Two authentication models
The tool has two groups of routes. They do not share an authentication method.httpOnly, Secure and SameSite=Lax. Its Path is set explicitly.
Status codes
The codes carry meaning. A client must treat them differently.401 and 410 are separate answers on purpose. A client that treats them as one either retries a dead session forever or throws away a good token.Reviewer routes
These routes use the bearer token.Session
A session response carries the session, the project, the author, the whitelist, the anchor algorithm versions and the upload limits.
Threads and comments
Three of these need a token whose role is admin: resolve, reopen and delete. Everything else on this table, including repin, works with an ordinary reviewer token for a thread in that token’s own project. Re-pinning was admin-only until 25 August 2026 — the reviewer’s browser is what scores the anchors and reports a lost one, so the reviewer was the only person who could see the loss and the only one who could not repair it.
Uploads
Admin routes
These routes use the gateway session cookie. The account also needs thewebpage-review flag.
Projects
Whitelist
Reviewer sessions
A token lasts 7, 14, 30 or 90 days. The default is 30 days.
Threads, uploads and read state
The export route is the only one here that does not answer JSON. It takes the
panel’s selected thread ids and streams back an archive holding
review.md,
review.json and every attachment, one folder per ticket reference. The
Markdown and JSON exports on their own are composed in the browser and never
reach the server — they carry each file’s address, not the file.
Identifiers
Every{id} matches this pattern.
Sizes
The system uses 1024 × 1024 for one megabyte, everywhere. The conversion from a typed megabyte figure to bytes happens one time, in the router.The two readings of a megabyte differ by 4.9 percent at 1000 MB. Nobody would notice which one shipped. For that reason the choice is made in one place and written down.