API Reference
How to call the App API: where it lives, how you authenticate, and the conventions every endpoint follows. The shapes, names and limits follow Discord's API wherever the two platforms do the same thing, so a bot written for one needs little change for the other. Moymo's own words are used where Moymo's things are different (a server, not a guild).
Base URL
Base URLText
text
https://moymo.net/api/app/v1The version is in the path. Within a version things are only added, never changed or removed.
Authentication
| Header | Credential | Acts as |
|---|---|---|
Authorization: Bot <bot token> | A bot token | The bot: a member of the servers it was added to, with the permissions of its role |
Authorization: Bearer <access token> | An OAuth2 access token | The member who authorised your application, for the scopes on the token |
Nothing else is accepted (a member's browser session is refused). A missing or wrong credential answers 401; a valid one asked to do what it may not answers 403. What a server, channel, member or message call needs is a bot token: an access token only reads who the member is and which servers they are in.
Conventions
| Format | JSON in and out. Send Content-Type: application/json with a body. Names are snake_case. Answers are never cached (Cache-Control: no-store). |
| IDs | UUID strings: servers, channels, messages, members, roles, commands. |
| Times | ISO 8601 in UTC. |
| Permissions | A decimal string of a 64-bit number ("3072"), so that a client whose numbers are doubles never rounds a bit away. See Permissions. |
| Empty fields | A field with no value is left out of an answer; the API never sends null. In the reference tables a ? before a type marks such a field. |
| Unknown fields | Ignored in request bodies, so a request written for Discord goes through. |
| CORS | Open: any origin may call the App API from a browser, because credentials are tokens you hold, never cookies. Never put a bot token or a client secret in a web page. |
| Audit | Everything a bot does is done as the bot, and is shown as the bot in the server. |
Errors and limits
- Errors have one shape, listed in Errors.
- Every call is held to Rate limits; the answer says where you stand in
X-RateLimit-*headers. - What a bot may see about other people is guarded by Intents.
Resources
| Resource | What it is |
|---|---|
| User | Who a token is, and the servers they are in. |
| Application | The application a token belongs to. |
| Application commands | Slash commands and context-menu commands an application registers. |
| Server | A server, its roles, members and bans. |
| Channel | A channel, its invites, typing. |
| Message | Messages, embeds, reactions, pins. |
| Interaction responses | Answering, following up on and editing the response to an interaction. |
Guides that go with them: Interactions, Components, Sending messages.
What is not here yet
The gateway (events over a WebSocket), incoming and outgoing webhooks, attachments on messages sent by a bot, layout components (containers, sections, galleries), and a few server features (forum posts, to-do lists, polls, calendars) are planned: the roadmap says in which order. Everything in this reference exists and is tested today.