Profile API
Account identity registration
GET /api/user/bap-ids requires a session and returns { bapIds: [...] }. Supplying ?pubkey=… performs a public lookup used during login. Results include id, identity_key, root_address, current_address, identity, is_primary, and stored metadata. Public lookup is not proof that the caller owns any listed identity.
POST /api/user/bap-ids registers a BAP identity for the signed-in account:
{
"bapId": "locally-derived-bap-id",
"name": "My profile",
"counter": 0,
"isPrimary": false,
"accountPubkey": "compressed-public-key"
}bapId is required. The route also accepts a public profile document. Generate/derive keys locally; this API does not need the backup password or WIF. Registration is separate from publishing an on-chain BAP record. Do not treat registration metadata alone as cryptographic evidence for a third-party authorization decision.
Use the account UI for primary selection and removal so its ownership/lifecycle checks are preserved. Deleting a profile record does not destroy the corresponding private key or erase its published history, and an active handle/delegation lifecycle can block deletion.
BAP profile and draft
| Method/path | Behavior |
|---|---|
GET /api/bap/profile?bapId=… | Read the resolved public profile, or the caller's available draft |
GET /api/bap/profile?pubkey=… | Resolve a profile from a public key |
POST /api/bap/profile | Save an session-scoped profile draft using { bapId, profile } |
DELETE /api/bap/profile?bapId=… | Remove the caller's session-scoped draft |
The GET response uses { status: "OK", result: ... } and can include draft/unpublished markers. POST saves a draft; it does not sign or broadcast a transaction.
There is no supported /api/profile/create endpoint accepting a password and no PUT /api/profile update contract. Those older examples were incorrect.
Publication tracking
POST /api/bap/profile/published records a client-completed publication using { bapId, txid, profile, kind?, fundedBy? }. txid must be 64 lowercase hexadecimal characters and profile must include identity. GET /api/bap/profile/published?bapId=… returns { publication } for the signed-in user's identity.
Recording a submitted transaction is not independent proof of chain confirmation. See BAP profiles for draft, signing, broadcast, and indexing boundaries.