No probs. Thx for fixing.

Tollbat is currently blocking ActivityPub requests for your Application actor.

Compare something like:

curl --header 'accept: application/activity+json' --location https://lemmy.ml/ (which provides a JSON response)

with:

curl --header 'accept: application/activity+json' --location https://hilariouschaos.com/ (which returns the HTML challenge page)

Exactly that, yeah. Thank you for the link.

It's straight-forward enough to do in back-end code, to just reject a query if parameters are missing, but I don't think there's a way to define a schema that then gets used to auto-generate the documentation and validate the requests. If the request isn't validated, then the back-end never sees it.

For something like https://freamon.github.io/piefed-api/#/Misc/get_api_alpha_search, the docs show that 'q' and 'type_' are required, and everything else is optional. The schema definition looks like:

/api/alpha/search:
    get:
      parameters:
        - in: query
          name: q
          schema:
            type: string
          required: true
        - in: query
          name: type_
          schema:
            type: string
            enum:
              - Communities
              - Posts
              - Users
              - Url
          required: true
        - in: query
          name: limit
          schema:
            type: integer
          required: false

required is a simple boolean for each individual field - you can say every field is required, or no fields are required, but I haven't come across a way to say that at least one field is required.

It's in use by a Feed: https://piefed.social/f/3dprinting

Users, Communities and Feeds are all actors as far as remote fediverse instances are concerned, and they don't necessarily have the means to distinguish between the types, so it's easier if there's no overlap.

I don’t know why All would stop like that, it shouldn’t do.

ip.address - - [24/Sep/2025 23:05:16] "GET /api/alpha/post/list?show_hidden=false&disliked_only=false&limit=25&page=1&saved_only=false&sort=Active&liked_only=false&type_=All HTTP/1.0" 200 -
ip.address - - [24/Sep/2025 23:05:41] "GET /api/alpha/post/list?page_cursor=2&show_hidden=false&disliked_only=false&limit=25&saved_only=false&sort=Active&liked_only=false&type_=All HTTP/1.0" 200 -

Boost starts using page_cursor after page 1, which got nixed

PieFed has a similar API endpoint. It used to be scoped, but was changed at the request of app developers. It's how people browse sites by 'New Comments', and - for a GET request - it's not really possible to document and validate that an endpoint needs to have at least one of something (i.e. that none of 'post_id' or 'user_id' or 'community_id' or 'user_id' are individually required, but there needs to be one of them).

It's unlikely that these crawlers will discover PieFed's API, but I guess it's no surprise that they've moved on from basic HTML crawling to probing APIs. In the meantime, I've added some basic protection to the back-end for anonymous, unscoped requests to PieFed's endpoint.

This is the kind of thing that apps handle well - I viewed your post from Voyager, and just had to click the sopuli.xyz link to get is resolved to my instance.

For the web browser experience: that link used to be a bit more visible (you can currently also get it from community sidebars, but it used to also be in post sidebars too). Someone complained though, and it was removed from post sidebars, so I assume they'd have the same complaint if it was re-surfaced again. You could just bookmark it, of course.

The page itself shouldn't be slow to load (it's a very lightweight page that's not doing anything until you click 'Retrieve'). It doesn't immediately redirect you to the post because the assumption was that you might want to retrieve more than one post at a time.

That said, if you're already viewing a page on the 'wrong' instance, then being able to change 'https' to 'web+pf' and have it work sounds cool (although it looks like Chrome makes highlighting 'https' into a 2-click experience).

There's definitely something about the experience. I have a projector at home, and it's not the latest model, and it's far from the ideal set-up, but I was watching The Martian recently, and found myself wondering if it was the greatest movie ever made, and then had to remind myself that no, it's just that I was projecting it.

Man, now they're going to use the ad revenue from that stream to make 1 and a half more Steven Seagal films. The only way we'll ever be rid of them is if Seagal dies, which of course can never happen.

There are some api rate limits (look for RateLimitExceeded in routes), but the settings are generous enough that a normal user (and not a bot) isn't going to get caught by them.