buildAPI REFERENCE
Private library API.
Read and move your own build library using a documented v1 format. Guest exports remain available without an account.
This is the owner-private preview. A production domain and successful real visitor integration test remain pending.
Read your own portable library
GET /api/v1/library returns buildapc-library version1 JSON directly. HEAD returns metadata without a body. All private responses use Cache-Control: private, no-store.
Native visitor sign-in is required on every private operation. The app issues no API key. Site service access supplies no visitor identity; the account hash is a write-destination pin, not a credential. Do not extract or share cookies/authentication headers.
const response = await fetch('/api/v1/library', {
credentials: 'same-origin', cache: 'no-store'
});
if (!response.ok) throw new Error('Read failed');
const library = await response.json();
const etag = response.headers.get('ETag');
const account = response.headers.get('X-BuildAPC-Account');No private API request has been made from this reference page.
This explicit read displays counts/revision only. It does not upload, modify or publish a build.
Write only after review
PUT /api/v1/library accepts a reviewed library. DELETE erases library content. Library JSON may contain private notes and manual quotes; review it before uploading. Both require the exact request Origin, X-BuildAPC-Intent: sync, the last-read X-BuildAPC-Account and concrete If-Match ETag.
PUT replaces the entire reviewed library; omitted builds/versions are removed. Existing saved version IDs cannot be rewritten in place. Save conflicts return412. Keep both copies, read the latest state, review the destination and retry deliberately. Deletion advances the revision, so stale uploads cannot restore removed data. Wildcard blind replacement is rejected. Successful writes return a receipt; read again to obtain the next ETag. Nothing retries automatically.
Cloud library deletion leaves minimal identity/revision fences and expiring rate counters. Community records, browser storage and downloaded copies are separate. Storage details →
Limits and recovery
| Scope | Limit |
|---|---|
| Reads / HEAD / conditional reads | 120 per minute per signed-in account |
| Authorized save attempts, including rejected formats/conditions | 30 per hour |
| Deletion | 10 per hour, independent of saves |
| Raw library body / normalized library | 1500000 UTF-8 bytes |
| One snapshot | 256000 UTF-8 bytes |
| Named builds / versions per build | 20 / 20 |
Rate responses include429, Retry-After seconds and named limit/remaining/reset headers. The server counts requests across aliases, including conditional reads. A15-second input deadline prevents indefinite uploads. Missing identity401, wrong origin403, changed account409, failed ETag412, missing concrete condition428, oversized body413 and unavailable storage503 preserve the pending copy.
Legacy /api/account and /api/account/library remain supported with their existing envelope/numeric revision tags and409 conflict status. v1 uses opaque account-bound tags and412. Incompatible resource/format changes require a new major path.
Validate a local copy
Choose a BuildAPC snapshot, library or API read/receipt JSON. Validation runs in this browser using the same portable-format rules; private notes/content are not displayed or uploaded. Original source dates and unresolved exact references remain context, not new verified prices or compatibility claims.
No file selected.
Normalized schemas are included in the OpenAPI document. Duplicate IDs, parseable dates, owned quantity versus selected quantity, immutable history and total UTF-8 size also require server validation. Review/import a copy in the guest builder →