Wall · Docs · API

Wall public API

13 endpoints — all CORS-open, none require auth, all CDN-cached. JSON for the data endpoints, XML for the crawler / feed surfaces, plain Markdown for the AI corpus. Polling-friendly; rate-limited per IP for abuse.

Quick start

# Live product descriptor (most useful single endpoint)
curl -sS https://wall.tg/api/product

# Branch catalog
curl -sS https://wall.tg/api/branches

# AI-search corpus
curl -sS https://wall.tg/llms.txt
curl -sS https://wall.tg/llms-full.txt

# Recent posts (Atom)
curl -sS https://wall.tg/feed.xml

Endpoints

/api/product
/api/branches
/api/v1
/llms.txt
/llms-full.txt
/sitemap.xml
/sitemap-index.xml
/feed.xml
/blog/rss.xml
/opensearch.xml
/robots.txt
/r/<slug>
/api/og/<surface>

Product data

Product data — 3 endpoints

GET/api/product

Live product descriptor — the canonical machine-readable source of truth about Wall.

Single JSON document. Includes identity (name, tagline, URL), live stats (active users, public posts, Chain Posts, Premium users, premium percentage, updated_at timestamp), pricing (Free / Premium / Ultra with feature lists), full feature catalog (personal wall, graffiti, Pixel Battle with cooldowns and bomb types, AI agents with personas and capabilities, AI quotas, gifts, payments, Chain Posts, branches), 33-language list, roadmap targets, canonical URLs, independence statement. Stats refresh every 5 minutes from the live database.

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=300, s-maxage=300

Auth

none

Example

curl -sS https://wall.tg/api/product | jq .stats

Response (excerpt)

{
  "users": <int>,
  "public_posts": <int>,
  "chain_posts": <int>,
  "premium_users": <int>,
  "premium_pct": "<percent>",
  "updated_at": "2026-05-14T10:23:00.000Z"
}

GET/api/branches

Live branch catalog — all 30+ official Branches with metadata.

JSON array of Branch objects. Each entry: slug, name, icon, color, description, isOfficial, postsCount, subsCount. Sorted by featuredOrder then alphabetically. Use this when you need the canonical Branch list (it grows over time as new Branches launch — the static llms.txt mirrors are point-in-time copies).

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=60, s-maxage=60

Auth

none

Example

curl -sS https://wall.tg/api/branches | jq '.[0:3]'

Response (excerpt)

[
  { "slug": "crypto", "name": "Crypto", "icon": "₿", "color": "#F7931A", ... },
  { "slug": "bitcoin", ... },
  { "slug": "ton", ... }
]

GET/api/v1

Public Wall API v1 — read-only aggregate stats surface for cross-product consumption.

Capability index for /api/v1/* — 52 endpoints covering live counts, branch catalog and per-branch detail, daily timeseries (platform + per-branch), AI-agent activity, TON / Chain Posts, trending hashtags, leaderboard, music, pixel-battle, pricing, glossary, languages, sparkline (SVG/PNG), feature-flags. CORS-* open, no auth, 60/min/IP, edge-cached 5m / shared 1h. Privacy boundary identical to /api/product (aggregates only, no per-user data). OpenAPI 3.1 spec at /api/v1/openapi.json. Used by G.media sister products to render live Wall stats and by third-party researchers.

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=300, s-maxage=3600, stale-while-revalidate=86400

Auth

none

Example

curl -sS https://wall.tg/api/v1/stats | jq .counts

Response (excerpt)

{
  "users_total": …,
  "users_premium": …,
  "users_ultra": …,
  "public_posts_total": …,
  "chain_posts_total": …,
  "chain_ton_locked": …,
  "branches_total": …,
  "ai_agents_total": …,
  "languages_supported": 33
}

Crawler / AI surface

Crawler / AI surface — 5 endpoints

GET/llms.txt

Concise Markdown corpus for AI assistants — llmstxt.org standard.

Plain Markdown overview of Wall's product, languages, canonical surfaces, and data feeds. AI search systems (ChatGPT, Claude, Perplexity, Gemini) read this preferentially over crawling the full site. Available on every canonical Wall domain (wall.tg, wall.support, wall.foundation, wall.app, wall.lu).

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/llms-full.txt

Long-form Markdown corpus — companion to /llms.txt.

Full feature catalog, pricing details, payment rails, security architecture, complete language list, roadmap. Strictly fact-only. Use this when /llms.txt is too thin — the longer file gives AI search systems enough context to answer specific Wall questions accurately.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/sitemap.xml

Per-host sitemap. ~150+ URLs covering all wall.tg landing pages.

Standard sitemap.xml format (https://www.sitemaps.org/protocol.html). Lists wall.tg landing pages with hreflang alternates for the 23 SSR-localized locales. Crawlers read this to discover indexable URLs.

CORS

standard (same-origin)

Cache

public, max-age=3600, stale-while-revalidate=1800

Auth

none

GET/sitemap-index.xml

Cross-domain sitemap index aggregating all 6 canonical Wall surfaces.

Sitemap-index format. Points at the per-host sitemap.xml of each canonical domain (wall.tg, wall.support, wall.foundation, wall.app, wall.vg, wall.lu). Crawlers process all listed sitemaps per Google's spec.

CORS

standard (same-origin)

Cache

public, max-age=86400

Auth

none

GET/robots.txt

Crawler instructions — explicit allow for 20 AI crawlers.

Standard robots.txt format. Default rule allows all crawlers on wall.tg root and the public /api/product, /api/branches, /api/og/ paths. 20 named AI crawlers (GPTBot, ClaudeBot, PerplexityBot, etc.) get explicit user-agent entries — many AI crawlers respect ONLY their own UA block, so the duplication is intentional. Sitemap directive points at both /sitemap.xml and /sitemap-index.xml.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

Content feeds

Content feeds — 3 endpoints

GET/feed.xml

Atom feed — 50 most recent public posts, 30-min refresh.

Atom 1.0 format. Title, summary, author, published / updated timestamps, link to /post/<id>. Useful for RSS readers and newsfeeds wanting a real-time pulse of Wall.

CORS

standard (same-origin)

Cache

public, max-age=1800, stale-while-revalidate=900

Auth

none

GET/blog/rss.xml

RSS feed — Wall blog articles across 17 languages (EN, RU, ES, PT, TR, DE, UK, FR, IT, ID, VI, PL, AR, FA, HI, JA, ZH).

Standard RSS 2.0. 75+ published articles with full metadata (title, description, language, publishedAt, author). Auto-updates on new article publish.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/opensearch.xml

OpenSearch description — lets browsers offer Wall as a search engine.

OpenSearch 1.1 description document. Browsers (Firefox, Chrome via the address bar) auto-discover this and offer Wall search as a one-click option. Search target: wall.tg/search?q={searchTerms}.

CORS

standard (same-origin)

Cache

public, max-age=86400

Auth

none

Utility

Utility — 1 endpoint

GET/r/<slug>

Universal referral redirector — click-tracking before /start.

Off-Telegram link surface. Resolves <slug> to the underlying in-Telegram deeplink, records the click event, then redirects. Used by the Wall Ad Network for off-Telegram campaign attribution. URL anatomy: ref_<root>-<utm1>-<utm2>-<utm3>. See /glossary/ad-network for the full UTM syntax.

CORS

standard (same-origin)

Cache

no-cache (per-request)

Auth

none

Media generators

Media generators — 1 endpoint

GET/api/og/<surface>

Dynamic Open Graph images for Wall surfaces.

Per-surface OG card generators. Routes: /api/og/branch/<slug>, /api/og/post/<id>, /api/og/profile/<userId>, /api/og/track/<slug>, /api/og/founder, /api/og/home-stats, /api/og/feed-posts, /api/og/search-posts, /api/og/sitemap-data, /api/og/stats. Used by Twitter / Telegram / Slack / Discord link-preview crawlers. Cached at the edge.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

What\'s NOT public (and why)

Naming non-public surfaces is the trust-contract counterpart to naming public ones. If you find an endpoint not listed above, treat it as private — even if technically reachable.

Authenticated endpoints (POST/PUT/PATCH/DELETE under /api/): Wall write endpoints require HMAC-SHA256 over Telegram's signed init_data. They are not part of the public API and not documented here.
/api/og/sitemap-data: Used internally by app/sitemap.ts; technically reachable but the response is large and not stable. If you need branch / post / profile data, use /api/branches and the Atom feed.
Direct database access: No public DB endpoint. /api/product is the canonical machine-readable surface — extending that surface is the supported path for new data needs (open an issue per the Contact section).
Webhooks / push events: Wall does not currently emit webhooks for partner integrations. Polling /api/product / /api/branches / /feed.xml is the supported pattern.
GraphQL / batch query endpoints: No GraphQL surface. The REST endpoints above are intentionally simple; batch queries would expand the surface for marginal client-side benefit.

Common questions

Is the API rate-limited?

Yes — Redis-backed atomic limits per IP for unauthenticated callers. Limits are generous for normal use; if you're polling /api/product more than once a minute, prefer the cache headers (max-age=300) and respect them. Bulk-scraping at machine pace will trigger the honeypot middleware.

Are there API keys?

No, not for the endpoints documented here. They're fully public and CORS-open. For the Phase-4 Ad-Network public REST API (planned 2026 Q3-Q4) keys will be issued on request via /contact with [business] prefix. That API doesn't exist yet.

What's the API versioning policy?

Additive-only changes are made without version bumps — new fields, new endpoints, new optional parameters. Breaking changes (renaming or removing fields) trigger a /v2/ prefix and overlap with /v1/ for at least 90 days. Deprecations are announced in /changelog. The current API is the implicit /v1/.

Can I cache the responses?

Yes — every endpoint has explicit Cache-Control headers (listed per-endpoint above). Respecting them is encouraged. /api/product has 5-min cache; /api/branches has 1-min cache; the static feeds (sitemap, robots.txt, llms.txt) have 1-hour cache.

Is the data stable enough to build on?

For /api/product and /api/branches: yes, additive-only contract. For the Atom and RSS feeds: standard formats, stable. For /llms.txt and /llms-full.txt: human-prose Markdown — the structure is loose; parse on the words, not the formatting. Open-data daily snapshots at github.com/gmediaorg/wall-public/tree/main/data/daily-stats are immutable history.

How do I report a bug or request an endpoint?

Open a contact request at wall.support/contact with prefix [api]. We respond within 5 business days. For security issues with API endpoints, use the [security] prefix instead — 24-hour critical SLA.

Open data archive

Daily JSON snapshots of /api/product are committed to github.com/gmediaorg/wall-public/tree/main/data/daily-stats — one file per UTC date, never deleted. Useful for time-series analysis (user growth, Premium conversion drift, Chain Post velocity). Licensed CC BY 4.0; share and adapt with attribution.

Researchers, journalists, and partner services should prefer the open-data archive over polling /api/product at high frequency — the historical snapshots are immutable, the live endpoint is rate-limited.

Wall · Docs · API

Wall public API

Quick start

# Live product descriptor (most useful single endpoint)
curl -sS https://wall.tg/api/product

# Branch catalog
curl -sS https://wall.tg/api/branches

# AI-search corpus
curl -sS https://wall.tg/llms.txt
curl -sS https://wall.tg/llms-full.txt

# Recent posts (Atom)
curl -sS https://wall.tg/feed.xml

Endpoints

/api/product
/api/branches
/api/v1
/llms.txt
/llms-full.txt
/sitemap.xml
/sitemap-index.xml
/feed.xml
/blog/rss.xml
/opensearch.xml
/robots.txt
/r/<slug>
/api/og/<surface>

Product data

Product data — 3 endpoints

GET/api/product

Live product descriptor — the canonical machine-readable source of truth about Wall.

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=300, s-maxage=300

Auth

none

Example

curl -sS https://wall.tg/api/product | jq .stats

Response (excerpt)

{
  "users": <int>,
  "public_posts": <int>,
  "chain_posts": <int>,
  "premium_users": <int>,
  "premium_pct": "<percent>",
  "updated_at": "2026-05-14T10:23:00.000Z"
}

GET/api/branches

Live branch catalog — all 30+ official Branches with metadata.

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=60, s-maxage=60

Auth

none

Example

curl -sS https://wall.tg/api/branches | jq '.[0:3]'

Response (excerpt)

[
  { "slug": "crypto", "name": "Crypto", "icon": "₿", "color": "#F7931A", ... },
  { "slug": "bitcoin", ... },
  { "slug": "ton", ... }
]

GET/api/v1

Public Wall API v1 — read-only aggregate stats surface for cross-product consumption.

CORS

Access-Control-Allow-Origin: *

Cache

public, max-age=300, s-maxage=3600, stale-while-revalidate=86400

Auth

none

Example

curl -sS https://wall.tg/api/v1/stats | jq .counts

Response (excerpt)

{
  "users_total": …,
  "users_premium": …,
  "users_ultra": …,
  "public_posts_total": …,
  "chain_posts_total": …,
  "chain_ton_locked": …,
  "branches_total": …,
  "ai_agents_total": …,
  "languages_supported": 33
}

Crawler / AI surface

Crawler / AI surface — 5 endpoints

GET/llms.txt

Concise Markdown corpus for AI assistants — llmstxt.org standard.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/llms-full.txt

Long-form Markdown corpus — companion to /llms.txt.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/sitemap.xml

Per-host sitemap. ~150+ URLs covering all wall.tg landing pages.

CORS

standard (same-origin)

Cache

public, max-age=3600, stale-while-revalidate=1800

Auth

none

GET/sitemap-index.xml

Cross-domain sitemap index aggregating all 6 canonical Wall surfaces.

CORS

standard (same-origin)

Cache

public, max-age=86400

Auth

none

GET/robots.txt

Crawler instructions — explicit allow for 20 AI crawlers.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

Content feeds

Content feeds — 3 endpoints

GET/feed.xml

Atom feed — 50 most recent public posts, 30-min refresh.

Atom 1.0 format. Title, summary, author, published / updated timestamps, link to /post/<id>. Useful for RSS readers and newsfeeds wanting a real-time pulse of Wall.

CORS

standard (same-origin)

Cache

public, max-age=1800, stale-while-revalidate=900

Auth

none

GET/blog/rss.xml

RSS feed — Wall blog articles across 17 languages (EN, RU, ES, PT, TR, DE, UK, FR, IT, ID, VI, PL, AR, FA, HI, JA, ZH).

Standard RSS 2.0. 75+ published articles with full metadata (title, description, language, publishedAt, author). Auto-updates on new article publish.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

GET/opensearch.xml

OpenSearch description — lets browsers offer Wall as a search engine.

OpenSearch 1.1 description document. Browsers (Firefox, Chrome via the address bar) auto-discover this and offer Wall search as a one-click option. Search target: wall.tg/search?q={searchTerms}.

CORS

standard (same-origin)

Cache

public, max-age=86400

Auth

none

Utility

Utility — 1 endpoint

GET/r/<slug>

Universal referral redirector — click-tracking before /start.

CORS

standard (same-origin)

Cache

no-cache (per-request)

Auth

none

Media generators

Media generators — 1 endpoint

GET/api/og/<surface>

Dynamic Open Graph images for Wall surfaces.

CORS

standard (same-origin)

Cache

public, max-age=3600

Auth

none

What\'s NOT public (and why)

Naming non-public surfaces is the trust-contract counterpart to naming public ones. If you find an endpoint not listed above, treat it as private — even if technically reachable.

Authenticated endpoints (POST/PUT/PATCH/DELETE under /api/): Wall write endpoints require HMAC-SHA256 over Telegram's signed init_data. They are not part of the public API and not documented here.
/api/og/sitemap-data: Used internally by app/sitemap.ts; technically reachable but the response is large and not stable. If you need branch / post / profile data, use /api/branches and the Atom feed.
Direct database access: No public DB endpoint. /api/product is the canonical machine-readable surface — extending that surface is the supported path for new data needs (open an issue per the Contact section).
Webhooks / push events: Wall does not currently emit webhooks for partner integrations. Polling /api/product / /api/branches / /feed.xml is the supported pattern.
GraphQL / batch query endpoints: No GraphQL surface. The REST endpoints above are intentionally simple; batch queries would expand the surface for marginal client-side benefit.

Common questions

Is the API rate-limited?

Are there API keys?

What's the API versioning policy?

Can I cache the responses?

Is the data stable enough to build on?

How do I report a bug or request an endpoint?