API Routes
REST API reference for api.frii.site
HTTP Headers
x-auth-token Main auth token returned from /login. Required for all authenticated endpoints.
x-auth-request SHA-256 hash of username and password, concatenated with a pipe: sha256(username)|sha256(password). Used during login.
x-plain-username Plain-text username sent alongside x-auth-request during login so the server knows which user to verify.
x-captcha-code Cloudflare Turnstile captcha token. Required for login and registration to prevent automation.
x-mfa-code 6-digit TOTP code sent when the account has multi-factor authentication enabled. Returned after a 412 response.
Content-Type Set to application/json for all POST/PATCH endpoints that include a JSON body.
Cookie: refresh_token HttpOnly cookie containing the refresh token. Sent to /refresh when the auth token expires (code 460).
Custom Status Codes
460 Auth token expired. Call /refresh with the refresh token cookie to get a new one.
461 Insufficient permissions. The current auth token does not have access to this resource.
462 Feature not available. The requested functionality is not enabled for this account or tier.