Fediverse and Bluesky

The fediverse

activitypub-service

This installation on the fediverse, by ActivityPub: what other servers ask of it and send to it, a person's choice to be on it, finding somebody elsewhere, and the servers it refuses (federation.md). Optional: an installation may not run it.

Where WebFinger is

GET/.well-known/host-meta

An XRD document (RFC 6415), for servers that look for WebFinger this way.

Who: Anyone, signed in or not

Answers

200
the XRD document
string application/xrd+xml

Request

curl "https://api.example.org/.well-known/host-meta"

const response = await fetch('https://api.example.org/.well-known/host-meta', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/.well-known/host-meta",
)
answer = response.json()

Who an account is

GET/.well-known/webfinger

WebFinger (RFC 7033): where another server finds somebody here by their handle.

Who: Anyone, signed in or not

Parameters

resourcestringin query
acct:ana@example.org, or the address of somebody's actor.

Answers

200
OK
activitypub.JRD application/jrd+json
400
no resource, or not one that is asked about
404
nobody here by that name is on the fediverse

Request

curl "https://api.example.org/.well-known/webfinger"

const response = await fetch('https://api.example.org/.well-known/webfinger', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/.well-known/webfinger",
)
answer = response.json()

The servers refused

GET/activitypub/blocks

Who: A super administrator

Parameters

qstringin query
Words the name or the reason holds.
startintegerin query
How many to pass over.
limitintegerin query
The most to send: 50 unless asked, 200 at most.

Answers

200
OK
object application/json
401
no token, or one that has expired
403
the viewer may not do this

Request

curl "https://api.example.org/activitypub/blocks" \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch('https://api.example.org/activitypub/blocks', {
  method: 'GET',
  headers: { Authorization: `Bearer ${token}` },
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/activitypub/blocks",
    headers={"Authorization": f"Bearer {token}"},
)
answer = response.json()

Answer · 200

{
  "data": [
    {
      "created_at": "2026-10-27T09:30:00Z",
      "created_by": 1,
      "domain": "string",
      "reason": "string"
    }
  ],
  "pagination": {
    "limit": 1,
    "offset": 1,
    "total": 1
  }
}

Refuse a server, or change why

POST/activitypub/blocks

Nothing from it is taken, and nothing is sent to it.

Who: A super administrator

Body application/json

domainstring
The server's name, or an address or a handle on it.
reasonstring
Why it is refused.

Answers

201
Created
DomainBlock application/json
400
domain_required: the request names no server; domain_unreadable: it is not a server's name; domain_is_here: it is this installation
Refusal application/json
401
no token, or one that has expired
403
the viewer may not do this

Request

curl -X POST "https://api.example.org/activitypub/blocks" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "string",
    "reason": "string"
  }'

const response = await fetch('https://api.example.org/activitypub/blocks', {
  method: 'POST',
  headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "domain": "string",
    "reason": "string"
  }),
});
const answer = await response.json();

import requests

response = requests.post(
    "https://api.example.org/activitypub/blocks",
    headers={"Authorization": f"Bearer {token}"},
    json={
      "domain": "string",
      "reason": "string"
    },
)
answer = response.json()

Answer · 201

{
  "created_at": "2026-10-27T09:30:00Z",
  "created_by": 1,
  "domain": "string",
  "reason": "string"
}

Stop refusing a server

DELETE/activitypub/blocks/{domain}

Who: A super administrator

Parameters

domainstringrequiredin path
Its name: spam.example.

Answers

204
done
401
no token, or one that has expired
403
the viewer may not do this
404
it is not refused

Request

curl -X DELETE "https://api.example.org/activitypub/blocks/<domain>" \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch('https://api.example.org/activitypub/blocks/<domain>', {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${token}` },
});
const answer = await response.json();

import requests

response = requests.delete(
    "https://api.example.org/activitypub/blocks/<domain>",
    headers={"Authorization": f"Bearer {token}"},
)
answer = response.json()

Find somebody on another server

GET/activitypub/lookup

They are kept here, so that they can be followed as anybody is. Thirty lookups in ten minutes.

Who: Somebody signed in

Parameters

qstringin query
Their handle (@alice@mastodon.example) or the address of their profile there.

Answers

200
OK
activitypub.RemotePerson application/json
400
lookup_unreadable
Refusal application/json
401
no token, or one that has expired
404
lookup_not_found, lookup_is_here, lookup_not_a_person or lookup_refused
Refusal application/json
409
the installation is not on the fediverse: site_private or site_unreachable
Refusal application/json
429
too_many_lookups
Refusal application/json
502
lookup_failed
Refusal application/json

Request

curl "https://api.example.org/activitypub/lookup" \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch('https://api.example.org/activitypub/lookup', {
  method: 'GET',
  headers: { Authorization: `Bearer ${token}` },
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/activitypub/lookup",
    headers={"Authorization": f"Bearer {token}"},
)
answer = response.json()

Answer · 200

{
  "alias": "string",
  "body": "string",
  "id": 42,
  "locked": false,
  "name": "string",
  "origin_domain": "string",
  "type": "string",
  "uri": "https://example.org/",
  "url": "https://example.org/"
}

Copy a post's pictures here again

POST/activitypub/posts/{id}/pictures

The pictures of a post from another server that has been left alone a while are removed from storage, and the post says so (media_removed). Asked here, they are read again from where they came from. For anybody signed in who may see the post.

Who: Somebody signed in

Parameters

idintegerrequiredin path
The post's id here.

Answers

200
OK
PicturesRestored application/json
401
no token, or one that has expired
404
media_not_removed: there is no such post the viewer may see, or its pictures are here
Refusal application/json
410
media_gone
Refusal application/json
429
too_many_requests
Refusal application/json
502
media_failed
Refusal application/json

Request

curl -X POST "https://api.example.org/activitypub/posts/<id>/pictures" \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch('https://api.example.org/activitypub/posts/<id>/pictures', {
  method: 'POST',
  headers: { Authorization: `Bearer ${token}` },
});
const answer = await response.json();

import requests

response = requests.post(
    "https://api.example.org/activitypub/posts/<id>/pictures",
    headers={"Authorization": f"Bearer {token}"},
)
answer = response.json()

Answer · 200

{
  "restored": 1
}

Whether the viewer is on the fediverse, and could be

GET/activitypub/settings

Who: Somebody signed in

Parameters

person_idintegerin query
The person's id, or a website's for one of its administrators. The viewer when left out.

Answers

200
OK
activitypub.Settings application/json
400
person_unreadable
Refusal application/json
401
no token, or one that has expired
403
somebody else's, and the viewer is not a site administrator, nor an administrator of the website asked about
404
there is no such person

Request

curl "https://api.example.org/activitypub/settings" \
  -H "Authorization: Bearer $TOKEN"

const response = await fetch('https://api.example.org/activitypub/settings', {
  method: 'GET',
  headers: { Authorization: `Bearer ${token}` },
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/activitypub/settings",
    headers={"Authorization": f"Bearer {token}"},
)
answer = response.json()

Answer · 200

{
  "actor": "string",
  "available": false,
  "enabled": false,
  "handle": "string",
  "reason": "string"
}

Go on the fediverse, or leave it

PUT/activitypub/settings

It is each person's own choice, off until they make it, and only for somebody whose profile is open to everybody. A website's is its administrators' (?person_id= with its id).

Who: Somebody signed in

Body application/json

enabledbooleanrequired
Whether the viewer is on the fediverse from now on. Leaving tells the servers that knew them, and some of those do not take them back (federation.md).

Answers

200
OK
activitypub.Settings application/json
400
enabled_required, person_unreadable
Refusal application/json
401
no token, or one that has expired
403
somebody else's, and the viewer is not an administrator of the website asked about
409
why they cannot be: site_private, site_unreachable or profile_not_public
Refusal application/json

Request

curl -X PUT "https://api.example.org/activitypub/settings" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": false
  }'

const response = await fetch('https://api.example.org/activitypub/settings', {
  method: 'PUT',
  headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "enabled": false
  }),
});
const answer = await response.json();

import requests

response = requests.put(
    "https://api.example.org/activitypub/settings",
    headers={"Authorization": f"Bearer {token}"},
    json={
      "enabled": False
    },
)
answer = response.json()

Answer · 200

{
  "actor": "string",
  "available": false,
  "enabled": false,
  "handle": "string",
  "reason": "string"
}

The installation itself

GET/ap/actor

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). The actor that signs what the installation asks of other servers.

Who: Anyone, signed in or not

Answers

200
OK
activitypub.Actor application/activity+json
404
the installation is not on the fediverse
503
its key cannot be read now

Request

curl "https://api.example.org/ap/actor"

const response = await fetch('https://api.example.org/ap/actor', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/actor",
)
answer = response.json()

A post, as other servers see it

GET/ap/notes/{uuid}

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). A Note, of somebody on the fediverse, open to everybody.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
The post's UUID.

Answers

200
OK
activitypub.Note application/activity+json
404
there is no such post that went out

Request

curl "https://api.example.org/ap/notes/<uuid>"

const response = await fetch('https://api.example.org/ap/notes/<uuid>', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/notes/<uuid>",
)
answer = response.json()

A picture of a post

GET/ap/notes/{uuid}/pictures/{position}

For a server that was sent the post: a redirect to the picture in storage.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
The post's UUID.
positionintegerrequiredin path
Which picture, from 0.

Answers

302
the picture is at the address in Location
404
there is no such picture of a post that went out

Request

curl "https://api.example.org/ap/notes/<uuid>/pictures/<position>"

const response = await fetch('https://api.example.org/ap/notes/<uuid>/pictures/<position>', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/notes/<uuid>/pictures/<position>",
)
answer = response.json()

The poster of a video post

GET/ap/notes/{uuid}/poster

For a server that was sent the post: a redirect to the picture in storage.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
The post's UUID.

Answers

302
the picture is at the address in Location
404
there is no such video of a post that went out

Request

curl "https://api.example.org/ap/notes/<uuid>/poster"

const response = await fetch('https://api.example.org/ap/notes/<uuid>/poster', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/notes/<uuid>/poster",
)
answer = response.json()

The video of a post

GET/ap/notes/{uuid}/video

For a server that was sent the post: a redirect to the file in storage.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
The post's UUID.

Answers

302
the file is at the address in Location
404
there is no such video of a post that went out

Request

curl "https://api.example.org/ap/notes/<uuid>/video"

const response = await fetch('https://api.example.org/ap/notes/<uuid>/video', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/notes/<uuid>/video",
)
answer = response.json()

Somebody here, as other servers see them

GET/ap/users/{uuid}

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). A Person, or an Organization for a Website, with their public key.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
Their UUID, as other servers know them.

Answers

200
OK
activitypub.Actor application/activity+json
404
nobody here by that name is on the fediverse
503
their key cannot be read now

Request

curl "https://api.example.org/ap/users/<uuid>"

const response = await fetch('https://api.example.org/ap/users/<uuid>', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/users/<uuid>",
)
answer = response.json()

How many follow them

GET/ap/users/{uuid}/followers

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). A collection with its count and no items.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
Their UUID, as other servers know them.

Answers

200
OK
activitypub.Collection application/activity+json
404
nobody here by that name is on the fediverse

Request

curl "https://api.example.org/ap/users/<uuid>/followers"

const response = await fetch('https://api.example.org/ap/users/<uuid>/followers', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/users/<uuid>/followers",
)
answer = response.json()

How many they follow

GET/ap/users/{uuid}/following

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). A collection with its count and no items.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
Their UUID, as other servers know them.

Answers

200
OK
activitypub.Collection application/activity+json
404
nobody here by that name is on the fediverse

Request

curl "https://api.example.org/ap/users/<uuid>/following"

const response = await fetch('https://api.example.org/ap/users/<uuid>/following', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/users/<uuid>/following",
)
answer = response.json()

Take an activity from another server

POST/ap/users/{uuid}/inbox

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). Signed with HTTP Signatures; what is not signed by whoever is said to have done it is not believed. Six hundred a minute from one address. Taken, whether or not anything is done with it.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
Their UUID, as other servers know them.

Body application/activity+json

anything

Answers

202
taken
400
the request is not well formed, or a value in it is not one it may be
401
not signed, or the signature does not check, or not by whoever is said to have done it
403
the server it came from is refused
404
nobody here by that name is on the fediverse
413
too large
429
too many from one address
503
it could not be kept now; send it again

Request

curl -X POST "https://api.example.org/ap/users/<uuid>/inbox"

const response = await fetch('https://api.example.org/ap/users/<uuid>/inbox', {
  method: 'POST',
});
const answer = await response.json();

import requests

response = requests.post(
    "https://api.example.org/ap/users/<uuid>/inbox",
)
answer = response.json()

How many posts they have sent out

GET/ap/users/{uuid}/outbox

For other servers, in ActivityStreams (https://www.w3.org/TR/activitystreams-vocabulary/ (opens in a new tab)). A collection with its count and no items.

Who: Anyone, signed in or not

Parameters

uuidstringrequiredin path
Their UUID, as other servers know them.

Answers

200
OK
activitypub.Collection application/activity+json
404
nobody here by that name is on the fediverse
503
it cannot be counted now

Request

curl "https://api.example.org/ap/users/<uuid>/outbox"

const response = await fetch('https://api.example.org/ap/users/<uuid>/outbox', {
  method: 'GET',
});
const answer = await response.json();

import requests

response = requests.get(
    "https://api.example.org/ap/users/<uuid>/outbox",
)
answer = response.json()

Take an activity from another server

POST/inbox

Who: Anyone, signed in or not

Body application/activity+json

anything

Answers

202
taken
400
the request is not well formed, or a value in it is not one it may be
401
not signed, or the signature does not check, or not by whoever is said to have done it
403
the server it came from is refused
404
nobody here by that name is on the fediverse
413
too large
429
too many from one address
503
it could not be kept now; send it again

Request

curl -X POST "https://api.example.org/inbox"

const response = await fetch('https://api.example.org/inbox', {
  method: 'POST',
});
const answer = await response.json();

import requests

response = requests.post(
    "https://api.example.org/inbox",
)
answer = response.json()

Written by Claude, reviewed by Rastin Mehr · About this