Start here
Report a Code preview
/v1/previews/reportson https://api.auray.ai/v1Report a Code preview — a page served at its own address on auray.app while somebody's Code project runs — by that address.
Report a Code preview — a page served at its own address on auray.app while somebody's Code project runs — by that address. No key is read: whoever met the page reports it anonymously, paced per address and network, and pays a proof-of-work challenge from POST /v1/community/reports/challenge (send its challenge and your nonce; one challenge is one report of either kind). The same report again, for the same reason while it is open, is merged into it. A preview already taken down is refused taken_down, and an address no preview of ours has not_found. Nobody is told how a report sent here ends; to hear back, write to the abuse address the help page names. A report names no account.
#Authentication
No key needed, and none is read: a report about a Code preview is anonymous, paced per address and network, and pays a proof-of-work challenge from POST /v1/community/reports/challenge — send its challenge and your nonce in the body.
#Request
#Body
application/json, required.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
address | string | yes | — | The preview's address as it was opened — https://<label>.auray.app, with any path after it, or without its scheme. 0 to 2048 characters. |
category | string | yes | — | One of "csam", "nonconsensual_likeness", "violent_extremism", "voice_cloning", "harassment", "copyright", "disinformation", "phishing", "malware", "other". |
details | string | yes | — | What the page did, as you saw it. 10 to 5000 characters. |
challenge | string | yes | — | A challenge from POST /v1/community/reports/challenge, unchanged. |
nonce | string | yes | — | A nonce such that sha256("<salt>.<nonce>") begins with the challenge's bits zero bits. 0 to 64 characters. |
#Example request
curl -X POST https://api.auray.ai/v1/previews/reports \
-H "content-type: application/json" \
-d '{
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
}'const res = await fetch("https://api.auray.ai/v1/previews/reports", {
method: "POST",
headers: {
"content-type": "application/json",
},
body: JSON.stringify({
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
}),
});
console.log(await res.json());import requests
r = requests.post(
"https://api.auray.ai/v1/previews/reports",
json={
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
},
)
r.raise_for_status()
print(r.json())package main
import (
"bytes"
"fmt"
"io"
"net/http"
)
func main() {
body := []byte(`{
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
}`)
req, err := http.NewRequest("POST", "https://api.auray.ai/v1/previews/reports", bytes.NewReader(body))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
out, _ := io.ReadAll(res.Body)
fmt.Println(res.Status, string(out))
}<?php
$ch = curl_init("https://api.auray.ai/v1/previews/reports");
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
],
CURLOPT_POSTFIELDS => json_encode([
"address" => "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category" => "phishing",
"details" => "The page asks for a bank password and a card number.",
], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_HTTP_CODE), " ", $response, PHP_EOL;require "net/http"
require "json"
uri = URI("https://api.auray.ai/v1/previews/reports")
req = Net::HTTP::Post.new(uri)
req["Content-Type"] = "application/json"
req.body = {
"address" => "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category" => "phishing",
"details" => "The page asks for a bank password and a card number."
}.to_json
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
puts res.code, res.bodyimport java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Main {
public static void main(String[] args) throws Exception {
String body = """
{
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
}""";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.auray.ai/v1/previews/reports"))
.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString(body))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.auray.ai/v1/previews/reports");
var body = """
{
"address": "https://abcdefghijklmnopqrstuvwxyz.auray.app/login",
"category": "phishing",
"details": "The page asks for a bank password and a card number."
}
""";
request.Content = new StringContent(body, Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");#Responses
#201 Created
Received.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
object | string | yes | — | One of "report". |
target | string | yes | — | One of "preview". |
category | string | yes | — | One of "csam", "nonconsensual_likeness", "violent_extremism", "voice_cloning", "harassment", "copyright", "disinformation", "phishing", "malware", "other". |
received | boolean | yes | — | |
merged | boolean | yes | — | Merged into the open report about the same preview for the same reason. |
request_id | string | no | — | Mirrored in the X-Request-Id header. |
Headers:
| Header | Description |
|---|---|
RateLimit-Limit | Burst capacity. |
RateLimit-Remaining | |
RateLimit-Reset | Seconds until refill. |
X-RateLimit-Limit | |
X-RateLimit-Remaining | |
X-RateLimit-Reset | Unix seconds. The X- spelling is what client libraries read. |
X-Request-Id |
#400 Bad Request
#404 Not Found
#409 Conflict
#410 Gone
#413 Payload Too Large
#429 Too Many Requests
#503 Service Unavailable
#Status codes
| Status | Meaning |
|---|---|
201 | Received. |
400 | Bad Request |
404 | Not Found |
409 | Conflict |
410 | Gone |
413 | Payload Too Large |
429 | Too Many Requests |
503 | Service Unavailable |
Every refusal names its code, and every code is explained at Errors.