can require prospective members to answer questions before joining. Questions support multiple types (text, single choice, multiple choice) and are used to screen members when the group's join mode is set to QUESTIONS. Answers are validated and generate a token that can be used during the join process.
Operations
API endpoints for managing community rules within groups. Rules define the expected conduct and content policies that members must follow. Each rule consists of text (the rule itself), a hint (explanation or context), and an ordering value for display sequence. Rules are scoped to specific groups and can be managed by users with appropriate permissions.
Operations
Login method management for authenticated accounts. Allows adding or removing email/password and phone number as authentication methods. Adding a login method requires email or SMS verification. Removing a method is blocked if it is the last remaining login identifier. All changes are audited. All endpoints require authentication.
Operations
User muting functionality for hiding content from specific users without blocking them. Muting a user hides their posts from your timelines and notifications, but does not prevent them from following you or interacting with your content. Mutes can be temporary (with an expiration duration) or permanent. All endpoints require authentication.
Operations
User notification management for retrieving, counting, and updating notification status. Notifications are generated by user interactions such as follows, mentions, reposts, and likes. Supports filtering by notification type and status (read/unread). All endpoints require authentication.
Operations
Password management endpoints for changing and recovering account passwords. Supports two flows: authenticated password change (requires current password and email confirmation) and unauthenticated password recovery (sends reset code to account email). All password changes invalidate other active sessions for security.
Operations
Phone number change management for authenticated users. Implements a secure 4-step phone change flow: (1) request change and receive SMS code on current phone, (2) verify current phone ownership, (3) submit new phone number and receive SMS code, (4) verify new phone number. All endpoints require authentication.
Operations
Endpoints for managing Pins (top-level posts) and Highlights (pinned replies). Top-level pins are shown first in the profile scope and are limited by admin setting Maximum number of pinned posts. Replies can be pinned as highlights under their root post. Pin and unpin actions are federated via ActivityPub.
Operations
Endpoints for managing platform-wide and group-specific data storage. Unlike application data, this provides direct data management not tied to specific applications. Supports flexible ownership models including platform-level, group-level, and user-level data with appropriate access controls.
Operations
Endpoints for creating, reading, updating, and deleting posts, as well as managing comments, likes, bookmarks, reposts, subscriptions, and votes. Most endpoints require authentication; read-only feed and post endpoints are accessible to guests via @PermitAll. Post mutations are federated via ActivityPub.
Operations
Endpoints for retrieving Role-Based Access Control (RBAC) configurations and managing roles, resources, permissions and role-to-user assignments. Scoped Role Definition (RBACRole):
- Represents roles within the RBAC system.
- Each role has a unique
roleId, aname, an optionaldescription, and ascope. - The
scopedefines the domain or area in which the role is valid. - The
scopecan be Global (hardcoded), currently the only one is "global" - The
scopealso can be dynamic, currently we use Group Ids, like "gr_05hxcvk1hjexere4pvtrj0hggt" - Roles come with assigned permissions (
RBACPermissions) that define what actions the role can perform on system resources. - Metadata such as
createdAtandupdatedAttimestamps track the role's lifecycle events.
Permissions (RBACPermissions):
- Encapsulates resource-specific access controls.
- Each permission object specifies the
resource(e.g., "user", "document") and an associated list of allowedRBACAccesstypes. RBACAccessenumerates the supported actions:Read,Add,Modify,Delete.
Role Assignments to Actors (RBACActorRole):
- Maps actors (e.g., users, services) to specific roles.
- Tracks the association through
actorId(representing the unique entity being assigned) androleId(specific role ID). - Includes timestamps to record when the assignment was created or updated.
Operations
API to retrieve followers and following collections for remote (federated) users. Fetches collection data from remote ActivityPub servers, resolves actor URIs to user profiles, and returns them in the local user format. Supports pagination via offset/limit parameters. All endpoints are publicly accessible (@PermitAll) and operate on remote users only -- local users are rejected.
Operations
Authentication session management endpoints. Allows users to view active sessions across devices, revoke individual sessions or all other sessions, and permanently delete session records. Sessions are tracked in both the database and Redis for real-time state synchronization. All endpoints require authentication. The current session cannot be revoked or deleted.
Operations
Endpoints for uploading, retrieving, and managing media files. The upload flow is two-step: first create an upload via POST to get an upload URL, then PUT the actual file content to that URL. Most endpoints require authentication. Class-level @RBACAuthorize requires authentication by default; public endpoints use @PermitAll.
Operations
User profile management endpoints. Handles user creation, retrieval by ID or username, profile updates, deletion, and social graph queries (followers/following). Supports both authenticated and guest access with varying levels of detail. Guest users receive basic profile data; authenticated users can access relationship statuses and full profiles.
Operations