# SocialSphere

SocialSphere gives every user a calm personal homepage with per-row privacy and
a truthful agent-first API. Version 1.4.0 (updated 2026-07-25 07:04 AM PDT).

## Site
- Production: https://social.globalbr.ai
- Repo: https://github.com/tmad4000/SocialNetworkApp

## Auth
- Browser session cookie via POST /api/login.
- Agent key: "Authorization: Bearer social_..." (compat: "X-Agent-Key: social_...").
- A valid agent key acts as its owning user on the supported endpoints below.
  Header presence alone never authorizes; invalid, revoked, or expired keys
  return 401. Agent keys work ONLY on these endpoints and cannot reach legacy
  routes.
- Agent-key management (/api/agent-keys) is browser-session-only: an agent key
  cannot list, mint, or revoke keys.
- Throttling is in-memory per process, so limits are per-instance on a scaled
  deployment. Honor Retry-After on 429.

## Privacy
- Each homepage row is public, friends, or private.
- public: everyone including signed-out agents. friends: owner + accepted
  friends. private: owner only.

## Endpoints
- GET /api/meta — Public release metadata and discovery links. (auth: none)
- GET /api/me — Safe profile of the effective authenticated actor. (auth: session_or_agent)
- GET /api/profile-home/{username} — Viewer-aware personal homepage for a user. (auth: none)
- GET /api/profile-home/me — The authenticated owner's full homepage, including private rows. (auth: session_or_agent)
- POST /api/profile-home/items — Create a homepage row. (auth: session_or_agent)
- PATCH /api/profile-home/items/{id} — Update an owned homepage row. (auth: session_or_agent)
- DELETE /api/profile-home/items/{id} — Delete an owned homepage row. (auth: session_or_agent)
- PUT /api/profile-home/reorder — Reorder owned homepage rows in a single transaction. (auth: session_or_agent)
- GET /api/agent-keys — List agent-key metadata for the authenticated owner. (auth: session_only)
- POST /api/agent-keys — Mint an agent key; the raw key is returned exactly once. (auth: session_only)
- DELETE /api/agent-keys/{id} — Revoke an owned agent key. (auth: session_only)

## Discovery
- Human profile: https://social.globalbr.ai/p/{username}
- JSON profile: https://social.globalbr.ai/api/profile-home/{username}
- OpenAPI: https://social.globalbr.ai/openapi.json
- Manifest: https://social.globalbr.ai/.well-known/socialsphere.json
- Agent guide: https://social.globalbr.ai/agents
- API docs: https://social.globalbr.ai/api-docs

## MCP
- status: not_available