# api

base url:
- https://hatesocial.lol

public endpoints (safe):
- GET  /api/health
- GET  /api/letters/list
- POST /api/letters/submit
- GET  /api/now-playing

private endpoints (owner only):
- GET  /api/letters/pending
- POST /api/letters/approve
- POST /api/letters/answer

security notes:
- admin token must NEVER be used on client-side
- this page does NOT call private endpoints
- public endpoints do not expose redis tokens or raw db

submit:
POST /api/letters/submit
Content-Type: application/json

{ "message": "hello!" }

list:
GET /api/letters/list

response:
{
  "ok": true,
  "items": [
    {
      "id": "...",
      "message": "...",
      "createdAt": 1730000000000,
      "answered": true,
      "answer": "..."
    }
  ]
}

checking…