Athenana is a private, invitation-only place to keep things — but the ways in and out of it are open standards rather than an API of its own invention. This page is what a client, a server or a person can rely on it to speak, with the addresses to speak to. Everything listed is implemented and running; what is not implemented is named at the bottom rather than left for you to discover.
Any Micropub client can post here — Quill, Indigenous, a Shortcut, an editor plugin — without either side knowing about the other.
/micropub — create, update, delete and undelete.h=entry and mf2 JSON
type: ["h-entry"].
q=config and q=source. There is no media endpoint
and no syndicate-to; neither is advertised, because neither
exists.
What a post becomes here:
bookmark-of → a saved link, with content kept as your note on itquote-of → a highlight, with content as the passage quotedphoto uploaded as multipart → an imagecontent alone → a notecategory → tags, and name → the titleA note, a highlight and an image arrive private; a link follows the same rule a link saved any other way does. Posting something never publishes it.
How a client gets a token without anybody pasting one. Signing in as a person is separate and unchanged — this is the authorization layer clients use.
/.well-known/oauth-authorization-server — the metadata document, also linked as rel="indieauth-metadata"/indieauth/authorize — the consent screen/indieauth/token — the token endpoint
PKCE is required, and S256 is the only method. The
specification permits falling back to a flow without it; this server does not,
and plain is absent from the metadata rather than listed and then
refused.
Four scopes — create, read, update and
delete. A scope this server does not implement is dropped rather
than refusing the whole request, and the consent screen shows exactly the subset
that was understood, so you approve what you will actually get. Every token is
listed on the account it belongs to and can be revoked there one at a time.
Both directions, and neither is automatic in the way people expect.
/webmention — the receiving endpoint, advertised both as an HTTP Link header and as rel="webmention" on every public pageA mention that arrives is reviewed by the owner, not published. Nothing you send appears on a page here on your say-so.
An account with a blog can be followed from Mastodon and anywhere else that speaks ActivityPub.
/.well-known/webfinger — resolves @handle@athenana.com to an actor/blog/{handle} — the blog, and its actor document under content negotiation/blog/{handle}/outbox and /blog/{handle}/followers/blog/{handle}/inbox — HTTP Signatures required; an unsigned request is refused before its body is read as anything but bytesThis is deliberately partial, and the limit is worth knowing before you build against it. Follow and Undo are honoured, and posts are delivered to followers. Replies, likes, boosts and mentions arriving here are acknowledged and then dropped — accepting them would mean storing and moderating other people's writing, which is not what this is. Nothing you send to that inbox will appear anywhere, and nobody is notified.
/feed.xml and /feed.json — the public front page, as RSS and JSON Feed/blog/{handle}/feed.xml and /blog/{handle}/feed.json — one account's blog, in bothNamed here so nobody builds against something that is not there.
Something behaving differently from what this page says is a bug worth telling us about: support@wyome.com.