Developer
API Architecture
REST conventions, standard response formats, and error handling policies.
API Architecture
The GO Shortener backend exposes a clean, synchronous JSON REST API under the /api namespace.
Response Serialization Standards
Success Envelope
Endpoints returning data deliver pure JSON with an appropriate HTTP 200 or 201 status code:
{
"short_code": "K8xP2q",
"short_url": "https://go.arcn.online/K8xP2q",
"destination_url": "https://github.com/ItsARCn/Go-shortner",
"expires_at": "2026-09-10T14:30:00Z",
"created_at": "2026-09-03T14:30:00Z"
}
Standard Error Envelope
When an operation fails, the API responds with a structured error payload:
{
"error": "The destination URL cannot point to internal or private IP subnets."
}
HTTP Status Codes Reference
| Code | Name | Usage in GO Shortener |
|---|---|---|
200 | OK | Successful fetch, update, or action resolution |
201 | Created | Successful short link creation or account registration |
302 | Found | Active link redirection to target destination URL |
400 | Bad Request | Malformed JSON, failed URL validation, or SSRF policy violation |
401 | Unauthorized | Missing, invalid, or expired go_session cookie |
403 | Forbidden | Insufficient RBAC permissions, banned user, or disabled link |
404 | Not Found | Target short code or user does not exist |
410 | Gone | Target short link has expired |
429 | Too Many Requests | Anonymous 24-hour quota or monthly registered quota exceeded |
500 | Internal Error | Unhandled server panic or SQLite transaction error |
Authentication Mechanism
API calls to protected endpoints authenticate using the HTTP-only go_session cookie:
- For web applications, standard
fetchwithcredentials: "include"automatically transmits the cookie. - For external API testing via
curl, supply the cookie header:Terminalcurl -H "Cookie: go_session=your_session_token" https://go.arcn.online/api/user/dashboard