cast.onion API

The cast.onion API provides access to stations, streaming, applications, and administrative tools. All routes are prefixed with /v1/.

Session & Connection

• GET /v1/ws — WebSocket connection, returns a session ID
• GET /v1/docs — Returns this documentation page

Stations

• GET /v1/stations — List all active stations (requires session)
• GET /v1/stations/:id — Get station by ID (requires session)

Applications

• POST /v1/apply — Submit a hosting application (requires session)
• GET /v1/apply/:id — Check application status (requires session)

Station Owner

• GET /v1/owner/dashboard — Get station info (requires session + X-Access-Token)
• PATCH /v1/owner/station — Update station details (requires session + X-Access-Token)

Streaming

• POST /v1/broadcast/:station_id — Stream audio to a station (requires X-Station-Key)
• GET /v1/listen/:station_id — Listen to live audio stream (audio/ogg)
• GET /v1/status/:station_id — Check if a station is live

Guest Rooms

• POST /v1/room/create — Create an invite room (requires session + X-Access-Token)
• POST /v1/room/join/:code — Join a room using an invite code
• GET /v1/room/:room_id — Get room info and guest list
• POST /v1/room/:room_id/stream — Guest audio stream (requires X-Guest-ID)
• POST /v1/room/:room_id/mute/:guest_id — Host mutes a guest (requires X-Access-Token)
• POST /v1/room/:room_id/selfmute — Guest mutes themselves (requires X-Guest-ID)

Admin

All admin routes require X-Admin-Token.

• GET /v1/admin/applications — List pending applications
• POST /v1/admin/applications/:id/approve — Approve application
• POST /v1/admin/applications/:id/deny — Deny application
• POST /v1/admin/stations/:id/suspend — Suspend station
• POST /v1/admin/stations/:id/revoke — Revoke station
• POST /v1/admin/stations/:id/unsuspend — Unsuspend station

GraphQL

• POST /v1/graphql — GraphQL endpoint for stations, directory, and applications

CDN

• GET localhost:1050/:path — Static file server (cdn-files directory)