The Mesh.me API

The personal data API

Everything mesh.me knows that's yours, readable by you, with a token. Read-only. Your account only. The data API is the same for everyone. Your data doesn't have a paywall.

Quickstart

Mint a token in Privacy Controls, then:

curl -H "Authorization: Bearer mesh_pat_..." \
  https://meshs.me/api/me/v1/posts?limit=50

Pages come back as {data, nextCursor} — pass the cursor back to continue. Tokens are for scripts and servers, not script tags: the API sends no CORS headers on purpose, because a token in browser JavaScript is a leak in progress.

The token, honestly

A token looks like mesh_pat_<fingerprint>.<secret> and matches ^mesh_pat_[A-Za-z0-9_-]{12}\.[A-Za-z0-9_-]{43}$ — grep your repos and logs for it. We keep a fingerprint, not the token: it is hashed at creation and nobody at mesh.me can read it back. Every token expires (a year at most), every token is revocable instantly, and a revoked token is deleted — not flagged, deleted. If one leaks: it could only ever read, only your account, only its scopes, and it dies the moment you revoke it.

Resources

• GET /api/me/v1

  Who this token is: name, fingerprint, scopes, expiry, and this index.

• GET /api/me/v1/profileprofile:read

  Your profile fields and follower/following/post counts. Includes your email — scope accordingly.

• GET /api/me/v1/postsposts:read

  Your mesh.me posts, newest first. /posts/{id} fetches one.

• GET /api/me/v1/commentsposts:read

  Comments you wrote.

• GET /api/me/v1/reactionsposts:read

  Reactions you gave (post ids, not other people).

• GET /api/me/v1/savesposts:read

  Posts you saved (ids and timestamps).

• GET /api/me/v1/imported/accountsimported:read

  Your connected platforms — names and sync facts, never credentials.

• GET /api/me/v1/imported/postsimported:read

  Your imported platform posts with their engagement totals.

• GET /api/me/v1/imported/commentsimported:read

  Your own comments as imported from platforms.

• GET /api/me/v1/imported/mediaimported:read

  Media attached to your imported posts.

• GET /api/me/v1/analyticsanalytics:read

  Stored per-platform analytics snapshots, exactly as the data export ships them.

• GET /api/me/v1/journaljournal:read

  Meshi's journal, if you keep one. Off means {granted:false} — never an error.

What is deliberately not here

• Messages and MeChat. A conversation has a counterparty — their half is not yours to stream through a standing credential.
• Notifications. The rows name the people who acted — other people's identities.
• Follower and following lists. Counts are in your profile; the edges are other people's identities. The one-shot data export remains the place for them, with you present.
• Flow watch history. The most intimate table in the product. Not exposed here, and flagged for its own careful treatment.
• Other people's content. Feed items, public posts, anything authored by someone else.
• Blocks, mutes, and reports. Safety lists stay off every wire.
• Credentials and security records. Platform tokens, sessions, password data, verification records — no token reads the keys to anything, including itself.
• Anything billing. Stripe state never serializes toward a token.
• Writes of any kind. The API is read-only. Posting, settings, and money always require you, present, signed in.

Limits and answers

60 requests a minute and 600 an hour per token, 1,000 an hour per account — a full backfill fits in an hour, a daily sync in single digits. A 401 means the token doesn't work; we won't tell you whether a dead token was ever real — that's deliberate. A 403 names the missing scope. A 404 is the same for a thing that doesn't exist and a thing that isn't yours. v1 only ever gains fields, never loses or renames them; anything breaking would be a v2 beside it.