GET /api/threads/{id}

GET

api

threads

{id}

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const thread = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
    headers={'Authorization': f'Bearer {jwt}'}
)

thread = response.json()

{
  "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "user_id": "user-uuid-here",
  "title": "My Conversation",
  "visibility": "private",
  "created_at": "2024-01-15T10:30:00.000Z",
  "updated_at": "2024-01-15T11:45:00.000Z"
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "THREAD_ERROR"
}

Authentication

Conditional (Line 116): [AllowAnonymous] Public sharing enabled: Authentication optional for public/unlisted threads Private threads: Authentication required JWT Claims Extraction (Lines 138-142):

sub | ClaimTypes.NameIdentifier → User UUID (optional for public threads)

Path Parameters

string

required

Thread UUIDFormat: Valid GUIDValidation: Route constraint :guid (Line 115)

Response

string

UUID identifier

string

Owner UUID

string

Thread title

string

"private", "public", or "unlisted"

string

ISO8601 UTC timestamp

string

ISO8601 UTC timestamp

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const thread = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
    headers={'Authorization': f'Bearer {jwt}'}
)

thread = response.json()

{
  "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "user_id": "user-uuid-here",
  "title": "My Conversation",
  "visibility": "private",
  "created_at": "2024-01-15T10:30:00.000Z",
  "updated_at": "2024-01-15T11:45:00.000Z"
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "THREAD_ERROR"
}

Authorization Logic

Feature Flag Check (Line 134):

var publicSharingEnabled = await _systemSettingsService.GetFeatureFlagAsync("public_sharing");

Access Decision Tree (Lines 150-179):

1. Check if public_sharing enabled AND visibility is public/unlisted:
   ├─ TRUE → Allow access (return thread)
   └─ FALSE → Step 2

2. Check if user authenticated:
   ├─ FALSE → 401 UNAUTHORIZED
   └─ TRUE → Step 3

3. Check if visibility is private AND userId != thread.userId:
   ├─ TRUE → 403 FORBIDDEN
   └─ FALSE → Allow access (return thread)

PUBLIC_SHARING Feature Flag States

Flag	Visibility	Auth	Access
ON	public	No	✅ Allowed (Line 150-154)
ON	unlisted	No	✅ Allowed (Line 150-154)
ON	private	No	❌ 401 (Line 158-166)
ON	private	Yes (owner)	✅ Allowed (Line 179)
ON	private	Yes (other)	❌ 403 (Line 169-177)
OFF	public	No	❌ 401 (Line 158-166)
OFF	public	Yes (owner)	✅ Allowed (Line 179)
OFF	public	Yes (other)	❌ 403 (Line 169-177)
OFF	unlisted	No	❌ 401
OFF	private	Yes (owner)	✅ Allowed

Side Effects

Database Reads (Lines 121, 134):

SELECT from threads table WHERE thread_id = {id}
SELECT from system_settings table WHERE key = 'public_sharing'

No Database Writes: Read-only endpoint

Permissions

Who Can Read:

Public threads (when public_sharing = true): Anyone
Unlisted threads (when public_sharing = true): Anyone with the link
Private threads: Owner only
Any visibility (when public_sharing = false): Owner only

Visibility Semantics:

private: Requires auth + ownership
public: Visible to all when feature enabled
unlisted: Visible to all when feature enabled, but not listed in search/discovery

Edge Cases

Thread doesn’t exist: 404 (Lines 123-131)
Invalid GUID format: 400 (route constraint, not in controller code)
Deleted thread: 404 (service returns null)
Feature flag missing: Treated as false (default behavior assumed)
User ID claim missing for public thread: Allowed (auth optional, Lines 137-142)
User ID claim present but thread private: Ownership check applies (Line 169)

Error Conditions

Code	HTTP	Cause	Controller Line
`NOT_FOUND`	404	Thread doesn’t exist	123-131
`UNAUTHORIZED`	401	Auth required but missing	158-166
`FORBIDDEN`	403	Private thread, wrong user	169-177
`THREAD_ERROR`	500	Service exception	181-189

Exception Handling (Lines 181-189):

catch (Exception ex) {
    return StatusCode(500, new { error = ex.Message, code = "THREAD_ERROR" });
}

Behavioral Guarantees

Visibility Check Order:

Thread existence (404 if not found)
Feature flag + visibility (public access allowed here)
Authentication (401 if required but missing)
Ownership (403 if private + wrong owner)

Authentication Optional: Only for public/unlisted threads with feature flag enabled Ownership Enforcement: Always checked for private threads, regardless of feature flag Feature Flag Dependency: public_sharing setting controls anonymous access

Security Implications

Public Exposure Risk: When public_sharing = true:

Public threads visible without authentication
Unlisted threads accessible via direct link (URL guessing possible)
No rate limiting documented

Privacy Guarantee: Private threads NEVER accessible by non-owners Auth Bypass: Public/unlisted threads accessible anonymously ONLY when feature enabled

curl -X GET 'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

const response = await fetch(
  'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
  {
    headers: { 'Authorization': `Bearer ${jwt}` }
  }
);

const thread = await response.json();

import requests

response = requests.get(
    'http://localhost:5079/api/threads/f47ac10b-58cc-4372-a567-0e02b2c3d479',
    headers={'Authorization': f'Bearer {jwt}'}
)

thread = response.json()

{
  "thread_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "user_id": "user-uuid-here",
  "title": "My Conversation",
  "visibility": "private",
  "created_at": "2024-01-15T10:30:00.000Z",
  "updated_at": "2024-01-15T11:45:00.000Z"
}

{
  "success": false,
  "error": "Thread not found",
  "code": "NOT_FOUND"
}

{
  "success": false,
  "error": "Authentication required to access this thread",
  "code": "UNAUTHORIZED"
}

{
  "success": false,
  "error": "You do not have access to this thread",
  "code": "FORBIDDEN"
}

{
  "success": false,
  "error": "Database query failed",
  "code": "THREAD_ERROR"
}

Overview

Chat & Arena

Threads

Voting & Stats

Models & Users

Utilities

Admin API

Authentication

Path Parameters

Response

Authorization Logic

PUBLIC_SHARING Feature Flag States

Side Effects

Permissions

Edge Cases

Error Conditions

Behavioral Guarantees

Security Implications

​Authentication

​Path Parameters

​Response

​Authorization Logic

​PUBLIC_SHARING Feature Flag States

​Side Effects

​Permissions

​Edge Cases

​Error Conditions

​Behavioral Guarantees

​Security Implications

Authentication

Path Parameters

Response

Authorization Logic

PUBLIC_SHARING Feature Flag States

Side Effects

Permissions

Edge Cases

Error Conditions

Behavioral Guarantees

Security Implications