Account

Create account via email, WIP

NOTE

This endpoint hasn't been researched yet

NOTE

URL is dynamic and currently unknown.

Body type: CreateAccountEmailRequest (undocumented).

Response type: FirstPartyCreateAccountResponse (undocumented).

POST /v?/users/registration/email

Validate password complexity, WIP

NOTE

This endpoint hasn't been researched yet

Body type: ValidatePasswordComplexityRequest (undocumented).

POST /v3/users/password-validation

Register push token

Requires Authorization.

Binds an FCM registration token to the signed-in profile so the server can deliver push notifications. Re-registering the same token is idempotent.

Repeated requests are completed without errors.

POST /v3/gcm-push-tokens

Body:

• vendorProvidedIdentifier — string, The Firebase installation ID, which is the part of token before the first :.
• token — string, FCM registration token, shaped <installationId>:APA91b….

Response:

Empty

Unregister push token

Requires Authorization.

Stops delivery to one registration token. Note the path is push-tokens, not the gcm-push-tokens used to register.

Repeated requests are completed without errors.

DELETE /v3/push-tokens/{token}

Response:

Empty

Get push settings

Requires Authorization.

GET /v5/push-settings

Response:

• favoritePushNotification — boolean, Notify when a favorite comes online. or null
• tapPushNotification — boolean, Notify on received taps. or null
• tappedPushNotification — boolean, Notify when a profile you tapped comes online. or null
• mediaRecipientPushNotification — boolean, Notify when a profile you sent photos to comes online. or null
• recommendedPushNotification — boolean, Notify when a recommended profile nearby is online. or null
• unreadChatsPushNotification — boolean, Remind about unread chats. or null
• viewedProfilePushNotification — boolean, Notify when the profile gets views. or null

Update push settings

Requires Authorization.

Per-category push toggles. Only the fields present in the request body are updated.

PUT /v5/push-settings

Body:

• favoritePushNotification — boolean, Notify when a favorite comes online. or null
• tapPushNotification — boolean, Notify on received taps. or null
• tappedPushNotification — boolean, Notify when a profile you tapped comes online. or null
• mediaRecipientPushNotification — boolean, Notify when a profile you sent photos to comes online. or null
• recommendedPushNotification — boolean, Notify when a recommended profile nearby is online. or null
• unreadChatsPushNotification — boolean, Remind about unread chats. or null
• viewedProfilePushNotification — boolean, Notify when the profile gets views. or null

Update password, WIP

NOTE

This endpoint hasn't been researched yet

Body type: ChangePasswordRequest (undocumented).

Response type: ChangePasswordResponse (undocumented).

POST /v3/users/update-password

Update account email, WIP

NOTE

This endpoint hasn't been researched yet

Body type: UpdateEmailRequest (undocumented).

POST /v3/users/email

Response:

• profileId — string with numbers, account's ID
• sessionId — Session ID
• authToken — string, Auth token for session refresh

Update password via phone, WIP

NOTE

This endpoint hasn't been researched yet

Body type: ChangePasswordPhoneRequest (undocumented).

Response type: ChangePasswordResponse (undocumented).

POST /v4/sms/users/update-password

Create third party account, WIP

NOTE

This endpoint hasn't been researched yet

Creates a Grindr account for a Facebook or Google identity, used when Login via third party returns registered: false. The URL is chosen from the recaptcha_third_party assignment — not the first-party one that governs Sign in: assignment off → POST /v7/users/thirdparty (this endpoint) with no captchaToken; assignment on → POST /v8/users/thirdparty; assignment on and the captcha token is the literal dummyToken → POST /v8/dev/users/thirdparty. The body is ThirdPartyAccountRequest in all three cases — on this URL the shared schema's captchaToken is simply never populated.

The response carries no session: Login via third party is repeated with the same vendor and provider token to obtain one.

POST /v7/users/thirdparty

Body:

• thirdPartyVendor — integer, 1 — Facebook, 2 — Google
• thirdPartyToken — string, provider access token (Facebook user access token / Google access_token), the same value that was sent to Login via third party
• thirdPartyUserId — string with the provider user id, taken verbatim from thirdPartyUserInfo.id, vendor prefix included. Omitted rather than sent as null when absent
• age — integer, age in whole years, computed on-device from the birthday the user enters during sign-up. The birthday itself is never sent
• email — string with email, pre-filled from thirdPartyUserInfo.email. Omitted rather than sent as null when the client has none
• captchaToken — string, reCAPTCHA Enterprise token for the sign_up action, sent only when the recaptcha_third_party assignment is enabled. With the assignment off the field is omitted rather than sent as null, and the request goes to /v7/users/thirdparty instead

Response:

• profileId — string with numbers, the new account's ID
• thirdPartyUserId — string with the provider user id, may be absent

Forgot password, WIP

NOTE

This endpoint hasn't been researched yet

Body type: ForgotPwdEmailRequest (undocumented).

Response type: ForgotPwdEmailResponse (undocumented).

POST /v3/users/forgot-password

Create phone session, WIP

NOTE

This endpoint hasn't been researched yet

Body type: LoginPhoneRequest (undocumented).

POST /v4/sms/sessions

Response:

• profileId — string with numbers, account's ID
• sessionId — Session ID
• authToken — string, Auth token for session refresh

Get preferences

Requires Authorization.

GET /v3/me/prefs/settings

Response:

• profileId — integer
• locationSearchOptOut — boolean
• incognito — boolean
• hideViewedMe — boolean, Hides the Viewed Me list. While set, GET /v7/views/list returns nothing and no new views are recorded.
• approximateDistance — boolean
• viewRightNowNsfw — boolean
• mapLocationFuzzRadius — integer, Map-location privacy fuzz radius. Renamed from mapLocationRadius in app 26.10.0. or null
• showOnMap — boolean, Whether the profile is shown on the map.

Set preferences

Requires Authorization.

PUT /v3/me/prefs/settings

Body:

• settings — object
  • locationSearchOptOut — boolean
  • incognito — boolean
  • hideViewedMe — boolean
  • approximateDistance — boolean
  • viewRightNowNsfw — boolean
  • showOnMap — boolean, Whether the profile is shown on the map.
  • mapLocationFuzzRadius — integer, Map-location privacy fuzz radius. Renamed from mapLocationRadius in app 26.10.0. or null

Response:

Empty.

Get visiting settings

Requires Authorization.

GET /v1/visiting/settings

Response:

• setting — string, visiting-status mode: OFF, ON, or AUTO

Set visiting settings

Requires Authorization.

PUT /v1/visiting/settings

Body:

• setting — string, visiting-status mode: OFF, ON, or AUTO

Response:

Empty.

Get home location

Requires Authorization.

GET /v1/visiting/home

Response:

• name — string, human-readable name of location
• lat — number
• lon — number

Set home location

Requires Authorization.

PUT /v1/visiting/home

Body:

• lat — number
• lon — number

Response:

• name — string, human-readable name of location
• lat — number
• lon — number

Create third party account (reCAPTCHA), WIP

NOTE

This endpoint hasn't been researched yet

reCAPTCHA variant of Create third party account (POST /v7/users/thirdparty), selected when the recaptcha_third_party assignment is enabled. The body then carries a captchaToken minted for the sign_up action; if that token is the literal dummyToken the request goes to POST /v8/dev/users/thirdparty instead. The body is ThirdPartyAccountRequest in all variants.

POST /v8/users/thirdparty

Body:

• thirdPartyVendor — integer, 1 — Facebook, 2 — Google
• thirdPartyToken — string, provider access token (Facebook user access token / Google access_token), the same value that was sent to Login via third party
• thirdPartyUserId — string with the provider user id, taken verbatim from thirdPartyUserInfo.id, vendor prefix included. Omitted rather than sent as null when absent
• age — integer, age in whole years, computed on-device from the birthday the user enters during sign-up. The birthday itself is never sent
• email — string with email, pre-filled from thirdPartyUserInfo.email. Omitted rather than sent as null when the client has none
• captchaToken — string, reCAPTCHA Enterprise token for the sign_up action, sent only when the recaptcha_third_party assignment is enabled. With the assignment off the field is omitted rather than sent as null, and the request goes to /v7/users/thirdparty instead

Response:

• profileId — string with numbers, the new account's ID
• thirdPartyUserId — string with the provider user id, may be absent

Create third party account (dev), WIP

NOTE

This endpoint hasn't been researched yet

Development twin of Create third party account (reCAPTCHA). Used instead of /v8/users/thirdparty when the recaptcha_third_party assignment is enabled and the captcha token obtained is the literal string dummyToken, i.e. on builds wired to a stub reCAPTCHA provider. The body and response are the same as the other two variants.

POST /v8/dev/users/thirdparty

Body:

• thirdPartyVendor — integer, 1 — Facebook, 2 — Google
• thirdPartyToken — string, provider access token (Facebook user access token / Google access_token), the same value that was sent to Login via third party
• thirdPartyUserId — string with the provider user id, taken verbatim from thirdPartyUserInfo.id, vendor prefix included. Omitted rather than sent as null when absent
• age — integer, age in whole years, computed on-device from the birthday the user enters during sign-up. The birthday itself is never sent
• email — string with email, pre-filled from thirdPartyUserInfo.email. Omitted rather than sent as null when the client has none
• captchaToken — string, reCAPTCHA Enterprise token for the sign_up action, sent only when the recaptcha_third_party assignment is enabled. With the assignment off the field is omitted rather than sent as null, and the request goes to /v7/users/thirdparty instead

Response:

• profileId — string with numbers, the new account's ID
• thirdPartyUserId — string with the provider user id, may be absent

PushSettings

Per-category push-notification toggles.

• favoritePushNotification — boolean, Notify when a favorite comes online. or null, optional
• tapPushNotification — boolean, Notify on received taps. or null, optional
• tappedPushNotification — boolean, Notify when a profile you tapped comes online. or null, optional
• mediaRecipientPushNotification — boolean, Notify when a profile you sent photos to comes online. or null, optional
• recommendedPushNotification — boolean, Notify when a recommended profile nearby is online. or null, optional
• unreadChatsPushNotification — boolean, Remind about unread chats. or null, optional
• viewedProfilePushNotification — boolean, Notify when the profile gets views. or null, optional

ThirdPartyAccountRequest

Request body for Create third party account and both of its reCAPTCHA variants — the shape is identical on all three URLs.

thirdPartyVendor and thirdPartyToken repeat the pair that Login via third party just used; thirdPartyUserId and email are echoed from the thirdPartyUserInfo that call returned. Fields with no value are omitted, not sent as null.

• thirdPartyVendor — integer, 1 — Facebook, 2 — Google
• thirdPartyToken — string, provider access token (Facebook user access token / Google access_token), the same value that was sent to Login via third party
• thirdPartyUserId — string with the provider user id, taken verbatim from thirdPartyUserInfo.id, vendor prefix included. Omitted rather than sent as null when absent, optional
• age — integer, age in whole years, computed on-device from the birthday the user enters during sign-up. The birthday itself is never sent
• email — string with email, pre-filled from thirdPartyUserInfo.email. Omitted rather than sent as null when the client has none, optional
• captchaToken — string, reCAPTCHA Enterprise token for the sign_up action, sent only when the recaptcha_third_party assignment is enabled. With the assignment off the field is omitted rather than sent as null, and the request goes to /v7/users/thirdparty instead, optional

ThirdPartyAccountResponse

Response from Create third party account. It carries no session: Login via third party is run again with the same vendor and provider token to obtain one.

• profileId — string with numbers, the new account's ID, optional
• thirdPartyUserId — string with the provider user id, optional

AccountPreferences

• profileId — integer
• locationSearchOptOut — boolean
• incognito — boolean
• hideViewedMe — boolean, Hides the Viewed Me list. While set, GET /v7/views/list returns nothing and no new views are recorded.
• approximateDistance — boolean
• viewRightNowNsfw — boolean
• mapLocationFuzzRadius — integer, Map-location privacy fuzz radius. Renamed from mapLocationRadius in app 26.10.0. or null, optional
• showOnMap — boolean, Whether the profile is shown on the map., optional

AccountPreferencesUpdate

• settings — object
  • locationSearchOptOut — boolean
  • incognito — boolean
  • hideViewedMe — boolean
  • approximateDistance — boolean
  • viewRightNowNsfw — boolean
  • showOnMap — boolean, Whether the profile is shown on the map.
  • mapLocationFuzzRadius — integer, Map-location privacy fuzz radius. Renamed from mapLocationRadius in app 26.10.0. or null

VisitingSettings

• setting — string, visiting-status mode: OFF, ON, or AUTO

HomeLocation

• name — string, human-readable name of location
• lat — number
• lon — number

HomeLocationMutation

• lat — number
• lon — number

PushTokenRequest

• vendorProvidedIdentifier — string, The Firebase installation ID, which is the part of token before the first :.
• token — string, FCM registration token, shaped <installationId>:APA91b….