Public Browsing
no authPublic profile lookup, featured profiles and anonymous analytics events
Profile Lookup
GET /profile?username=… or ?account_id=… — exactly one param; private/unknown profiles → PROFILE_NOT_FOUND 404
Like Profile (toggle)
POST /profile/like — auth required; toggles your like on the profile loaded above (own profile allowed). liked in the response is the state after the call.
Load a profile in the lookup section first.
Sign in first — POST /profile/like requires a bearer token (401 UNAUTHENTICATED otherwise).
Public Like (anonymous, cookie toggle)
POST /profile/public-like — no auth; the visitor is identified by the selenial_like_visitor cookie and the like toggles. Re-load the profile above without auth to see is_liked reflect the cookie.
Load a profile in the lookup section first.
No bearer token is sent. The browser stores/sends the HttpOnly selenial_like_visitor cookie (via credentials:'include'), so a second click toggles the like off. Clearing cookies = a new visitor (a fresh like).
Featured Profiles
GET /featured-profiles?limit=N&tag=SLUG — public; only public+featured profiles, most recently featured first. Cards include is_liked for the authenticated caller.
Tag Vocabulary
GET /tags — public; the closed list profile tags are drawn from. Slugs are stable ids; the descriptions are what the backend shows the analyser.
Quick Analytics Event
POST /profile/interactions — public, throttle 60/min; fires against the profile loaded above
Load a profile in the lookup section first.
visitor_hash (localStorage selenial_qa_visitor_hash): not minted yet — the first event below mints one
Minted by POST /profile/visitors. The backend resolves it rather than trusting it, so repeat events count as one unique visitor, and an identical event repeated within the dedupe window comes back recorded: false.