API reference

The newest unexpired override of a key wins over the plan value. The subject must exist (404 `SUBJECT_NOT_FOUND`). Audited.

Support and super admins only, from their own session reauthenticated within the last 5 minutes. Opens a separate session for the user (at most 30 minutes; tokens carry an `act` claim) and sets it as the auth cookies; the staff refresh token is kept aside so `DELETE /v1/users/me/impersonation` returns to it. In that session credential, billing, delete and staff operations answer 403 `IMPERSONATION_FORBIDDEN`. Audited.

Lowering limits never deletes content; consumers restrict. Audited with the reason and each changed value.

Partial: only the fields sent change. Audited with the reason and the field names (never the addresses; the registration allow-list only by its size).

open → in_progress ⇄ waiting_on_user → resolved → closed (in_progress and waiting_on_user may both resolve). Closed tickets are read-only (409 `TICKET_NOT_OPEN`). Assignees must be active support staff.

A public reply is mailed to the requester and starts work on an open ticket; an internal note is visible to staff only.

Super admins only, never on their own account (422 `STAFF_SELF_ACTION`); the last active super admin keeps the role (422 `LAST_SUPER_ADMIN`). Audited with the reason, the roles granted and revoked.

Signs out every session of the user (impersonations included); suspended accounts get 403 `ACCOUNT_DISABLED`. Idempotent; never your own account. Audited with the reason.

For the impersonation banner: `active` with the session details while a staff member impersonates the signed-in user, else `active: false`.

Closes the impersonation this session belongs to and revokes its session (audited), then signs the staff member back into their own session from the staff refresh cookie set at the start (`staffSessionRestored`); otherwise the auth cookies are cleared.

At most 50 events, 64 KiB. Without analytics consent (the current consent record of the account, or of `anonymousId` when signed out) events are stored without any player identifier. Events are kept only about publications the caller could play: published public or unlisted ones that aren't embed-only; embed-only and private ones with a valid `embedToken` for them; private ones for signed-in members with `puzzle:read`, access grantees and organization devices in scope. Events about school organizations' publications never carry a player identifier. Others, invalid events and events older than 30 days (or the raw retention) are dropped alike (`rejected`), so the counts never reveal which publications exist.

Every export of the workspace (whoever asked), all statuses. Keyset by id.

Queues a CSV or JSON file of one report, with exactly the rules of the query API (counts only; unique players rounded down to multiples of 5 and suppressed below 5; details suppressed below 5 starts; ranges clamped to the plan's retention; live days lag an hour). Built asynchronously into private storage: poll `GET /v1/analytics/exports/{id}` (or wait for the `analytics.export_ready` notification and mail), then `POST …/download` for a 5-minute link. Files are kept for the platform's export retention (7 days by default). Per workspace: 3 building at once and 20 per rolling 24 hours (429 `ANALYTICS_EXPORT_RATE_LIMITED`, `details { reason: concurrent|daily, limit, retryAfterSeconds }`). `publications` exports hold at most 10000 rows (`truncated`). CSV cells that start with `=`, `+`, `-`, `@`, a tab or a carriage return are prefixed with `'`. API keys with the `analytics:read` scope may call it. Refused under staff impersonation (403 `IMPERSONATION_FORBIDDEN`); listing, reading and downloading stay allowed.

A signed URL of the private file, valid for 5 minutes (`attachment; filename="analytics-<report>-<from>-<to>.<format>"`); ask again for a new one. Audited.

Counts only (no player identifiers). Range: inclusive UTC days clamped to the plan's aggregated retention and today; today and days not aggregated yet are computed live. Unique players: consenting players only, exact while raw events are kept; counts of 1–4 are suppressed; never collected for school organizations. Origins are indicative only: events of publications played without an embed token carry the origin the client claims (`embedOrigin`), which nobody verifies; only token embeds record the token's verified origin. API keys with the `analytics:read` scope may call it. `private, no-store`.

Publications with numbers in the range (deleted ones included, `publication: null` once gone), sorted by `sort` then id. Counts only (no player identifiers). Range: inclusive UTC days clamped to the plan's aggregated retention and today; today and days not aggregated yet are computed live. Unique players: consenting players only, exact while raw events are kept; counts of 1–4 are suppressed; never collected for school organizations. Origins are indicative only: events of publications played without an embed token carry the origin the client claims (`embedOrigin`), which nobody verifies; only token embeds record the token's verified origin. API keys with the `analytics:read` scope may call it. `private, no-store`.

Counts only (no player identifiers). Range: inclusive UTC days clamped to the plan's aggregated retention and today; today and days not aggregated yet are computed live. Unique players: consenting players only, exact while raw events are kept; counts of 1–4 are suppressed; never collected for school organizations. Origins are indicative only: events of publications played without an embed token carry the origin the client claims (`embedOrigin`), which nobody verifies; only token embeds record the token's verified origin. API keys with the `analytics:read` scope may call it. `private, no-store`.

Counts only (no player identifiers). Range: inclusive UTC days clamped to the plan's aggregated retention and today; today and days not aggregated yet are computed live. Unique players: consenting players only, exact while raw events are kept; counts of 1–4 are suppressed; never collected for school organizations. Origins are indicative only: events of publications played without an embed token carry the origin the client claims (`embedOrigin`), which nobody verifies; only token embeds record the token's verified origin. API keys with the `analytics:read` scope may call it. `private, no-store`.

Counts only (no player identifiers). Range: inclusive UTC days clamped to the plan's aggregated retention and today; today and days not aggregated yet are computed live. Unique players: consenting players only, exact while raw events are kept; counts of 1–4 are suppressed; never collected for school organizations. Origins are indicative only: events of publications played without an embed token carry the origin the client claims (`embedOrigin`), which nobody verifies; only token embeds record the token's verified origin. API keys with the `analytics:read` scope may call it. `private, no-store`.

Returns the key once (`secret`); only its SHA-256 is stored. Use it as `Authorization: Bearer <key>` without cookies.

Issues a new key with the same name, scopes and expiry (shown once) acting as you; the old key is revoked, or keeps working for `overlapMinutes`.

Idempotent per player on `clientCompletionId` (a known one answers 200 with the stored completion; the same id for another publication is 409 `CLIENT_COMPLETION_ID_CONFLICT`). The final state is checked by the engine against the solution of `versionId` (422 `COMPLETION_NOT_SOLVED`); unknown versions or versions of a retired major line are 404 `PUZZLE_VERSION_NOT_FOUND`. Completes the open session named by `playSessionId`, else records a new completed session. Device times must be plausible (422 `COMPLETION_TIME_IMPLAUSIBLE`, checked before the state is compared). When the caller’s payload has no checks (private publications played without `puzzle:read-solution`, students), every upload is a server probe like `POST /v1/play-sessions/:id/check`: refused before the state is compared past the casual check budgets (409 `CHECK_LIMIT_REACHED`, `details { limit, scope: session|daily, retryAfterSeconds? }`: 50 per named session, 100 per player and publication in 24 h, solved or not), throttled to one every 3 s per session (or per player and publication without one) and 30 a minute per client IP (429 `PLAY_RATE_LIMITED`); a wrong state is logged as a probe (`details.checksRemaining` when it named a session). Always unverified (`verificationNote: offline`). Competitive publications and sessions are refused before the state is checked (422 `COMPETITIVE_REQUIRES_SESSION`): complete them online with `POST /v1/play-sessions/:id/complete`. Accepted whatever `serverProgressEnabled` says (FR-PLAY-07); with it off, the session recorded for the completion keeps no game state (`state: null`). New uploads are limited to 10 a minute per player and 3 a minute per player and publication (429 `PLAY_RATE_LIMITED`, `details.retryAfterSeconds`); replays of a known `clientCompletionId` don't count. School students must name one of their own open sessions in `playSessionId` (422 `PLAY_SESSION_REQUIRED` without one; 409 `PLAY_SESSION_ENDED` once it was abandoned: start a new session).

Rate-limited like sign-in; after too many failed claims platform-wide, every claim answers 429 `DEVICE_PAIRING_PAUSED` for a minute. Single use: the code stops working once claimed. Show `confirmationCode` on the device (the admin types it to approve) and poll `POST /v1/device-auth/credential` with the returned token until an admin decides.

The old credential and its access tokens stop working; store the new one before discarding the old.

Also restarts the offline window (`device.offlineUntil`). Use the token as `Authorization: Bearer <accessToken>` without cookies.

The organization's published, standalone-playable publications within the device's scope, private ones included (the device plays them without checks). Load each through its `playPath` with the device's token.

For publications the device plays without checks (private ones): whether the state solves the version (`solved`), never which entries are wrong; each check is logged as a probe (no state). Publications the device may not play are 404 like the play pointer; taken down 410. Competitive publications need a play session, which devices don’t have (422 `COMPETITIVE_REQUIRES_SESSION`); payloads with checks are checked on the device (422 `CHECKS_AVAILABLE_LOCALLY`). At most 100 checks per device and publication in 24 h, refused before the state is compared (409 `CHECK_LIMIT_REACHED`, `details { limit: 100, scope: daily, retryAfterSeconds }`). Throttled (429 `PLAY_RATE_LIMITED`, `details.retryAfterSeconds`): one check per device and publication every 3 s, 60 per hour, and 30 a minute per client IP.

Needs the `confirmationCode` shown on the claiming device. Creates the device (it counts against the plan’s `org_devices_max`), or re-pairs the rotated device the pairing was opened for. The device then picks its credential up.

For a device that stayed offline past `offlineUntil` (status `lapsed`): it may sign in again within a new offline window.

Its credential and access tokens stop working at once and its plan slot is freed. Content it already cached stays playable until its `offlineUntil` (FR-DEV-ORG-02). `devices:revoke`: also in frozen organizations.

The current credential stops working now; the returned code (shown once) pairs the same device again, keeping its name, scope and plan slot.

Returns a single-use code (once) to enter on the device within 10 minutes; then approve the claimed pairing. Never `Idempotency-Key`: the code is not stored.

`filter[status]` defaults to `open`. Organization-level appeals (first level of organization bans) are their organization’s to resolve; staff may answer one from its `staffResolvableAt` (open 14 days, or the organization disabled or deleted), and that answer is final.

The ban (with its internal reason) or the moderation action, whether it still applies, and the organization-level appeal an escalation follows.

Lifts the ban, restores the content (with the copies its takedown followed) or the comment, or withdraws the warning, through the usual moderation action (with `note` as its reason). Notifies the appellant (`moderation.appeal_accepted`), never naming you. Not on your own decisions, appeals about you or organizations you belong to, or escalations whose first level you answered. Organization-level appeals only from `staffResolvableAt` (else 409 `APPEAL_ORGANIZATION_LEVEL`).

The decision stands; the appellant gets `moderation.appeal_rejected` and reads `note` on the appeal. A platform rejection is final.

Platform and organization bans. Notifies the user (`moderation.ban_revoked`). Refused for bans about yourself or an organization you belong to.

The author is notified (`comment.hidden`, `source: 'staff'`, never who); the publication's own moderators can't restore it (a workspace hide is taken over). Resolves the open reports on the comment.

Restores hides by staff or by the workspace.

Restores the puzzle and its publication; its status is kept (a published one is playable again at once). The owner is notified (`moderation.publication_restored`). `includeCopies` restores the copies the puzzle's current takedown followed.

Takedowns act on the puzzle (`takenDownAt`, also for never-published puzzles) and its live publication: it is no longer played (410 `PUBLICATION_REMOVED`), discussed, rated, embedded, listed, resolved, copied (clone, export, edition source: 409 `PUZZLE_TAKEN_DOWN`) or published (422), until restored. Owners still see it in Studio. The owner is notified (`moderation.publication_taken_down`); open reports on the publication and its puzzle (and on `reportId`'s target) are resolved and their reporters notified. Never on your own content or your organization's (422 `MODERATION_SELF_ACTION`). Edge caches: a purge of the affected URLs is queued; until the owner configures the Cloudflare purge, cached copies expire on their own (pointers, URL resolution, rating summaries and search within 60 s, payloads within 1 h, 5 min in browsers). `includeCopies` also takes down every copy of the puzzle, with or without a publication (each owner notified). Repeating it changes nothing (`changed: false`, no action).

Takedowns act on the puzzle (`takenDownAt`, also for never-published puzzles) and its live publication: it is no longer played (410 `PUBLICATION_REMOVED`), discussed, rated, embedded, listed, resolved, copied (clone, export, edition source: 409 `PUZZLE_TAKEN_DOWN`) or published (422), until restored. Owners still see it in Studio. The owner is notified (`moderation.publication_taken_down`); open reports on the publication and its puzzle (and on `reportId`'s target) are resolved and their reporters notified. Never on your own content or your organization's (422 `MODERATION_SELF_ACTION`). Edge caches: a purge of the affected URLs is queued; until the owner configures the Cloudflare purge, cached copies expire on their own (pointers, URL resolution, rating summaries and search within 60 s, payloads within 1 h, 5 min in browsers). `includeCopies` also takes down every copy of the puzzle, with or without a publication (each owner notified). Repeating it changes nothing (`changed: false`, no action).

Like resolve, with status `dismissed`: closes the report and, unless `onlyThisReport`, every open report on its target.

Closes the report and, unless `onlyThisReport`, every open report on its target. Reporters are notified (`moderation.report_closed`); the reported party never learns who reported.

Takes effect at once on every request (`USER_BANNED`). A `platform` ban also signs the user out everywhere; they can sign in again but only read their bans (`GET /v1/users/me/bans`), exercise their data rights (exports, account deletion, consent) and manage their notifications. Notifies the user (`moderation.banned`: scope, violation, expiry; never who decided or reported) and resolves the open reports on the user (and on `reportId`'s target).

Notifies the user (`moderation.warning` with the `violation`, never who decided or who reported). Resolves the open reports on the user (and on `reportId`'s target).

Types and their payloads: - `comment.reply` (community): Someone replied to your comment. Payload: `publicationId`, `commentId` (the reply), `parentCommentId`, `puzzleTitle`. - `comment.hidden` (moderation): A moderator of the publication (or platform staff) hid your comment. Payload: `publicationId`, `commentId`, `puzzleTitle`, `source` (`workspace`|`staff`). - `moderation.publication_taken_down` (moderation): Platform moderation took down a puzzle of yours (or of an organization you own) and its publication: it is no longer played, discussed, copied, published or listed. Payload: `publicationId` (null for puzzles without a publication), `puzzleId`, `puzzleTitle`, `violation` (a report reason, or null), `followedCopy` (true when it was taken down as a copy of other taken-down content), `ownerOrgId` (null for personal content). - `moderation.publication_restored` (moderation): Platform moderation restored a puzzle of yours (and its publication) that was taken down. Payload: `publicationId` (or null), `puzzleId`, `puzzleTitle`, `ownerOrgId`. - `moderation.warning` (moderation): Platform moderation warned you about your behaviour. Payload: `actionId`, `violation` (a report reason). - `moderation.banned` (moderation): You were banned (E13-T02): by the platform's moderators (`scope` `platform`: everything but reading your bans, your data rights and your notifications; `comments`, `ratings` or `publishing`: that feature everywhere) or by an organization (`scope` `org`: its workspace, membership and content). Never says who decided or who reported. Payload: `banId`, `scope`, `orgId` and `orgName` (org bans, else null), `violation` (a report reason), `expiresAt` (ISO date-time, null = permanent). - `moderation.ban_revoked` (moderation): A ban of yours was lifted before it expired. Payload: `banId`, `scope`, `orgId`, `orgName`. - `moderation.ban_expired` (moderation): A temporary ban of yours ended. Payload: `banId`, `scope`, `orgId`, `orgName`. - `moderation.appeal_submitted` (moderation): Your appeal was received (E13-T03). Payload: `appealId`, `kind` (`ban`|`takedown`|`comment_hide`|`warning`), `level` (`organization`: the organization that banned you reviews it first; `platform`: platform moderation), `banId` or `actionId` (the decision; the other is null), `orgId` and `orgName` (organization bans and organization content, else null). - `moderation.appeal_received` (moderation): Sent to an organization's owner: someone the organization banned appealed the ban, and the organization's admins (`organization:bans:manage`) review it first (E13-T03). Never the appellant's text. Payload: `appealId`, `banId`, `orgId`, `orgName`. - `moderation.appeal_accepted` (moderation): Your appeal was accepted and the decision reversed (the ban lifted, the content restored, the comment shown again; a warning is withdrawn). Never says who reviewed it; the answer is on the appeal (`GET /v1/users/me/appeals/:id`). Payload: `appealId`, `kind`, `level`, `banId`, `actionId`, `orgId`, `orgName`, `reversed` (false when the decision had already ended). - `moderation.appeal_rejected` (moderation): Your appeal was rejected; the decision stands. Never says who reviewed it; the answer is on the appeal. Payload: `appealId`, `kind`, `level`, `banId`, `actionId`, `orgId`, `orgName`, `escalatableUntil` (organization-level rejections: until when platform moderation can be asked to review it, ISO date-time; else null). - `moderation.report_closed` (moderation): A report you filed was closed. Never says what was done to whom. Payload: `reportId`, `targetType`, `status` (`resolved`|`dismissed`). - `organization.invitation` (organizations): You were invited to an organization (your verified address). Payload: `orgId`, `orgName`, `invitationId`. - `organization.ownership_transfer_offered` (organizations): An organization's owner offered you its ownership. Payload: `orgId`, `orgName`, `transferId`. - `organization.frozen` (organizations): An organization you belong to was fr

Audited `organization.appeal_accepted` and `organization.ban_revoked` (with `note` as the revoke reason of the ban; audit entries keep only its length). Notifies the appellant (`moderation.appeal_accepted`), never naming you.

The ban stands. The appellant gets `moderation.appeal_rejected` and may ask platform moderation within 30 days.

Takes effect at once: the user can't act in the organization (a member keeps the membership, but every permission there answers `USER_BANNED`), be invited or join, or comment on, rate or open its content. Only current members, pending invitees and users who commented on, rated or reported the organization's content in the last 90 days (anyone else, unknown users included: 404 `BAN_TARGET_NOT_FOUND`). Never yourself, platform staff or the owner; banning a member needs every permission of their role. At most 20 bans per hour and 3 of the same user per day (429 `BAN_RATE_LIMITED`, `details.retryAfterSeconds`). Notifies the user (`moderation.banned` naming the organization, never who decided; mailed to members only, in-app for others).

Notifies the user (`moderation.ban_revoked`).

For schools whose accepted version is no longer current.

Accepts the current DPA for the school and changes the organization type to `school` (school mode: comments off). Schools stay schools.

Send `version` back in `dpa.version` when creating a school or accepting the DPA.

The current version, runtime settings and embed data (`embed.frameAncestors` for the play document's CSP). Caching: public and unlisted responses without a token are shared-cacheable. After the publication switches to private, starts requiring embed tokens, is unpublished or is taken down, copies cached before the change can still be served by the edge until they expire: up to 60 s for the pointer and up to 1 h for payloads (5 min in browsers), until the instant purge of E13-T02. Responses with a token, and responses for private or token-required publications, are `private, no-store`. A personal owner who is suspended or deleted stops serving their publications: 404 like an unknown publication (`no-store`), with an edge purge queued on the change; restoring the account serves them again. Organization state never matters here.

Returns only the requested positions’ answers (a cell or an entry, never every answer at once) and, for cryptic crosswords, the annotations of clues this request revealed completely. Online only. Refused with 403 `REVEAL_DISABLED` (`details.reason`: `competitive`, or `disabled` when the pointer’s `settings.reveal.enabled` is false). With `playSessionId` the signed-in player’s open casual session counts one reveal and becomes `assisted` (FR-PLAY-06). Every reveal by a signed-in player is also logged for the publication (with or without a session, kept when progress is deleted), and such players never appear on its casual leaderboards.

The public definition and, for casual play with access to them, the checks; never the solution. Caching: public and unlisted responses without a token are shared-cacheable. After the publication switches to private, starts requiring embed tokens, is unpublished or is taken down, copies cached before the change can still be served by the edge until they expire: up to 60 s for the pointer and up to 1 h for payloads (5 min in browsers), until the instant purge of E13-T02. Responses with a token, and responses for private or token-required publications, are `private, no-store`. A personal owner who is suspended or deleted stops serving their publications: 404 like an unknown publication (`no-store`), with an edge purge queued on the change; restoring the account serves them again. Organization state never matters here.

Pins the publication’s current version and mode and starts from the engine’s initial state. Casual sessions need `serverProgressEnabled` in the player’s settings (422 `SERVER_PROGRESS_DISABLED`: casual play then stays on the device). Private publications need `puzzle:read` (404 otherwise); taken-down ones are 410. Multiple attempts are allowed, at most 10 open (active or paused) per publication and mode. School students (`Authorization: Bearer ppst_…`, no cookies) start sessions on their class’s assignments only (anything else is 404; competitive publications only when the teacher assigned them as competitive); their progress is always kept on the server.

The `ETag` is the session’s `revision` (the `If-Match` / `baseRevision` of the next progress sync).

Answers only whether the state solves the puzzle (`solved`), never which entries are wrong. **Competitive** (payloads carry no checks): each check uses one of the player’s 3 on the publication, shared by all their competitive sessions of it and kept when sessions are deleted (`checksRemaining`; failed completions use them too); then 409 `CHECK_LIMIT_REACHED` on every session of the publication. Probing another session also makes this one a repeat attempt (never verified). The state must be for the session’s `versionId` (409 `PLAY_SESSION_VERSION_MISMATCH`). Throttled like completions (429 `PLAY_RATE_LIMITED`). **Casual**: only when the caller’s payload has no checks (`protection: null`: private publications played by grantees, school students or members without `puzzle:read-solution`); with checks the runtime checks locally (422 `CHECKS_AVAILABLE_LOCALLY`, nothing counted). Bounded before the state is evaluated (no refusal depends on the answer): 50 per session (`checksRemaining`; failed completions of such sessions count too, never ending it), then 409 `CHECK_LIMIT_REACHED` with `details { limit: 50, scope: session }` (start a new session); 100 per player and publication over the casual sessions started in the last 24 h, then 409 `CHECK_LIMIT_REACHED` with `details { limit: 100, scope: daily, retryAfterSeconds }`; one per session every 3 s, 10 a minute per player and session, and 30 a minute per client IP (429 `PLAY_RATE_LIMITED`, `details.retryAfterSeconds`). When `solved` is true, complete the session with `POST …/complete` (the server checks the state again). The state defaults to the session’s `versionId`; casual sessions may send a newer minor.

The server checks the state with the engine against the stored solution (422 `COMPLETION_NOT_SOLVED`: nothing recorded). Casual completions are never verified (`verificationNote: casual`) and a wrong casual state leaves the session open; when the caller’s payload has no checks, every attempt is a server probe: refused before the state is evaluated past the casual check budgets (409 `CHECK_LIMIT_REACHED`, `details { limit, scope: session|daily, retryAfterSeconds? }`, solved or not) and throttled to one per session every 3 s and 30 a minute per client IP (429 `PLAY_RATE_LIMITED`); a wrong state counts one check (`details.checksRemaining`, `sessionEnded: false`). Competitive ones use the session’s `versionId` (409 `PLAY_SESSION_VERSION_MISMATCH` for another), are timed by the server (start of the session to now, no pauses) and verified unless the publication changed mode, answers were revealed, it is not the player’s first attempt at the publication (`repeat_attempt`: any other competitive session of theirs on it, earlier or later, that was completed, saved progress, or was checked or failed a completion, also once deleted), more than 24 h passed or the time is below the game’s plausible minimum (`verificationNote`). A wrong competitive state uses one of the player’s 3 checks on the publication, shared by all their sessions of it (`details.checksRemaining`); with none left the session is abandoned (`details.sessionEnded`, `endedReason: too_many_attempts`). At most 10 checks and completions per minute per player and session (429 `PLAY_RATE_LIMITED`, `details.retryAfterSeconds`). A completed session answers its completion again. With `serverProgressEnabled` off a casual completion is still recorded, but the session keeps no final state (`state: null`).

Optimistic concurrency on the session’s `revision` (`baseRevision` or `If-Match`; one is required, 428): a stale base is 409 `PLAY_SESSION_REVISION_CONFLICT` with the server copy in `details.session` and `details.revision`; let the player choose a copy and resend with `baseRevision = details.revision`. Re-sending the last applied `clientMutationId` returns the session unchanged. The state is validated by the engine (`PLAY_STATE_INVALID`, `PLAY_STATE_MAJOR_UNSUPPORTED`). When the publication moved to a newer minor version the server migrates the state (`migrated: true`, new `versionId`). `revealsUsed`, `hintsUsed` and `assisted` never go down. Competitive states must be for the session’s `versionId` (409 `PLAY_SESSION_VERSION_MISMATCH`; only the server migrates them). Casual sessions need `serverProgressEnabled`. The response `ETag` is the new revision.

Every achievement of the catalog (E12-T06) with your progress, computed from your statistics (streak days in UTC), whether or not your profile is public. Others see the achieved ones on your public profile (`GET /v1/profiles/:handle`) while `profilePublic` is on.

Every completion you made (casual, offline and competitive; unverified ones included, FR-PLAY-07), newest first by default, filterable by game type, mode, verification and publication. Never a state or a solution.

Deletes every unfinished casual session (active, paused, abandoned) with its stored game state (FR-PRIV-02; e.g. after turning `serverProgressEnabled` off). Completed sessions and completions stay (your history), and so do competitive attempts (server-timed and verified). Idempotent. Allowed while banned (it only removes your data); refused while impersonating. Turning `serverProgressEnabled` off does the same automatically.

Newest first by default. `filter[status]=open` lists saved games to resume (active or paused). `publicationIds` (comma-separated, at most 100) answers the offline sync prompt (architecture §12.3): the server copies of the device’s local games, to compare `revision`/`updatedAt` with the device copies. Entries carry no engine state: read `GET /v1/play-sessions/:id` for it. Sessions of other players never appear.

Session counts, completion counts, daily streaks and, per game type, completions, average and best times (without revealed answers) and the best verified time. Streak days are calendar days in `timeZone` (IANA name, default UTC); a streak stays current until a whole day passes without a completion.

Owner only. Freezes the organization now (reason `deletion_requested`: content becomes read-only, members are notified, nobody can claim it; published puzzles keep serving) and soft-deletes it at the freeze deadline, 14 days later (an earlier deadline of a freeze for a lost plan is kept), unless the owner cancels. Its members, invitations and unpublished content are purged `retention.deletedOrganizationsDays` (90) after the deletion; published puzzles stay while published. Needs a sign-in within the last 5 minutes.

Owner only, before the deadline, with a sign-in within the last 5 minutes. The organization is active again when the owner holds the Organization Owner plan; otherwise it stays frozen for the lost plan with the same deadline (members holding the plan can then claim it).

A signed URL valid for 5 minutes.

Soft-deletes the account now (every session is signed out, owned organizations are frozen for their members to claim, API keys are revoked, webhooks disabled, subscriptions canceled) and purges its personal data after `retention.deletedAccountsDays` (30 days by default): personal puzzles are deleted, organization content stays with the organization, comments stay shown as a deleted user, completed play stays anonymised. Needs a sign-in within the last 5 minutes. There is no undo.

Signed in: the account's records. Signed out: those of `anonymousId` (400 `ANONYMOUS_ID_REQUIRED` without it). `current: null` means no choice yet: optional categories are off.

Records a new version when the choice differs from the current one (the same choice again only confirms it). Withdrawal is a choice with `analytics: false`; it takes effect for the next analytics batch. The player's choice wins: an `embed_sdk` choice made while the current record is a `banner` or `settings` withdrawal is stored in the history but never becomes `current` (analytics stay off until the player grants through the banner or settings). `anonymousId` is a device secret: whoever knows it can read and change that device's consent, so keep it on the device and never put it in URLs that are shared or logged. Anonymous choices lapse when not confirmed for `retention.consentRecordsDays` (3 years). At most 20 new anonymous ids per IP per hour (429 `CONSENT_RATE_LIMITED`).

Queues the archive (profile, settings, sessions, devices, sign-in methods, comments, support tickets without internal notes, consents, memberships and your puzzles' metadata; never other people's data). One at a time (409 `EXPORT_IN_PROGRESS`), one per 24 hours (429 `EXPORT_RATE_LIMITED`, `details.retryAfterSeconds`; failed ones don't count). You get an email when it is ready.

A signed URL valid for 5 minutes (ask again for a new one). 409 `EXPORT_NOT_READY` while pending, processing or failed; 410 `EXPORT_EXPIRED` once deleted.

`handle` is a username or an organization slug (a leading `@` is accepted). No query parameters (any is 400). At most 20 requests a minute per IP. Users: display name, avatar, public statistics, achieved achievements, best-players positions and newest public puzzles, only while their profile is public. Organizations (never schools, and only with at least one public puzzle): name, brand image and newest public puzzles. No emails or account data. Private, unknown, deleted and suspended handles are one 404.

Discoverable puzzles (public, published, not taken down, playable standalone) of the user or organization, newest first by default; listing cards only, never content. Unknown query parameters are 400; at most 20 requests a minute per IP.

Your row on one board period (`board` = a board key), with the board’s own rules: the board must be one you may see (token-only embeds need `X-Embed-Token`), and `entry` is null when you aren’t in the stored top 100 or wouldn’t be shown (leaderboard visibility off, banned). Signed-in users only; students, devices and API keys are refused.

Casual results: client-timed, **unverified** (label them so): online casual completions without hints, reveals or assists, a player's best per publication. Best players of discoverable publications (never schools’), per game type (`filter[gameType]`) or every type, by results counted, then the game’s scoring over the sums. Entries show username, display name and avatar only. Public and the same for every caller: `public, max-age=0, s-maxage=60`; boards are rebuilt hourly.

Verified competitive results only: each player's server-timed first attempt per publication. Best players of discoverable publications (never schools’), per game type (`filter[gameType]`) or every type, by results counted, then the game’s scoring over the sums. Entries show username, display name and avatar only. Public and the same for every caller: `public, max-age=0, s-maxage=60`; boards are rebuilt hourly.

Only for live, published, public or unlisted publications that aren’t taken down or owned by a school; private ones never have a public board. Embed-only publications that require tokens need their `X-Embed-Token` (then `private, no-store`); otherwise `public, max-age=0, s-maxage=60` (`Vary: x-embed-token`). Default kind: the publication’s play mode. Everything else is 404 `LEADERBOARD_NOT_FOUND`.

Most played, trending, top rated and most commented discoverable puzzles (public, published, not taken down, not a school’s), with their listing card (no content). Recomputed hourly; `public, max-age=0, s-maxage=60`.

Results on the series’ public and unlisted editions, by results counted, with the series title (`seriesTitle`). Only for series whose owner is live (an active user, or an organization neither disabled, deleted nor a school) with at least one public, playable edition; else 404 `LEADERBOARD_NOT_FOUND`. Default kind `competitive`. `public, max-age=0, s-maxage=60`.

One rating per player and publication: 201 when created, 200 when changed or repeated. Only after starting the publication (422 `RATING_REQUIRES_PLAY`), never for your own workspace (422 `RATING_OWN_CONTENT`). At most 10 rating writes (sets, repeats and removals) a minute and 60 an hour (429 `RATING_RATE_LIMITED`).

Idempotent: 204 whether or not you had rated it. Counts against the rating write limit (429 `RATING_RATE_LIMITED`).

Count, plain mean, Bayesian `weightedAverage` and distribution. Cached at the edge for 60 s (`public, s-maxage=60`) unless an `X-Embed-Token` is sent (embed-only publications that require tokens need one; then `private, no-store`).

Reports only what you can see (404 `REPORT_TARGET_NOT_FOUND` otherwise, whatever the type). One open report per target: repeating it answers 200 with the existing report (`created: false`). At most 5 reports a minute, 20 an hour and 50 a day (429 `REPORT_RATE_LIMITED`). The reported party never learns who reported them.

Totals, per-assignment completion and medians, and sessions and completions per UTC day (E20-T04), counted over the class's current, unrevoked students and current assignments only; no student identifiers. Sessions count by their server start, completions by the time the server recorded them, and each assignment only from its `assignedAt` on (earlier play isn't class work): per-assignment figures, `days` and `totals` alike. `medianTimeMs`/`medianHints` (each completer's first completion in the range) are null when fewer than 3 students completed. `from`/`to` are inclusive UTC days: default the last 30 days ending today, at most 366 days (400 `ANALYTICS_RANGE_INVALID`), clamped to the organization plan's analytics retention and to today (`range.clamped`); nothing left is 422 `ANALYTICS_RANGE_OUTSIDE_RETENTION`. Works in frozen organizations.

Idempotent. Clears the join code; the class's student tokens stop working until it is restored.

A new code, shown only in this response; the previous one stops working. Never `Idempotency-Key`.

Idempotent. Nobody can join until a new code is rotated.

For each student and each of the class's current assignments they started: status, attempts, completion, time, hints and reveals (E20-T03). Sparse: pairs without an entry were not started. Active students and revoked ones whose play is still retained. `filter[publicationId]` (an assignment of the class, else 404 `CLASS_ASSIGNMENT_NOT_FOUND`) and `filter[studentId]` (a student of the class, else 404 `STUDENT_NOT_FOUND`) narrow it.

One of the organization's own publications; its students may then play it while it is published. Students play only casual publications unless `competitive` is set (a competitive publication assigned without it is not playable for them). 201 when assigned, 200 when it already was (`competitive`, when sent, is changed).

Idempotent. Its students play again; rotate the join code to let new ones join.

No account, email or other personal data. Returns the student token once (`ppst_…`): keep it on the device and send it as `Authorization: Bearer` without cookies. After too many wrong codes from one network, joins from it answer 429 `CLASS_JOIN_PAUSED` for up to 10 minutes.

School organizations with a current DPA only. The join code is in this response only (stored hashed); never `Idempotency-Key`, so it is not stored for replays.

One entry per assigned publication you started (none: not started), with `openSessionId` to resume (`GET /v1/play-sessions/:id` with the student token). Play itself uses the play-session routes with the student token; progress is always saved on the server.

Published, not taken down and standalone-playable, of any visibility (private ones play without checks). Load each through its `playPath` with the student token; nothing else is playable with it.

Same nickname rules as joining; revoked students are 404.

Idempotent; works in frozen organizations. The student's token stops working at once and the nickname is freed; their play history stays.

Public, published puzzles by text (full-text per language, typo-tolerant titles, accents ignored) and filters. Never returns content, checks or solutions.

Users with a public profile and organizations that have at least one public, published puzzle, by handle (prefix) or name (typo-tolerant).

Signed by Stripe (`Stripe-Signature`); idempotent on the event id. Not for API clients.

Needs an active paid plan (Creator or Organization Owner; 403 `ENTITLEMENT_REQUIRED` otherwise). The description becomes the first message; the support list is mailed. At most 10 unresolved tickets and 10 new ones per 24 hours (422 `TICKET_LIMIT_REACHED`).

The server checks the bytes against the declared type; images are re-encoded, videos stored as uploaded. Rejected files are discarded (422).

resolved → closed (409 `TICKET_INVALID_TRANSITION` from any other status; closing a closed ticket is a no-op).

Only while the ticket is open, in progress or waiting on you (409 `TICKET_NOT_OPEN`); a ticket waiting on you goes back in progress.

Private bucket only. Images (JPEG, PNG, WebP, AVIF, GIF…) up to 10 MB, videos (MP4, WebM, QuickTime) up to 50 MB. At most 5 attachments per ticket, pending uploads included (422 `TICKET_ATTACHMENTS_LIMIT`). Then `PUT` the file and register it with `POST /v1/support/tickets/:id/attachments`.

A ban of yours (any scope; works while platform-banned), a takedown of your content (or of an organization you own), a platform moderator hiding your comment, or a warning. Once per decision and reviewer, within 30 days of the decision, while it still applies. Organization bans go to that organization’s admins first; once they reject it, appeal the same ban again within 30 days to go to platform moderation. Your text is plain text. You get `moderation.appeal_submitted`, then `moderation.appeal_accepted|appeal_rejected`.

Active ones by default. Works while platform-banned: when any other route answers 403 `USER_BANNED`, show these (scope, organization, rule broken, expiry) with their appeal (`appeal`, `appealable`: appeal with `POST /v1/users/me/appeals`).

Warnings, platform hides of your comments and takedowns of your content (or of organizations you own), newest first, each with whether it still applies, its newest appeal and whether a new one can go now. Bans are in `GET /v1/users/me/bans`.

Partial update. Also while platform-banned, but then only to restrict what others see: turning `profilePublic` or `leaderboardVisible` on is 403 `USER_BANNED` (`details[].field`).

Queues one more attempt with the same event id and body (receivers deduplicate on `Puzzle-Event-Id`).

Returns the signing secret once (`secret`); it is stored encrypted. Endpoints receive `POST` JSON bodies `{ id, type, version: "1", createdAt, workspace, data }` signed with `Puzzle-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>` (headers `Puzzle-Event-Id`, `Puzzle-Event-Type`, `Puzzle-Delivery-Id`), for the events they subscribe to in their own workspace. Retries: first attempt + 8 over ~21.6 h; deduplicate on `id`. Payloads carry ids and public publication settings only: never solutions, play states, comment bodies or who played or commented. | Event | Body schema | Sent when | |---|---|---| | `publication.published` | `PublicationPublishedWebhookDto` | A publication was published (it is playable unless moderation took it down). | | `publication.unpublished` | `PublicationUnpublishedWebhookDto` | A published publication stopped being published: unpublished by the workspace, or closed because its puzzle was deleted (`reason`). | | `publication.archived` | `PublicationArchivedWebhookDto` | A publication was archived (`wasPublished`: it was published until then). | | `completion.created` | `CompletionCreatedWebhookDto` | A player completed a publication (verified against the solution on the server). Anonymous: no player identity. Not sent for school students. | | `comment.created` | `CommentCreatedWebhookDto` | A comment or reply was posted on a publication. Ids only: read the comment through the API. | | `moderation.publication_taken_down` | `PublicationTakenDownWebhookDto` | Platform moderation took the publication down: it is no longer served until restored. | | `moderation.publication_restored` | `PublicationRestoredWebhookDto` | Platform moderation restored a publication it had taken down (`status` tells whether it is published). |

URL, subscriptions, description; `enabled: false|true` disables or re-enables it (re-enabling resets the failure count).

Replaces the secret at once and returns the new one (once); later attempts are signed with it.

Queues one `webhook.ping` delivery (a single attempt, no retries); follow it in the delivery log.