Hackers Colony

API Docs

Hackers Colony exposes a small set of read-only endpoints. All content is public and served over the same origin as the site.

Public endpoints

GET
/api/content/posts

All published posts with their author, category and tags.

[
  {
    "id": "uuid",
    "slug": "example-post",
    "title": "Example Post",
    "description": "Short excerpt",
    "contentFormat": "markdown",
    "publishedAt": "2026-01-01T00:00:00Z",
    "category": { "name": "Web Security", "slug": "web-security" },
    "author": { "name": "Author", "slug": "author" },
    "tags": [{ "name": "XSS", "slug": "xss" }]
  }
]

Served from this site so browsers never need the internal content service.

GET
/api/me

Whether the current session holds admin access.

{ "isAdmin": false }

Returns a single boolean; the admin allow-list is never exposed.

GET
/status

Live health of the website, content service and database.

HTML status page

Internal service

These run behind the reverse proxy and are consumed server-side. They are documented for transparency; they are not part of a public API contract and may change.

GET
/health

Content service liveness check.

{ "status": "ok" }

GET
/posts

Published posts, read from the database under row-level security.

Array of post rows

GET
/categories

All public categories.

Array of category rows

GET
/tags

All public tags.

Array of tag rows

POST
/api/track

First-party analytics ingest (called by the site itself).

204 No Content

Notes

  • All content reads are gated by row-level security: drafts are never returned publicly.
  • Creating, editing and deleting posts happens through the admin area and requires admin access.
  • Live availability of these services is shown on the status page.