API Reference

all API routes live under /api/* and are handled by PHP.

Auth And Account

/api/account/is-admin

• returns { isAdmin: boolean }
• refreshes frontend admin awareness for maintenance-mode bypass logic

/api/settings

GET

• requires logged-in user
• returns current settings from data/accounts/accounts.json
• currently exposes glowIntensity, colors, and mobileFriendlyView

POST

• requires logged-in user
• updates user settings in accounts.json
• can set mobileFriendlyView and sync the mobile_friendly_view cookie
• validates color fields as #RRGGBB
• admin users can also toggle maintenance mode through the settings flow

/api/bookmark

POST only.

• requires logged-in user for server persistence
• supports single toggle via postId
• supports full replacement via bookmarks
• writes normalized bookmark ids back to accounts.json
• anonymous bookmarking is handled client-side in localStorage instead

Content / Media

/api/feed-post

• returns parsed feed post JSON for a supplied ?id=

/api/gallery/delete

• admin-only image deletion from data/images
• validates filename/path and allowed image extensions

/api/newsletter/publish

• writes newsletter HTML to data/newsletter/{id}.html
• this is the real publish endpoint, not an /email/* route

/api/sitemap

• admin-only sitemap generator
• scans routes and content files
• writes /sitemap.xml

Toast / Stream / Status

/api/discord-bot-status

• reads data/etc/toast.json
• returns bot and stream status payload for UI consumers

/api/discord-bot-control

POST JSON payload with stream info.

• updates stream URL and name in data/etc/toast.json
• writes a stream update signal for downstream consumers

/api/discord-bot-control/status

POST JSON payload with bot status.

• updates bot online/offline state in data/etc/toast.json

/api/stream-proxy

• same-origin proxy for stream audio playback
• host-restricted based on configured stream host
• used by toast playback UI

Telemetry / System

/api/page-view

POST JSON payload with { path }.

• normalizes route path
• rejects /api/* paths
• hashes client IP before storage
• updates data/etc/page_views.json
• returns updated page count

/api/system/usage

• returns CPU, memory, and disk usage data
• includes Linux and Windows code paths

Implementation Notes

• most endpoints return JSON and perform direct file IO
• write-heavy endpoints should be treated carefully because there is no database transaction safety blanket here
• /api/page-view already uses file locking, which is the sane move