API Reference
These are the internal REST endpoints the Android/iOS apps use
to talk to the website backend. All are flat PHP files under /api/, returning
JSON. Endpoints other than auth.php and health.php require a
Authorization: Bearer <token> header obtained from
POST /api/auth.php.
Authentication
| Endpoint | Method | Purpose |
|---|---|---|
/api/auth.php | POST | Exchange email/password for a device API token. |
/api/health.php | GET | Public liveness probe (no auth) — {status, db, time}. |
Account & Status
| Endpoint | Method | Purpose |
|---|---|---|
/api/user_status.php | GET | Returns tier, data used, data limit. |
/api/user_settings.php | GET/POST | Read/update data-saver limits, app exclusion list, Fusion server region. |
/api/app_priorities.php | GET/POST | Read/update per-app bonding priority (Pro). |
Bonding & Telemetry
| Endpoint | Method | Purpose |
|---|---|---|
/api/heartbeat.php | POST | Reports current aggregate speed + active paths; drives the live dashboard. |
/api/analytics_upload.php | POST | Batch upload of per-path latency/loss/throughput metrics (every ~5 min). |
/api/scheduler_priors.php | GET | Aggregated, anonymized warm-start priors for the on-device AI scheduler. |
/api/fusion_servers.php | GET | List of available Fusion edge servers (region, host, load). |
/api/p2p_signal_token.php | POST | Mints a short-lived signaling ticket for the P2P relay's WebSocket handshake. |
Errors
All endpoints return a JSON body with an error field and an appropriate HTTP
status code (401 unauthenticated, 403 forbidden/suspended, 422 validation, 429 rate-limited,
500 server error) on failure.
Rate limits
Every endpoint is rate-limited per authenticated device token (or per IP for
auth.php). Exceeding the limit returns HTTP 429.
Need something the API doesn't cover yet? Let us know.