API

Kumir developers

Native iOS/Android and partner integrations use versioned /api/v1. The machine-readable contract is OpenAPI 3.1 at GET /api/v1/openapi. Do not invent Stripe, APNs, FCM, or OAuth keys — missing providers return 501 or log-only, never a fake success.

Auth: POST /api/v1/auth/login returns an HS256 access token (1 hour) and a rotating refresh token (30 days). Send Authorization: Bearer … and X-Fameo-Channel: ios|android. Health probes /api/v1/health and /ready stay unauthenticated.

stars

GET /api/v1/stars
Server-side talent search + catalog ranking (optional q, kids, instant) · Optional bearer
GET /api/v1/stars/{username}
Public storefront (reviews, samples, related) · Optional bearer
GET /api/v1/stars/{username}/feed
Talent follower feed (optional q) · Optional bearer
GET /api/v1/stars/{username}/live-slots
GET stars · :username · live-slots · Optional bearer
GET /api/v1/stars/{username}/merch
GET stars · :username · merch · Optional bearer
GET /api/v1/stars/{username}/merch/{publicId}
GET stars · :username · merch · :publicId · Optional bearer
GET /api/v1/stars/{username}/reviews
Public storefront reviews (optional q) · Optional bearer