The per-project file API: listing the tree, reading and writing text files, uploading binaries, mkdir, move and delete, with the relative POSIX path rules and the traversal rejections that guard them.
Project, gist and news endpoints: browsing and detail reads, create/edit/delete, private and read-only flags, zip export and fork jobs with their polling endpoints, and the news listing and article reads.
The polymorphic report endpoint, the machine-readable reason list, and the administrator moderation queue: its state machine, actions, seniority rule and acknowledgement contract with the published review window.
The JSON lookup endpoints behind mentions and the message composer: user search and content search, their single q parameter, result caps and response shapes.
Background-job endpoints for the three public developer tools: queueing a run, polling status, reading the report, and the progress websockets - all addressed by unguessable capability URLs.
Toggle-style engagement endpoints for posts, comments, gists, projects and quizzes: vote casting and removal, emoji reactions, bookmarks and poll answers, including the X-Requested-With header rule that returns JSON inst...
Registering browser and APNs push subscriptions: discovering enabled providers via push.json, fetching the public VAPID key, posting a PushSubscription, and the client-side unsubscribe model with no server endpoint.