GET /api/threads/{id}/messages

GET

api

threads

{id}

messages

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const data = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
    headers={'Authorization': f'Bearer {jwt}'}
)

messages = response.json()

{
  "items": [
    {
      "message_id": "msg-uuid-here",
      "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
      "prompt_text": "What is AI?",
      "model1_id": "model-uuid-1",
      "model2_id": "model-uuid-2",
      "model1_response": "AI is artificial intelligence...",
      "model2_response": "Artificial intelligence refers to...",
      "comparison_id": "comparison-uuid",
      "model1_time_ms": 450,
      "model2_time_ms": 520,
      "created_at": "2024-01-15T10:30:00.000Z"
    }
  ]
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "MESSAGES_ERROR"
}

Authentication

Conditional (Line 198): [AllowAnonymous] Follows same access rules as GET /api/threads/

Path Parameters

string

required

Thread UUIDFormat: Valid GUIDValidation: Route constraint :guid (Line 197)

Response

array

Array of message objects

Show Message object

string

UUID identifier

string

Parent thread UUID

string

User’s input message

string

First model UUID (nullable for single-chat mode)

string

Second model UUID (nullable for single-chat mode)

string

First model’s response text

string

Second model’s response text (nullable for single-chat)

string

Comparison UUID (only for dual-chat mode)

integer

First model inference time in milliseconds

integer

Second model inference time (nullable)

string

ISO8601 UTC timestamp

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const data = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
    headers={'Authorization': f'Bearer {jwt}'}
)

messages = response.json()

{
  "items": [
    {
      "message_id": "msg-uuid-here",
      "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
      "prompt_text": "What is AI?",
      "model1_id": "model-uuid-1",
      "model2_id": "model-uuid-2",
      "model1_response": "AI is artificial intelligence...",
      "model2_response": "Artificial intelligence refers to...",
      "comparison_id": "comparison-uuid",
      "model1_time_ms": 450,
      "model2_time_ms": 520,
      "created_at": "2024-01-15T10:30:00.000Z"
    }
  ]
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "MESSAGES_ERROR"
}

Authorization Logic

Identical to GET /api/threads/ (Lines 203-249):

// First check thread access (same logic as GetThread)
var thread = await _threadsService.GetThreadAsync(threadId);

// Apply same visibility + feature flag checks
if (!(publicSharingEnabled && (thread.Visibility == "public" || "unlisted"))) {
    // Require auth + ownership check
}

Access Control Matrix

Flag	Visibility	Auth	Access
ON	public	No	✅ Allowed
ON	unlisted	No	✅ Allowed
ON	private	No	❌ 401
ON	private	Yes (owner)	✅ Allowed
ON	private	Yes (other)	❌ 403
OFF	*	No	❌ 401
OFF	*	Yes (owner)	✅ Allowed
OFF	*	Yes (other)	❌ 403

Side Effects

Database Reads (Lines 204, 216, 251):

SELECT from threads table WHERE thread_id = {id}
SELECT from system_settings table WHERE key = 'public_sharing'
SELECT from thread_messages table WHERE thread_id = {id}

No Database Writes: Read-only endpoint Message Ordering: Not specified by API contract (service-defined, likely chronological)

Permissions

Same as Thread Access:

If user can read thread, user can read messages
No separate message-level permissions

Cascade Rule: Message visibility = Thread visibility

Edge Cases

Thread doesn’t exist: 404 (Lines 206-214)
Thread exists but has zero messages: Returns {"items": []} (Line 253)
Invalid GUID format: 400 (route constraint)
Deleted thread: 404 (service returns null for thread)
Orphaned messages (thread deleted): Cannot occur (thread lookup first)
Partial message data (model2 null in single-chat): Nullable fields return null

Error Conditions

Code	HTTP	Cause	Controller Line
`NOT_FOUND`	404	Thread doesn’t exist	206-214
`UNAUTHORIZED`	401	Auth required but missing	230-238
`FORBIDDEN`	403	Private thread, wrong user	240-248
`MESSAGES_ERROR`	500	Service exception	255-263

Exception Handling (Lines 255-263):

catch (Exception ex) {
    return StatusCode(500, new { error = ex.Message, code = "MESSAGES_ERROR" });
}

Behavioral Guarantees

Two-Step Verification (Lines 204-249):

Thread existence + access check
Messages retrieval

Atomicity: Not transactional

Thread could be deleted between checks (race condition)
Service behavior on race condition not enforced by server contract

Pagination: Not supported

Returns ALL messages for thread
No limit parameter
Could cause performance issues for large threads

Performance Characteristics

Database Queries: 3 queries per request

Thread lookup
Feature flag lookup
Messages retrieval

Response Size: Unbounded (proportional to message count) Index Requirements:

thread_messages.thread_id should be indexed
threads.thread_id primary key

Performance Risk: Large threads (100+ messages) may cause slow responses

Message Schema Details

Single-Chat Mode:

model1_id: Populated
model2_id: NULL
model1_response: Populated
model2_response: NULL
comparison_id: NULL

Dual-Chat Mode:

model1_id: Populated
model2_id: Populated
model1_response: Populated
model2_response: Populated
comparison_id: Populated (links to comparisons table)

Comparison ID Usage:

Can be used with GET /api/arena/model-stats to see vote data
Links message to arena comparison for voting

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const data = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479/messages',
    headers={'Authorization': f'Bearer {jwt}'}
)

messages = response.json()

{
  "items": [
    {
      "message_id": "msg-uuid-here",
      "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
      "prompt_text": "What is AI?",
      "model1_id": "model-uuid-1",
      "model2_id": "model-uuid-2",
      "model1_response": "AI is artificial intelligence...",
      "model2_response": "Artificial intelligence refers to...",
      "comparison_id": "comparison-uuid",
      "model1_time_ms": 450,
      "model2_time_ms": 520,
      "created_at": "2024-01-15T10:30:00.000Z"
    }
  ]
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "MESSAGES_ERROR"
}

Overview

Chat & Arena

Threads

Voting & Stats

Models & Users

Utilities

Admin API

GET /api/threads/{id}/messages

Authentication

Path Parameters

Response

Authorization Logic

Access Control Matrix

Side Effects

Permissions

Edge Cases

Error Conditions

Behavioral Guarantees

Performance Characteristics

Message Schema Details

​Authentication

​Path Parameters

​Response

​Authorization Logic

​Access Control Matrix

​Side Effects

​Permissions

​Edge Cases

​Error Conditions

​Behavioral Guarantees

​Performance Characteristics

​Message Schema Details

Authentication

Path Parameters

Response

Authorization Logic

Access Control Matrix

Side Effects

Permissions

Edge Cases

Error Conditions

Behavioral Guarantees

Performance Characteristics

Message Schema Details