Skip to main content
The Tightknit Admin API v1 lets you read and manage your community’s data over REST. Resources live at URLs under /v1, and request and response bodies are JSON, except file uploads, which send multipart/form-data. Each endpoint page shows whether it reads (GET) or writes (POST, PATCH, DELETE).

​
Endpoint

Tightknit’s v1 REST API endpoint is:

​
Authentication

​
API keys

To create and manage API keys, see API Keys. Send the key as a bearer token in the Authorization header. The Bearer prefix is required.
A request without a bearer token returns 401 with the code unauthorized. A key that is not valid returns 401 with the code invalid_token. To check which community and permissions a key carries, call GET /v1/api_key. It needs no permission.

​
Permissions

Each endpoint requires a permission for the family of data it touches. Reading needs the family’s read permission (for example api:admin:feeds:read). Writing needs the family permission itself (api:admin:feeds), which also grants reading. Expanding a related object with expand also requires the read permission for that object’s family. A missing permission returns 403 with the code insufficient_scope.

​
Responses

Every resource object carries an object field naming its type. Most objects also carry an id with a short prefix for their type, for example feed_4h2o89z6qlpw for a feed or prof_5Yq7tVz2Hm3n for a member. Field names are snake_case, and timestamps are RFC 3339 strings in UTC. Creating or updating an object returns 200 with the full object, the same shape a GET returns. Deleting one returns 200 with the object’s type, its id and "deleted": true. Send write bodies as JSON with Content-Type: application/json, up to 1 MiB. File uploads are the exception. Send POST /v1/files a multipart/form-data body instead. The file can be as large as your plan’s upload limit, which can exceed 1 MiB. Every response includes a Request-Id header. Include it when you contact support about a request.

​
Pagination

Most list endpoints return a list object, paginated with a cursor:
  • Unless an endpoint documents its own ordering, results are ordered newest first, by created_at.
  • limit sets the page size, from 1 to 100. The default is 20.
  • To fetch the next page, pass the previous page’s next_cursor as starting_after. When next_cursor is absent, you have reached the last page.
  • Lists that offer other orders take a sort parameter: a field name sorts ascending, and a leading - descending (sort=-start_date).
  • A cursor only works with the filters and sort that produced it. Changing either while reusing a cursor returns 400.
A few lists return everything in one response or use their own ordering. Each endpoint’s page says when it does.

​
Filtering

Most lists accept:
  • id, repeated to fetch specific objects: ?id=feed_4h2o89z6qlpw&id=feed_9x1k3m7p2q8r (up to 100 values).
  • created_at[gte] and created_at[lte] to bound the creation time.
Each endpoint documents the filters it supports. Filters that take an operator use the field[operator] form. Objects reference related objects by ID, for example a feed’s created_by_id. Endpoints that support it accept expand to embed the related object in the same response, such as ?expand=created_by. Repeat the parameter to expand more than one relation. Each endpoint lists the relations it can expand.

​
Errors

Errors use the problem details format with Content-Type: application/problem+json:
Branch on code, not on title or detail. Validation errors return 400 with the code invalid_request. When a specific parameter failed, a param field names it. An undeclared query parameter or body field is refused rather than ignored, and param names it, with its path when it is nested (integrations.slack.channel_ids).

​
Rate limits

Requests are limited per community, not per API key, so adding keys does not add capacity. Each community gets, per minute:
  • 600 reads.
  • 300 writes.
  • 60 calls to a few costly endpoints, such as search, uploading a file and deleting an event, which count against this budget instead of the read or write one.
Each budget is counted separately in each Cloudflare data center that serves your traffic. A separate per-IP limit applies before your API key is checked. It sits well above the community limits, so it only matters if you send many communities’ traffic from a single outbound IP. A throttled request returns 429 with these headers: Successful responses do not carry rate limit headers. Pace your retries with Retry-After.