api.stoat.chat; api.revolt.chat still answers the same API. Create a bot in the client under user settings, or copy a user session token, then pass it here. Things to know before you call:
- The header depends on the credential. A bot token goes in
X-Bot-Token, a user token inX-Session-Token. They are not interchangeable: a bot token in the session header is rejected. Setcredential: 'bot'(the default) or'user'. Authorizationis not used. Revolt ignores a bearer header entirely, which is why the plugin writes the token into its own header rather thanTOKEN.- A custom host is supported.
base_urltargets a self-hosted instance; the default is Stoat’s production host. - Two error bodies. Revolt’s own errors answer
{ "type": "NotFound", "location": "…" }, sometimes with the field that was missing (MissingPermissionaddspermission). A bad token (401) or a body that cannot be parsed (422) gets the web framework’s envelope instead,{ "error": { "code", "reason", "description" } }. The plugin reads both. A 429 carriesretry_afterin the body in milliseconds, which the rate-limit handler waits. - Messages come back with their authors. With
include_users=truea message list answersmessagesbeside theusersandmembersthose messages reference, so a caller never has to resolve an author id itself. The plugin sendsinclude_users=trueunless you passfalse, in which case Revolt answers a bare array and the plugin returns onlymessages. - Cursors, not pages.
beforeandafterare message ids, and they contradict each other, so the schema rejects both at once.sortpicks the order (Latestby default); Stoat ignores it, along withbeforeandafter, whennearbyis set. - A message needs content or an attachment. An empty post is refused, so the schema requires one of the two.
- Deletes depend on the channel type.
messages.deleteremoves the message for good.channels.deletedeletes a server channel with its messages, leaves a group, and only closes a direct message, whose messages stay.
- 14 typed API operations
Setup
1
Install
2
Add the plugin
corsair.ts
multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.3
Choose authentication
- API Key (Recommended)
No setup required yet. When you make your first request as a tenant, Corsair prompts for the API key.More: API Key
4
Connect a tenant
Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.
Example API calls
Read the latest messages in a channelWhat’s next
API reference
Every
revolt.api.* operation with input and output types.Connect / OAuth
createLink, Hub delivery, and tenant connect flows.
Use with agents
Expose this plugin’s operations as MCP tools.