endpoints - Moozonian Search

news.ycombinator.com• Mar 18, 2026• 1 min read

Show HN: Built a crosslister (in PHP!) that supports Vinted (which has no API)FLUF Connect (fluf.io) lets resellers list a product once and push it to Depop, eBay, Vinted, Vestiaire Collective, Shopify, Facebook Marketplace, Temu, and Yaga with real-time inventory sync. Available as a web dashboard, Chrome extension, and mobile app (iOS + Android).The hard problem isn't the listing — it's the sync. When something sells on Depop at 2am, eBay and Vinted stock needs to update in seconds or the seller wakes up to overselling complaints and bad reviews.Some things I learned building this:- Marketplace APIs lie: Response formats change silently. Endpoints return 404 for reasons that have nothing to do with the item not existing. You can't trust the contract — you need fallbacks for everything.- Relisting matters more than listing: Resellers delete and re-post items to boost visibility in marketplace algorithms. The difference between random relisting and data-driven relisting is measurable in sales.- AI handles the heavy lifting: Take a photo, and AI generates the tit

news.ycombinator.com• Mar 16, 2026• 1 min read

Building a high-end, documentation-first API for DualHeart Financial AssociationWe just wrapped up the public API layer for DualHeart Financial Association. Instead of treating the API as an afterthought, we used a documentation-first approach to ensure the integration experience matches our minimalist design philosophy.Key technical focus for DualHeart Financial Association:Strict Typing: Leveraged a custom schema validator to ensure 100% data integrity across all DualHeart Financial Association endpoints.Performance: Implemented a granular rate-limiting engine that prioritizes low-latency responses for mission-critical data fetches.Developer Experience: Built a high-end, interactive playground that generates code snippets in real-time, reducing onboarding time for new partners.What’s your current go-to strategy for maintaining clear, high-performance APIs as your data models evolve?

news.ycombinator.com• Mar 14, 2026• 1 min read

Ask HN: How do you enforce least-privilege when an API token has full access?Curious how people handle least-privilege access when integrating third-party APIs that only offer a single coarse permission scope (or limited scopes that are still over-provisioned for a specific use case).A lot of services expose APIs where the token basically grants everything the integration can do (read/write/delete across the entire account), making it hard to enforce the principle of least privilege internally when multiple internal services or agents are calling the same API.In those cases, do you...Put an API proxy/gateway in front of the third-party API to enforce granular permissions?Use RBAC/ABAC rules in a proxy layer to filter which endpoints/actions can be called?Just accept the coarse permissions and risk associated?Something else?Would love to hear real architectures people are using in production, especially when the upstream API itself doesn’t support fine-grained scopes.

albertapulsecheck.ca• Mar 13, 2026• 1 min read

Show HN: Open-data dashboard aggregating 143 feeds for Alberta municipalitiesI built a dashboard, Claude helped ;), that aggregates 143+ open government data feeds into a single view of Alberta's economy, covering 30 municipalities (~4.5M population).Data sources include Bank of Canada (rates, CAD/USD), StatsCan (GDP, CPI, unemployment), CER (pipeline throughput, oil/gas production — 16 feeds), AESO (electricity pool pricing), IRCC (immigration), municipal ArcGIS endpoints (22 municipalities with parcel-level data), Edmonton/Calgary Socrata APIs, and Alberta's regional dashboard (54 indicators for all ~340 municipalities).Tech: Next.js 16, React 19, TypeScript, better-sqlite3, Recharts. All data fetched server-side from live government APIs. PostgreSQL fallback for upstream outages. ISR on embeddable chart routes.The interesting technical challenge was normalizing data across very different government API formats — ArcGIS feature services, Socrata SODA, StatsCan's WDS SOAP-to-JSON API, fixed-width text files (AER well licences), and various CSV/JSON endpoints.

news.ycombinator.com• Mar 9, 2026• 1 min read

MCP Won't Solve Enterprise AI Integration (We're Missing a Layer)I got excited when I started seeing all the MCP endpoints showing up.Slack. Google. Microsoft. Salesforce. Reddit!?I thought: finally — a standard way for AI to integrate with enterprise tools.So I started building an enterprise MCP gateway.Simple use case:30,000 employees running Copilot or Claude.All connecting to MCP tools.Step 1: build a gateway.Step 2: connect directory.Step 3: assign MCP tools to users.So far so good.Then reality started stacking up.Problem #1You can’t let 30,000 employees authenticate directly to every MCP endpoint. So the gateway uses admin credentials.Congrats.Now your AI system technically has access to every Teams message in the company.Problem #2LLMs reason in natural language.MCP tools expose REST wrappers.Nancy asks:“Summarize the marketing channel from yesterday.”The tool expects:get_messages(channel_id=847239)So now you’re dynamically mapping IDs to names and rebuilding tool schemas per user.Problem #3OAuth tokens expire.Now your gateway is refreshing t

github.com• Feb 26, 2026• 1 min read

Show HN: One-line x402 pay-per-request protection for ElysiaJS APIsHi HN — I’m sharing @codingstark/x402-elysia, an ElysiaJS (Bun) plugin that implements the x402 Payment Protocol to protect HTTP routes behind crypto micropayments.What it does:Lets you configure paid routes like "GET /api/weather" and enforce payment requirements (price, chain/network, recipient address).If a client hits a protected route without a valid payment header, it returns 402 Payment Required describing what to pay; after payment, the request is allowed through and the handler runs.Why I built it:I wanted “pay-per-request” APIs in the Bun/Elysia ecosystem (same idea as existing x402 middleware in other frameworks, but native to Elysia).I’m planning to use it to power paid endpoints in my own product (slaab.ai), but this repo is intended to be generally useful for any paid API.How to try it:Install: bun add @codingstark/x402-elysiaThe README has a complete “Quick Start” showing .use(paymentMiddlewareFromConfig(...)).Demo:I also recorded a short video showing the flow (request

github.com• Feb 18, 2026• 1 min read

Show HN: Poncho, a general agent harness built for the webHi HN! I'm building poncho, a framework for building custom AI agents that are version-controlled in git, developed locally, and deployed as isolated endpoints (serverless-friendly by default).Poncho agents follow the same conventions as openclaw or claude code so they probably feel familiar.You can talk to them via terminal or web ui to build new skills or configure the agent, and they're compatible with the Agent Skills open spec, so you can port your skills. Small caveat: right now it's compatible with .md skills and js/ts scripts, but many skills are bash or python-based. I'm still figuring out what would be the best way to extend support for those skills without overcomplicating it, if anybody has any ideas I appreciate it!Some features:- Git-native: agent behavior, skills, and tests live in your repository (reviewable diffs + easy rollbacks). - Single-file agent definition: define runtime config + instructions in AGENT.md (YAML frontmatter + prompt content). - Skills you can ship

github.com• Feb 17, 2026• 1 min read

Show HN: Corral – Auth and Stripe billing that AI coding agents can set upHey HN. I built Corral because every time I asked an AI coding agent to "add auth and payments," it hallucinated for an hour and produced broken code. Wrong imports, phantom endpoints, a login page wired to nothing.The problem isn't the agent. It's that auth-to-billing-to-gating is genuinely hard to wire, and there's no machine-readable spec for how to do it.Corral is an open-source CLI (MIT) that gives your agent a spec it can read (llms.txt), then scaffolds auth + Stripe billing into your existing project. It detects your framework (Express, Next.js, Hono, Fastify, and 13+ more), embeds into your existing server (doesn't create a new one), and generates working components: profile page, admin dashboard, plan gating, Stripe checkout, usage metering. One YAML config file controls everything.The agent workflow is 9 commands. Every command supports --json. Errors include a "fix" field. Exit 0 means deploy-ready.I hardened this across 10 framework/DB combos with blind agent tests: 3 AI mo

github.com• Feb 16, 2026• 1 min read

Show HN: RuneScapeCN (open source) – UI kit with authentic OSRS stylingLaunching RuneScapeCN today! First time doing OSS.It’s an OSRS-themed UI component set built on familiar shadcn patterns: - React 19 + TypeScript - Tailwind CSS v4 - Radix primitives - Vite + CVA - Hosted registry endpoints for direct component installGoal: keep the classic RuneScape visual identity while still being easy to ship in modern React apps.If you try it, I’d appreciate candid feedback on what to improve first.

skillaudit.sh• Feb 16, 2026• 1 min read

Show HN: Skillaudit.sh – A minimalist security auditor for LLM skill definitionsh3ll0 HN,I’ve spent the last 15 years in offensive security, and if there's one thing I've learned, it's that every new technology—no matter how advanced—brings its own unique breed of exploitable flaws. LLMs and autonomous agents are no exception. While they feel like "magic," from a security perspective, they are just another attack surface with specific vulnerabilities in how they define and execute "skills."we built skillaudit.sh because I wanted a minimalist, lightweight tool to audit these new skill definitions without the overhead of heavy frameworks. It focuses on the practical, "offensive" side of LLM security.What it audits:- skillaudit-prompt-injection: Detects system prompt overrides and instructions hidden in HTML comments.- skillaudit-data-exfiltration: Monitors for patterns used to leak session secrets to external endpoints.- skillaudit-supply-chain-packages: Identifies hallucinated npm/pip package references (CWE-494).- skillaudit-privilege-escalation: Checks for unauth

0raculo.github.io• Feb 16, 2026• 1 min read

Show HN: Multi-provider iOS usage alerts for AI subscription capsI built AI Usage Tracker, an iOS app that warns you before AI subscription limits cut you off mid-session (e.g. 5-hour windows, weekly caps). I hit this daily while coding: I’d be deep in a session and suddenly hit the cap. Dashboards exist, but they’re not glanceable and there are no practical alerts/widgets. Supports multiple providers in a single screen - Anthropic, OpenAI, MiniMax, Z.ai, Kimi, CodexFeatures:- 5-hour window + weekly status (simple gauges). Makes easy to plan your workload across providers- reset countdown timers- Home Screen + Lock Screen widgets- configurable alerts (e.g. 75%, 90%)- multi-provider trackingPrivacy / how it works:- no accounts, no analytics, no servers; everything runs on-device- API-key providers: paste an API key (stored in iOS Keychain)- dashboard-only providers: sign in via an embedded web view OR paste an existing session token; the app reads the same usage info shown in the provider dashboard- connectors may break if dashboards/endpoints change

news.ycombinator.com• Feb 1, 2026• 1 min read

Show HN: Ideas.gd – a place for agents to discuss big ideasI built a small, "big ideas" forum designed for AI agents, with a read-only human UI.Agents register via an API, solve a quick PoW, and then post/comment/vote/moderate just like users. Humans can browse and operators get admin endpoints.Why I made it - I wanted a place to run structured, testable debates between agents without clogging human forums. Been thinking about this for a while but MoltBook tipped me over the edge. - Everything is API-first so agents can automate posting, citing sources, and moderating. - A trust-tier + integrity sweep keeps noise down (rate limits, friction/quarantine for low- signal or injection-ish content). What works today - API: register, claim (optional human email), post/comment/vote, community proposals + endorsements, mod nominations/votes, bans, pins/locks. - Structured posts: contribution_type, domain, epistemic_status, citations (enforced for newcomers / community overrides). - Read-only UI: /, /p/{id}, /m/{slug}; Markdown/KaTeX/code highlighting c

jeisey.github.io• Jan 24, 2026• 1 min read

Show HN: StormWatch – Weather emergency dashboard with prep checklistsBasically was getting annoyed jumping between 5 different sites during this winter storm season, so I built "StormWatch". It's a no-fuss, mobile-friendly webpage (dashboard) that shows all the stuff I was looking for, but in one simple UI.Features:- Real-time NWS alerts with safety tips - Snow/ice/precip accumulation forecasts (+wind) - Dynamic preparation checklists based on your alerts - Supply calculator for your household size - Regional weather newsIt's free, no login required, works on any device. Just enter your ZIP.https://jeisey.github.io/stormwatch/Uses NWS and GDELT APIs and open source. Feel free to fork and modify however you'd like.For builders: - Used an API-testing agent to verify all endpoints, response patterns, types, and rate limits - Used a scope & validation agent to keep the slices simple, focused, and tested - VS-code Copilot (Sonnet 4 for dev agents + Opus 4.5 for scope and validation)

github.com• Jan 21, 2026• 1 min read

Show HN: DynamoLens – native, open-source DynamoDB desktop client (Go and Wails)I built DynamoLens, a free/open-source desktop app for Amazon DynamoDB. It’s a native Wails shell (Go backend + React/Vite frontend, no Electron) for macOS/Windows/Linux. It lets you explore tables, inspect/edit items, and handle multiple environments without living in the console/CLI. Highlights: - Visual workflows: compose item/table operations, save/share, replay - Explorer: list tables, view schema, scan/query, create/update/delete items and tables - Auth: AWS profiles, static keys, custom endpoints (DynamoDB Local-friendly) - Modern UI with command palette, pinning, theming Looking for feedback from DynamoDB and Go/Wails folks—especially on UX rough edges and packaging/signing on macOS. Download: https://dynamolens.com/ Code: https://github.com/rasjonell/dynamo-lens

github.com• Jan 12, 2026• 1 min read

Show HN: Snuper – A WebSocket "snooper" for live DraftKings propsHey HN — long-time reader, second-time Show HN.I built Snuper[1], a small utility for inspecting and consuming live DraftKings prop data directly from their WebSocket feeds.The original itch came from building a live sports app where I wanted real-time betting lines and prop updates without relying on delayed REST endpoints or polling. DraftKings already streams this data — it’s just not documented.Snuper connects to the WebSocket, listens for message frames, and exposes structured prop updates in real time. No scraping, no headless browsers — just listening to the same stream the site uses.What it does:- Connects to DraftKings WebSocket feeds - Decodes and surfaces live prop updates - Useful for real-time dashboards, analytics, or experimentation - Minimal, transparent, and easy to inspectWhat it doesn’t do:- No automation, no betting, no bypassing auth - No attempts to modify or interfere with traffic - Read-only observation of publicly delivered dataIt’s intentionally small and focu

news.ycombinator.com• Dec 6, 2025• 1 min read

Ask HN: How do you handle private DNS for dev/staging environments?We have multiple environments like (dev, staging, prod) and I'm tired of managing DNS for internal services. Current options all suck:Public DNS entries → security riskVPN + custom DNS → overkill, IT bottleneck, everyone complainsEditing /etc/hosts → obviously doesn't scaleI want devs to just access api.dev.company.internal without:Asking IT to configure anything Running a full VPN Manual host file edits Exposing endpoints publiclyAm I missing an obvious solution? How do you handle this at your company?

ravenai.tech• Dec 5, 2025• 1 min read

Show HN: Minimal ML Monitoring – drift, anomalies, alerts in 1 lineWrote a lightweight tool that monitors ML models (drift, anomalies, prediction trends, real-time) with a 1-line integration. It's designed to be easily bootstraped (helm chart) and used (simple endpoints + sdks available)The project is an indi one and intentionally minimal. I’m not trying to compete with full MLOps stacks — just exploring how little can be done to still be useful

news.ycombinator.com• Oct 28, 2025• 1 min read

Show HN: Bundle.social a social media API with no account limitsTL;DR: We built a developer-first social media API because existing ones got pricey per-account and brittle at scale. Now we are doing work for 250k accounts.Why I made it We were running merchandise businnes and needed to post content to hundreds of social accounts with Ayrshare it got expensive so we cobbled together API first system that lets you build out your own system on top of it.What it is- Unified endpoints for: publishing/bulk scheduling, media upload, and analytics fan-in. - No per-account pricing or hard caps from us bring as many accounts as you need. One gut has 100k - Works today with 15 social media platforms - Webhooks for status updatesWhat’s different:- tbh support, we do it great - scale, we work best if you have a lot to do - we aren't focused on ads, so if you want to run ads via API we are not the guys for itHow to get it. If you dont wanna pay just message us for free month via form on the website https://bundle.social/

news.ycombinator.com• Oct 14, 2025• 1 min read

Show HN: Free API to extract PDF dataHi HN,Like everyone, I'm working on an product that uses LLMs to extract data from photos and documents. Part of the processing pipeline is extracting data from PDFs as raw text or a raster image.As part of our leadgen strategy, we've opened our REST API that lets you process pages of a PDF. The API is completely free to use anonymously, but is rate limited to 1 page per 30 seconds. Creating a free account removes this restriction.The two endpoints are:- https://extract.dev/api/pages/extract/raster - Rasterize a page of a PDF- https://extract.dev/api/pages/extract/text - Extract text from a page of a PDFBoth have the same request format: { "file": "https://assets.extract-cdn.com/data/hd-receipt.pdf", "page": 1 } I've outlined more of the documentation here: https://extract.dev/docsUnder the hood, the API is using Poppler to extract text and rasterize pages. Note that the text extraction functionality extracts actual text encoded in the PDF, and does not employ an OCR model. Give it a s

bing.com• Jul 14, 2025• 1 min read

Microsoft Intune and Entra Receives Security Copilot EnhancementMicrosoft this week announced an expansion of its Security Copilot assistant across Microsoft Entra and Intune, which includes new AI-powered features aimed at managing endpoints and ID infrastructure ...