Getting Started

Introduction

The reference is your key to a comprehensive understanding of the Fadfed API.

This document explains how to use Fadfed's api server. This is the entry point of the app.

It is used mainly for Auth, User profile update and file uploads.

Requirements

• You must use a valid token to send requests to the API endpoints. See below how to to generate a valid token.
• You must add a devid param to all all request.
• You must add a session-id param and X-SESSION-ID header.
• You must set the User-Agent header to Fadfed/{version}({platform}/{platformVersion}) for example for Android app we use Fadfed/4.7.7(Android/14)
• The API only responds to HTTPS-secured communications. Any requests sent via HTTP return an HTTP 301 redirect to the corresponding HTTPS resources.
• The API returns request responses in JSON format. When an API request returns an error, it is sent in the JSON response as an error key.

Authentication

There's multiple degrees to authentication used in this API server.

1. Token based authentication
2. Basic auth based on devid and token
3. JWT token authentication for authenticated users.

See below an explanation of each type.

MD5 Token Based Authentication

We use a token we generate using this formula to authenticate that requests are coming through the app and valid. this is a legacy request authentication system that we might remove in the future.

Token = md5 of SESSION_ID using DEVID as key.

JavaScript

import crypto from "crypto";
const token = crypto.createHmac('md5', SESSION_ID).update(DEVID).digest('hex');

Basic Auth based on devid and md5 token

Similar to Token based authentication, we should use Basic auth using devid for username and token for password ei: set Authorization header to basic base64(devid:token)

JWT Token Authentication for authenticated users

For app users, there's multiple ways to create an account. For iOS app users there's only login using apple ID, but for Android there's Google, Huawei and Facebook. Once signed up, the API returns a JWT auth token that needs to be sent with all subsequent request as the auth request query param.

Authentication error response

If token. basic token or auth key is missing, malformed, or invalid, you will receive an HTTP 401 Unauthorized response code with a message that specifies which authentication parameter is missing/invalid.

Base Endpoints

We have two environments production and development.

For local development the default endpoint is http://localhost:5100/

For development the base URL we use is: https://dev.wefaaq.net/api

for Production the base endpoint is: https://v2.fadfedly.com/api

Tenants

Each app in the Fadfed system is identified by an id we call tenant

To Send a request to a specific tenant add @tenant as the first path of the base URL.

• For Fadfed app the tenant is fadfedx
• For Chitter the tenant is chitter
• For hopchat the tenant is hopchat
• For Chillo the tenant is chillo
• for old fadfed app the tenant is fadfed
• for old chitter app the tenant is anonymous

For Example if we want to make request for the Fadfed app we would in development we would use https://dev.wefaaq.net/api/@fadfedx

If we want to do that in local development we would use http://localhost:5100/fadfedx

Rate Limits

Rate-limited requests will return a "rate_limited" error code (HTTP response status 429). The rate limit for incoming requests per integration is an average of three requests per second. Some bursts beyond the average rate are allowed.

Status Codes

HTTP response codes are used to indicate general classes of success and error.

Success Code

Error Codes

Error responses contain more detail about the error in the response body, in the "code" and "message"properties.

Endpoints

Endpoints