Getting Started

The Sublay REST API is a project-scoped HTTP API. All endpoints follow the same base structure and share common conventions for authentication, pagination, and error reporting.

Base URL

All API requests are made to:

https://api.sublay.io/v7/:projectId

Replace :projectId with the UUID of your Sublay project, which you can find in the Sublay dashboard. So every endpoint takes the form:

https://api.sublay.io/v7/:projectId/<endpoint>

Request Format

Most endpoints accept application/json. Endpoints that support file uploads accept multipart/form-data. The Content-Type header should be set accordingly.

POST /v7/:projectId/auth/sign-in
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "secret"
}

Authentication

Protected endpoints require a Bearer token in the Authorization header:

GET /v7/:projectId/app-notifications
Authorization: Bearer <accessToken>

See Authentication for full details on obtaining and refreshing tokens.

Pagination

Endpoints that return lists use cursor-free offset pagination. Pass page and limit as query parameters:

Parameter	Default	Max	Description
`page`	`1`	—	Page number (1-indexed)
`limit`	varies	varies	Results per page (endpoint-specific)

Paginated responses always return the same envelope:

{
  "data": [...],
  "pagination": {
    "page": 1,
    "pageSize": 20,
    "totalPages": 5,
    "totalItems": 97,
    "hasMore": true
  }
}

Error Format

All error responses follow a consistent structure:

{
  "error": "Human-readable error message.",
  "code": "feature/error-slug"
}

Some errors include an additional field key (e.g., validation errors on a specific input field):

{
  "error": "Username already taken",
  "field": "username",
  "code": "DUPLICATE_USERNAME"
}

Common HTTP Status Codes

Status	Meaning
`200`	Success
`201`	Resource created
`400`	Bad request — invalid input or missing required fields
`401`	Unauthorized — missing or expired token
`403`	Forbidden — valid token but insufficient permissions
`404`	Not found
`409`	Conflict — duplicate resource (e.g., email already in use)
`429`	Rate limit exceeded
`500`	Internal server error

Rate Limiting

Each endpoint has its own rate limit, applied per project and per IP. When a limit is exceeded, the API returns 429 Too Many Requests. Limits are noted per endpoint in this reference.

Authentication

Overview

Auth Endpoints

OAuth Endpoints

User Endpoints

User Follow Operations

User Connection Operations

Follow Endpoints

Connection Endpoints

Entity Endpoints

Comment Endpoints

Chat — Conversations

Chat — Members

Chat — Messages

Collection Endpoints

App Notification Endpoints

Push Notification Endpoints

Report Endpoints

Search Endpoints

Space Endpoints

Space — Membership

Space — Rules

Space — Moderation

Space — Chat

Event Endpoints

Storage Endpoints

Utils

Crypto

Base URL

Request Format

Authentication

Error Format

Common HTTP Status Codes

Rate Limiting

​Base URL

​Request Format

​Authentication

​Pagination

​Error Format

​Common HTTP Status Codes

​Rate Limiting

Base URL

Request Format

Authentication

Pagination

Error Format

Common HTTP Status Codes

Rate Limiting