Developer

API Architecture

REST conventions, standard response formats, and error handling policies.

API Architecture

The GO Shortener backend exposes a clean, synchronous JSON REST API under the /api namespace.


Response Serialization Standards

Success Envelope

Endpoints returning data deliver pure JSON with an appropriate HTTP 200 or 201 status code:

{
  "short_code": "K8xP2q",
  "short_url": "https://go.arcn.online/K8xP2q",
  "destination_url": "https://github.com/ItsARCn/Go-shortner",
  "expires_at": "2026-09-10T14:30:00Z",
  "created_at": "2026-09-03T14:30:00Z"
}

Standard Error Envelope

When an operation fails, the API responds with a structured error payload:

{
  "error": "The destination URL cannot point to internal or private IP subnets."
}

HTTP Status Codes Reference

CodeNameUsage in GO Shortener
200OKSuccessful fetch, update, or action resolution
201CreatedSuccessful short link creation or account registration
302FoundActive link redirection to target destination URL
400Bad RequestMalformed JSON, failed URL validation, or SSRF policy violation
401UnauthorizedMissing, invalid, or expired go_session cookie
403ForbiddenInsufficient RBAC permissions, banned user, or disabled link
404Not FoundTarget short code or user does not exist
410GoneTarget short link has expired
429Too Many RequestsAnonymous 24-hour quota or monthly registered quota exceeded
500Internal ErrorUnhandled server panic or SQLite transaction error

Authentication Mechanism

API calls to protected endpoints authenticate using the HTTP-only go_session cookie:

  • For web applications, standard fetch with credentials: "include" automatically transmits the cookie.
  • For external API testing via curl, supply the cookie header:
    Terminal
    curl -H "Cookie: go_session=your_session_token" https://go.arcn.online/api/user/dashboard
    
Copyright © 2026