Account

Your own data and API key management. Reading your own stats requires an API key; creating and revoking keys requires the signed-in session cookie.

GET /api/v1/me Account

Identifies the caller from the API key and returns that user's stats. The profile, scores, and coding minutes belong to the key owner and are identical to the public user endpoint for the same id.

Auth: Authorization: Bearer <key>

Responses

  • 200 - your UserStats.
  • 401 - missing or invalid API key.

Example

curl -H "Authorization: Bearer shiptalkers_..." \
     https://shiptalkers.kirze.de/api/v1/me
GET/POST /api/v1/keys Account

GET lists the signed-in user's active keys: public id, creation time, and last-used time. Full keys are never returned.

POST creates a new key. The full key is returned exactly once at creation; store it, as it can never be retrieved again (only a hash is stored).

Auth: signed-in session cookie.

CSRF: POST and DELETE requests must include the token from the st_csrf cookie in an X-CSRF-Token header. The cookie is set at sign-in and refreshed on the account page.

Example

curl -b session.cookie https://shiptalkers.kirze.de/api/v1/keys

curl -b session.cookie -H "X-CSRF-Token: <st_csrf from the account page>" \
     -X POST https://shiptalkers.kirze.de/api/v1/keys

POST example response

{
  "key_id": "key_9f3a",
  "key": "shiptalkers_2f8d1a9c...",
  "created_at": 1736092800
}
DELETE /api/v1/keys/{key_id} Account

Permanently revokes one of your API keys. Requests authenticated with a revoked key are rejected immediately.

Path parameters

  • key_id - public id of the key to revoke.

Auth: signed-in session cookie.

Responses

  • 204 - revoked.
  • 401 - not signed in.
  • 403 - missing or invalid CSRF token.
  • 404 - no such key for this user.

CSRF: include X-CSRF-Token as above.

Example

curl -b session.cookie -H "X-CSRF-Token: <st_csrf from the account page>" \
     -X DELETE \
     https://shiptalkers.kirze.de/api/v1/keys/key_9f3a