API

Routes

• GET /list.bin and GET /list.json are the list, each with its signature at .sig.
• GET /reports/ is the vote log.
• GET /database/posts.csv is every post as CSV, written once a day. The database page says what each column holds.
• POST /v1/reports sends a vote. DELETE /v1/reports takes it back.
• PUT /v1/name sets the name an install shows by on the stats page.
• GET /v1/stats is the stats page as JSON.
• GET /v1/health answers when the server is up.

The list

/list.bin is the one for phones. It's a 16-byte head starting with SLC1, then 13 bytes for each entry in hash order, so an app can search it where it lies without parsing anything. /list.json holds the same entries as JSON. Both can be fetched from any web page.

Each signature is a base64 DER ECDSA P-256 signature over the list's exact bytes. Use a list only when its signature checks out, and build the key into your app rather than downloading it, so a list from anywhere else can't pass.

An app that keeps list.bin can ask for /list.bin?since=<version> with the version it has. When this server kept the changes since then, it sends just those, starting with SLD1 and ending with the new list's signature, and otherwise the whole list. The spec has the format under "Changes since a version".

The lists here are signed for this key, an ECDSA P-256 public key as base64 SubjectPublicKeyInfo:

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEm3z98lvD0Uw5pugevvcJmfTFQ7MSkdIXFB46QdE8iX9Je0l6G3S8SyiZfzemEBzq85KBm7dLuaxZonvDCpRP1g==

Finding a post

Posts are listed by a hash of their key, never by their link. A key names the site and the post, like tt:video:7351234567890123456 for a TikTok video, and keys.md has the form for each site. The hash is the first 16 characters of the lowercase hex SHA-256 of the key's UTF-8 bytes, and test-vectors.json has links, keys and hashes to check your code against. Work it out on the device and look it up there, so nobody learns what your user is watching.

Each entry is [code, ai, notAi], a label and the two vote counts, so your app can go by whatever number of reports your user picks.

• 1 is reported: at least 3 people, with at least 70% of the votes saying AI.
• 2 is widely reported, with at least 10 people and 85%.
• 3 is disputed: at least 3 people, but only 40% to 70% of the votes say AI. Show it as disputed and don't hide it.
• 4 is a creator rather than a post, one with 3 or more posts at code 1, 2 or 5. Its entry is [4, posts, 0], where the middle number counts those posts, not votes.
• 5 means the owner of this server looked at the post and ruled it AI-made, whatever the votes say.
• 6 is a creator the owner ruled AI-made. Its entry is [6, posts, 0], and every post of theirs counts as ruled AI unless the post's own entry is 5 or 7. Say the account was checked, not the post.
• 7 means the owner looked at the post and ruled it real. Show it with no label and no count, whatever its creator's entry says.
• 0 is listed but short of every label.

Say how many people reported a post, never that it is AI.

How often to download

A new list goes out at most every 5 minutes. Keep the copy you have for 30 minutes, then ask again with its ETag in If-None-Match. A 304 means nothing changed and comes back without a body. Download in the background, never once for each video.

Reporting from your app

Make one random install ID when your app is installed and send it with every report, so each install gets one vote on a post. Give your user a few seconds to undo before a report goes out.

One install can send 60 reports an hour, and one IP address 600 requests an hour. The bodies, and the proof of work a server can ask for, are in the spec. Link the reporting guidelines near your report button so everyone means the same thing by a report.

The vote log

/reports/ keeps every vote ever counted as JSON lines, one file per batch in a folder for each day. A batch never changes once it's there, so a mirror only fetches the new ones. It holds hashes, never names or install IDs.

Credit

The list and the log are under CC BY-NC-SA 4.0. Show this line where your users can see it, with a link to this server:

Uses HushSlop data licensed under CC BY-NC-SA 4.0

That's all a non-commercial app needs. Using the data in a product or service you charge for, or inside a business, needs a separate license, as the license page says.