Public JSON API
Every public profile is readable as JSON: no key, no sign-in, and nothing the page does not already show.
The endpoint
Every public profile is readable as data at one address:
xyst.wtf/u/yourname.json
No key, no sign-in, no rate limit to apply for. An alias answers here exactly as your username does.
What comes back
The same public facts your page renders, in the same order of importance:
Identityusername, url, display name, bio, pronouns, location, joined
Lookavatar, and the accent, background, card and text colours
Badgeskey, label and colour, plus the icon of a custom badge
Linksplatform, label and the full url
Audiotitle and duration per track
Cardsthe png and svg addresses of your card
Viewsonly when your page shows them
A field your page does not show is absent rather than null, so nothing implies there is a number to read where there is not one.
Caching and access
Cachingone hour
Cross-originallowed, so a browser can read it directly
Deactivated404, exactly like the page
An edit shows up within the hour. Responses carry an ETag, so a client that asks again before then is answered with a 304 rather than the whole document.
What it never carries
It only ever carries what your page already shows.
No email, no id, no session, no plan, nothing from your settings. Turn your view count off and it disappears from here too; hide a badge and it is gone from here as well. A public API and a public page have to mean the same set of facts, or the API becomes a way around your own privacy switches.