# API guide

All application routes use the `/v1` prefix. JSON is the primary request and response format, timestamps are ISO-8601 UTC instants, and list endpoints use Spring Data page responses.

Start with [authentication and CSRF](<https://subho.xyz/twitter-backend-java/api/authentication/index.md>), browse the [endpoint guide](<https://subho.xyz/twitter-backend-java/api/endpoints/index.md>), then inspect the [generated reference](<https://subho.xyz/twitter-backend-java/api/reference/index.md>).

## Common conventions

- Bearer tokens use `Authorization: Bearer <jwt>`.
- State-changing requests require the CSRF cookie and matching header.
- Page requests accept `page`, `size`, and `sort`.
- The default page size is 20 and the maximum is 100.
- Validation failures and handled exceptions use the documented error model.

## In this section

| Page | Focus |
| --- | --- |
| [Authentication and CSRF](<https://subho.xyz/twitter-backend-java/api/authentication/index.md>) | Token lifecycle and browser-safe write requests |
| [Endpoints](<https://subho.xyz/twitter-backend-java/api/endpoints/index.md>) | All current `/v1` routes and access requirements |
| [Models and errors](<https://subho.xyz/twitter-backend-java/api/models/index.md>) | Request, response, page, and error shapes |
| [Test the API](<https://subho.xyz/twitter-backend-java/api/testing/index.md>) | Swagger UI and curl examples |
| [Generated reference](<https://subho.xyz/twitter-backend-java/api/reference/index.md>) | Code-derived OpenAPI parameters and schemas |