API Overview

The API uses the same session authentication as the web app. Authenticated requests carry the cookie obtained at sign-in; dashboard settings and management operations also check administrator privileges.

API scope

Endpoints may change between releases. Check server/api/ for request parameters, responses and permission checks before integrating.

Method	Path	Purpose
POST	/api/login	Sign in with email/password and set a session cookie
GET	/api/auth/github	GitHub OAuth login and callback
GET	/api/photos	Photo list for signed-in users
GET	/api/photos/visible	Public photo list excluding hidden and password-protected album photos
GET	/api/albums	Read accessible albums
POST	/api/albums/:albumId/unlock	Unlock an album with its password
GET	/api/system/settings/fields?namespace=app	Read setting form fields (administrator)
PUT	/api/system/settings/batch	Save settings in a batch (administrator)
GET	/api/queue/recent	Recent dashboard tasks
GET	/api/system/logs	Dashboard logs

Update settings in a batch

With an administrator session, send a PUT request to /api/system/settings/batch:

{
  "updates": [
    { "namespace": "app", "key": "title", "value": "My Gallery" },
    { "namespace": "app", "key": "slogan", "value": "Photos from my travels" }
  ]
}

For new settings or form changes, read Adding a setting.

Dashboard endpoints are not public photo feeds

Photo access follows album visibility and password rules. Do not expose the authenticated dashboard photo list as a public API.