for developers

the api ✦

a small, deliberate surface: two public read-only endpoints (plus an rss feed) for status pages and bots, and the authenticated dashboard api that powers this site.

public endpoints

no authentication. aggregated and anonymized only — command names and counts, never user or guild ids. rate limited to 60 requests/minute per ip and cached for 60 seconds on the server.

GET /api/public/stats

live vitals (servers, members, latency, uptime), today's command usage, top commands (7 days), fun aggregate counters (total xp, warnings, confessions, memories, active streaks), a growth series and a latency history for charts.

request
curl  https://miles-discord-bot.onrender.com/api/public/stats
response (trimmed)
{  "status": "ok",  "version": "1.1.0",  "servers": 5,  "members": 1234,  "latency_ms": 82.5,  "uptime_seconds": 432000,  "uptime_percent": 99.87,  "commands_used_today": 214,  "top_commands": [{ "command": "daily", "count": 41 }],  "fun_stats": {    "total_xp": 812345,    "warnings_issued": 37,    "confessions_posted": 12,    "memories_stored": 214,    "daily_streaks_active": 18  },  "growth": [{ "date": "2026-09-01", "servers": 3 }]}

GET /api/changelog

the parsed release notes — a json array of versions with feature / fix / improvement / breaking categories. mirrors /changelog.

request
curl  https://miles-discord-bot.onrender.com/api/changelog

GET /changelog.rss

the same releases as rss 2.0 — subscribe from any reader.

request
curl  https://miles-discord-bot.onrender.com/changelog.rss

GET /health

plain vitals (status, uptime, guilds, users, latency, supabase flag) — what the landing page stats bar polls.

request
curl  https://miles-discord-bot.onrender.com/health

the dashboard api

the private half (settings reads/writes, live actions) is not a public api by design. requests must carry a discord oauth bearer token, the target guild must contain aurelia, the caller must hold manage server there, and mutations additionally need a csrf token bound to the bearer. everything is rate limited and audit logged.

auth model
browser  ──cookie──▶ next.js proxy ──bearer+csrf──▶ flask api                (httpOnly)              (server-side only)GET     /api/dashboard/guild/<gid>/settings/<module>PATCH   /api/dashboard/guild/<gid>/settings/<module>POST    /api/dashboard/guild/<gid>/action/<action>GET     /api/dashboard/ai/status

curious how it all fits together? aurelia is a managed project with a privately maintained source — the live stats page and the dashboard itself are the living demonstration; questions about the topology are welcome in the support server.

fair use

  • poll the public endpoints at most once a minute — they are cached server-side anyway
  • don’t scrape the authenticated api; log in like the dashboard does
  • status pages and discord bots embedding her stats are explicitly welcome — link back to https://veloura-aurelia.vercel.app