Ksync Sync API

Stateless post-quantum sync relay for Kryon apps. The server stores public keys and mirrored app data, never client private keys. Protocol v5 makes encrypted records the primary private-data surface while legacy typed rows remain available for compatibility, and released Inbe v4 encrypted collections remain valid.

OpenAPI JSON · Health check · Readiness · Metrics

GET/api/v1/apps

Lists registered apps, collection prefixes, visibility classes, and capabilities. Built-in registrations include Inbe and Uku.

POST/api/v1/apps

Registers or updates an app when KSYNC_ADMIN_TOKEN is set and X-Ksync-Admin matches it.

GET/api/v1/sync/challenge?user_id=<sha256-public-key-hex>

Issues a single-use 32-byte challenge nonce encoded as lowercase hex.

GET/api/v1/sync/ws

Upgrades to a WebSocket event stream authenticated with Authorization: Bearer <token>, or browser subprotocols ksync-sync-v1, bearer.<token>.

POST/api/v1/sync

Applies signed local changes and returns remote changes newer than since_server_version.

GET/api/v1/sync/diagnostics

Returns bearer-authenticated sync state, table counts, compaction position, and legacy client hints.

GET/api/v1/tokens/issuer

Returns the Waozi token issuer key. Official apps accept only Waozi-signed waozi:token receipts.

GET/api/v1/tokens/products

Lists configured token products and direct Monero prices when direct purchases are enabled.

GET/api/v1/tokens/balance

Returns the bearer-authenticated account's Waozi token balance computed from signed ledger events.

POST/api/v1/tokens/spend

Debits Waozi tokens with app policy and idempotency enforcement.

POST/api/v1/tokens/purchases/monero/invoices

Creates a bearer-authenticated Monero invoice for a configured token product.

GET/api/v1/tokens/purchases/monero/invoices/{id}

Returns invoice status and settles a confirmed Monero payment against the authenticated account.

GET/POST/api/v1/account/app-grants

Lists or creates bearer-authenticated grants for sharing registered app collection prefixes across apps.

GET/api/v1/account/app-records

Returns encrypted records from a granted collection prefix for cross-app use.

GET/POST/api/v1/friends

Bearer-authenticated friend requests, accepted friends, and app-neutral shared profile stats.

DELETE/api/v1/account

Deletes all remote data for the signed sync account.

POST/api/v1/account/delete-with-key

Deletes all remote data for the sync account after verifying exported account key text.

Signed Message

ksync-sync-v1
<HTTP_METHOD>
<HTTP_PATH>
<sha256 hex of exact raw request body bytes>
<challenge nonce hex>

Signed requests use X-Ksync-User, X-Ksync-Signature, and Content-Type: application/json.