Drawer, WIP

NOTE

This page is a work in progress. Endpoints below haven't been fully researched.

Get media in drawer

Requires Authorization.

GET /v4/chat/media/drawer

Response:

Array of DrawerMedia.

Get media in drawer for a conversation

Requires Authorization.

GET /v4/chat/media/drawer/{conversationId}

Response:

Array of DrawerMedia.

Add media to drawer

Requires Authorization.

MediaId must be obtained through uploading.

PUT /v4/chat/media/drawer/{mediaId}

Response:

Empty.

Errors:

• 500 — Repeated requests cause 500 HTTP status "Internal Error".

Delete media from drawer

Requires Authorization.

Repeated requests are completed without errors.

DELETE /v4/chat/media/drawer/{mediaId}

Response:

Empty with HTTP status 202.

Upload media

Requires Authorization.

A correct Content-Type request header is required. length is sent for audio and video, looping only for video.

POST /v5/chat/media/upload

Query:

• length — long integer, optional
• looping — boolean, optional
• takenOnGrindr — boolean, Media captured with the in-app camera. The official client uses a signed upload endpoint only when this is true and the taken-on-grindr-signing-enabled flag is on.

Body:

Binary file.

Response:

• mediaId — long integer
• url — URL
• mediaHash — string, See Media -> Public CDN files -> Profile Images

Upload media (signed)

Requires Authorization.

Signed version of the unsigned Upload media. A correct Content-Type request header is required, and the request must carry a valid device-key signature over the raw request body; see Security headers -> Device-key upload signing. length and looping are never sent here. All media uploaded through this endpoint are marked as "Taken on Grindr" server-side.

POST /v6/chat/media/upload

Query (optional):

• length — long integer, optional
• looping — boolean, optional

Headers:

• X-Key-Id — base64url (no padding) SHA-256 of the device key SPKI — the keyId from Register device key.
• X-Sig — base64url (no padding) DER ECDSA-P256-SHA256 signature over the UTF-8 string bodyHash|timestamp|userId|androidId|nonce. See Security headers -> Device-key upload signing.
• X-Timestamp — Signing time as Unix epoch milliseconds (decimal string); must equal the timestamp inside the signed string.
• X-Nonce — base64url (no padding) of 32 random bytes, unique per request; must equal the nonce inside the signed string.

Body:

Binary file.

Response:

• mediaId — long integer
• url — URL
• mediaHash — string, See Media -> Public CDN files -> Profile Images

Errors:

• 4xx — Signature rejected; see UploadSigningErrorResponse (timestamp_drift / nonce_replayed).

DrawerMedia

• id — long integer
• url — URL
• contentType — string
• createdTs — unix timestamp in milliseconds
• used — boolean
• takenOnGrindr — boolean

MediaUploadResponse

• mediaId — long integer
• url — URL
• mediaHash — string, See Media -> Public CDN files -> Profile Images