Standards

Athenana is a private, invitation-only place to keep things — but the ways in and out of it are open standards rather than an API of its own invention. This page is what a client, a server or a person can rely on it to speak, with the addresses to speak to. Everything listed is implemented and running; what is not implemented is named at the bottom rather than left for you to discover.

Micropub

Any Micropub client can post here — Quill, Indigenous, a Shortcut, an editor plugin — without either side knowing about the other.

  • /micropub — create, update, delete and undelete.
  • Both syntaxes: form-encoded h=entry and mf2 JSON type: ["h-entry"].
  • q=config and q=source. There is no media endpoint and no syndicate-to; neither is advertised, because neither exists.

What a post becomes here:

  • bookmark-of → a saved link, with content kept as your note on it
  • quote-of → a highlight, with content as the passage quoted
  • a photo uploaded as multipart → an image
  • content alone → a note
  • category → tags, and name → the title

A note, a highlight and an image arrive private; a link follows the same rule a link saved any other way does. Posting something never publishes it.

IndieAuth

How a client gets a token without anybody pasting one. Signing in as a person is separate and unchanged — this is the authorization layer clients use.

  • /.well-known/oauth-authorization-server — the metadata document, also linked as rel="indieauth-metadata"
  • /indieauth/authorize — the consent screen
  • /indieauth/token — the token endpoint

PKCE is required, and S256 is the only method. The specification permits falling back to a flow without it; this server does not, and plain is absent from the metadata rather than listed and then refused.

Four scopes — create, read, update and delete. A scope this server does not implement is dropped rather than refusing the whole request, and the consent screen shows exactly the subset that was understood, so you approve what you will actually get. Every token is listed on the account it belongs to and can be revoked there one at a time.

Webmention

Both directions, and neither is automatic in the way people expect.

  • /webmention — the receiving endpoint, advertised both as an HTTP Link header and as rel="webmention" on every public page
  • Sending happens nightly, by reconciling what is publicly visible against what has already been sent — so a link that becomes public is mentioned, and one whose page stops existing gets the withdrawal the specification defines as a re-send.

A mention that arrives is reviewed by the owner, not published. Nothing you send appears on a page here on your say-so.

Almost nothing receives one, and that is worth knowing before you build on the sending half. Measured here on 9 September 2026: of 182 mentions owed across 112 target hosts, one was delivered. Every other target advertises no endpoint, which is recorded once and never retried — a site that does not participate costs one request ever, rather than one a night. That is the protocol's adoption rather than a fault at either end, and the receiving half above is unaffected by it.

WebFinger and ActivityPub

An account with a blog can be followed from Mastodon and anywhere else that speaks ActivityPub.

  • /.well-known/webfinger — resolves @handle@athenana.com to an actor
  • /blog/{handle} — the blog, and its actor document under content negotiation
  • /blog/{handle}/outbox and /blog/{handle}/followers
  • /blog/{handle}/featured — the post pinned to the top of the blog, which Mastodon shows as pinned
  • /blog/{handle}/inbox — HTTP Signatures required; an unsigned request is refused before its body is read as anything but bytes

This is deliberately partial, and the limit is worth knowing before you build against it. Follow and Undo are honoured, and posts are delivered to followers. Replies, likes, boosts and mentions arriving here are acknowledged and then dropped — accepting them would mean storing and moderating other people's writing, which is not what this is. Nothing you send to that inbox will appear anywhere, and nobody is notified.

Feeds

  • /feed.xml and /feed.json — the public front page, as RSS and JSON Feed
  • /blog/{handle}/feed.xml and /blog/{handle}/feed.json — one account's blog, in both
  • JSON Feed, read and published. Subscribe to a JSON Feed 1.1 address as you would RSS or Atom; it is recognised by its content, not by the type a page advertises it under.

Google Reader API

How a news reader — NetNewsWire, Reeder and the others that speak the old Google Reader protocol — syncs the feeds you follow here. The base address is https://athenana.com/api/greader. The username is your account's email address, and the password is a Reader app token made on the Extensions page; your sign-in password does not work here.

  • POST /api/greader/accounts/ClientLogin — POST only. A token is never accepted in a URL, where it would end up in an access log.
  • /api/greader/reader/api/0/subscription/list — your subscriptions, arranged in four folders
  • /api/greader/reader/api/0/stream/contents and /api/greader/reader/api/0/stream/items/ids — the streams, and /api/greader/reader/api/0/unread-count for the counts
  • /api/greader/reader/api/0/edit-tag and /api/greader/reader/api/0/mark-all-as-read — read and unread, and starring

Starring is saving. Starring an article in your reader saves it here as a private item; a newsletter issue is saved in the background. Un-starring in the reader does not remove what was saved.

Read-only where it matters. Subscriptions are managed on the Feeds page, not from a client: adding, removing and renaming from a reader is refused with a message saying where to go. Articles come as the feed published them, and a reader is not sent the full text of a page. Read and unread state is kept only for your reader and is never shown anywhere in Athenana itself.

Model Context Protocol

How an AI assistant such as Claude reads your library. The server is at https://athenana.com/mcp, over Streamable HTTP. A client finds the sign-in itself, through the protected resource metadata at /.well-known/oauth-protected-resource/mcp, and you approve it on the same consent screen an IndieAuth app gets. It is granted one permission, library:read.

  • POST /mcp — the MCP endpoint. It accepts an access token and nothing else: a signed-in browser session is refused.
  • Read-only. The tools search your items, open one, list recent ones and list your tags. None of them can change anything, and none returns a screenshot.

What is not implemented

Named here so nobody builds against something that is not there.

  • WebSub. No hub is advertised and none is subscribed to. Feeds followed here are polled daily, with conditional requests so an unchanged feed costs almost nothing.
  • Linked Data Notifications. No inbox, and no plan for one: Webmention already covers being told about a link.
  • Post Type Discovery and JF2. Posts here are one of four kinds, decided by which property arrived, which is all this application needs to know.

Something behaving differently from what this page says is a bug worth telling us about: support@wyome.com.