The OSO API

The OSO API is how a program reaches this site. It authenticates with a key, never a cookie, and lives under /api/v1/. Today it covers bug reports; the prefix is versioned so that anything added later does not move what is already there.

Getting a Key

Account, then API keys. A key is shown once and stored only as a hash, so there is no way to look it up again. Keys expire after a year unless you say otherwise.

A key acts as you and sees exactly what you would see. Staff-only notes come back only if your own account is staff, checked on every request rather than fixed when the key was made.

Using It

Send the key as a header, never in a URL: query strings end up in server logs, in Referer headers and in your shell history.

curl -H "Authorization: Bearer oso_..." https://oldschoolops.com/api/v1/bugs

Endpoints

Method and path	What it does
`GET /api/v1/bugs`	Recent reports. Optional `status`, `game` and `page`.
`GET /api/v1/bugs/{ref}`	One report and its comments.
`GET /api/v1/bugs/similar`	Whether something has been reported already, without filing anything.
`POST /api/v1/bugs`	File a report.

similar before POST is the half of de-duplication that stops a duplicate existing at all: it answers "has this been reported" without writing a row.

Response

{
  "generated_at": "2026-09-05T12:00:00Z",
  "count": 2,
  "page": 1,
  "bugs": [
    {
      "ref": "RF2232-261",
      "title": "Pit bosses never healed",
      "game": "rf2232",
      "status": "fixed",
      "severity": "normal",
      "reporter": "Somebody",
      "created_at": "2026-08-01T09:12:00Z",
      "updated_at": "2026-08-14T16:40:00Z",
      "url": "https://oldschoolops.com/bugs/RF2232-261"
    }
  ]
}

Field names are a contract. Timestamps are RFC 3339 in UTC.

Errors

Status	Means
401	No key, or the key was not accepted
403	The key has no access to that
404	No such report
429	Too many requests

A rejected key returns 401 whether it is unknown, revoked or expired. The three are one answer deliberately: telling them apart confirms which half of a guess was right.

Revoking

Account, then API keys, then Remove. It stops working immediately.