Comments
List, create, edit, and delete comments on MisarBlog articles.
First-party session route
Comments are a first-party route served by the MisarBlog app (https://api.misar.io/blog/comments), not part of the public api.misar.io/blog/v1 API-key surface. Writes are authenticated with your logged-in session cookie plus a CSRF token — there is no Authorization: Bearer mbk_... on these endpoints. Reading comments is public.
All write operations (POST, PATCH, DELETE) require a valid session cookie and a CSRF token sent in the X-CSRF-Token header (double-submit against the csrf_token cookie). Requests are rate-limited per IP.
List Comments
/blog/commentsReturns top-level comments for an article, each with its nested replies. Public — no authentication required. Rate-limited to 60 requests per minute per IP.
Query parameters
article_idstringqueryrequiredUUID of the article to fetch comments for.
limitintegerquerydefault: 20Top-level comments per page (1–100).
offsetintegerquerydefault: 0Pagination offset.
Response fields
commentsArray<Comment>Top-level comments (newest first). Each Comment includes id, article_id, user_id, parent_id, content, is_edited, is_hidden, reply_count, created_at, updated_at, a nested user (id, username, display_name, avatar_url), and a replies array of the same shape.
totalCountintegerTotal number of visible comments for the article, including replies.
hasMorebooleantrue when more top-level comments exist beyond this page.
curl "https://api.misar.io/blog/comments?article_id=550e8400-e29b-41d4-a716-446655440000&limit=20&offset=0"{
"comments": [
{
"id": "uuid",
"article_id": "uuid",
"user_id": "uuid",
"parent_id": null,
"content": "Great article! The section on streaming was especially helpful.",
"is_edited": false,
"is_hidden": false,
"reply_count": 1,
"created_at": "2026-04-16T10:30:00Z",
"updated_at": "2026-04-16T10:30:00Z",
"user": {
"id": "uuid",
"username": "janedoe",
"display_name": "Jane Doe",
"avatar_url": "https://supabase-blog.misar.io/storage/v1/object/public/avatars/janedoe.jpg"
},
"replies": []
}
],
"totalCount": 14,
"hasMore": false
}Create a Comment
/blog/commentsPosts a new comment or reply on an article. Requires a session cookie and the X-CSRF-Token header. Rate-limited to 5 requests per minute per IP.
Request body
article_idstringbodyrequiredUUID of the article to comment on.
contentstringbodyrequiredComment text (1–5000 chars). HTML is stripped server-side; comments are plain text.
parent_idstringbodyUUID of the comment being replied to. Omit for a top-level comment.
Response fields
successbooleantrue when the comment was created.
commentCommentThe created comment, including its generated id, created_at, and nested user.
curl -X POST "https://api.misar.io/blog/comments" \
-H "Content-Type: application/json" \
-H "X-CSRF-Token: $CSRF_TOKEN" \
--cookie "session=...; csrf_token=$CSRF_TOKEN" \
-d '{"article_id":"550e8400-e29b-41d4-a716-446655440000","content":"Excellent write-up!"}'{
"success": true,
"comment": {
"id": "uuid",
"article_id": "uuid",
"user_id": "uuid",
"parent_id": null,
"content": "Excellent write-up!",
"is_edited": false,
"is_hidden": false,
"reply_count": 0,
"created_at": "2026-04-16T10:30:00Z",
"updated_at": "2026-04-16T10:30:00Z",
"user": {
"id": "uuid",
"username": "janedoe",
"display_name": "Jane Doe",
"avatar_url": null
}
}
}Edit a Comment
/blog/commentsUpdates the text of a comment you own. Requires a session cookie and the X-CSRF-Token header. The updated comment is marked is_edited: true.
Request body
comment_idstringbodyrequiredUUID of the comment to edit.
contentstringbodyrequiredNew comment text (1–5000 chars).
Response fields
successbooleantrue when the comment was updated.
commentCommentThe updated comment with is_edited set to true.
{
"comment_id": "uuid",
"content": "Edited: the streaming section was especially helpful."
}{
"success": true,
"comment": {
"id": "uuid",
"content": "Edited: the streaming section was especially helpful.",
"is_edited": true,
"updated_at": "2026-04-16T11:05:00Z"
}
}Delete a Comment
/blog/commentsDeletes a comment. You can delete a comment you authored, or any comment on an article you own. Requires a session cookie and the X-CSRF-Token header. The comment ID is passed in the request body.
Request body
comment_idstringbodyrequiredUUID of the comment to delete.
Response fields
successbooleantrue when the comment was deleted.
{ "comment_id": "uuid" }{ "success": true }Status codes
400— Missingarticle_id/comment_id, or invalidcontentlength401— No active session (create/edit/delete)403— Invalid or missing CSRF token404— Comment not found or you do not have access to it429— Rate limit exceeded (see theRetry-Afterheader)