API client

The front end does not implement its own API. It calls node-backend through two client patterns. Query names and parameters are documented in the backend query catalogs — this page covers how the client invokes them.

Endpoints

From src/config/index.js:

Bot queries (/botQuery) are not used by the browser client; see Bot framework.

Open queries (GET)

Unauthenticated reads use a GET with query parameters:

GET {API_ENDPOINT_OPEN}?query=<name>&<param>=<value>&…

Example from Skeleton.js:

const url = new URL(API_ENDPOINT_OPEN);
url.searchParams.append("query", "user_names");
const res = await fetch(url);
const result = await res.json();

Common open queries used by the client:

Full catalog: Public queries.

Auth queries (POST)

Authenticated actions use callAuthApi:

import { callAuthApi } from "../lib/api";

const res = await callAuthApi("me_profile", {});
if (!res) return; // redirected to login
const result = await res.json();

Request shape:

POST {API_ENDPOINT_AUTH}
Authorization: Bearer <jwt>
Content-Type: application/json

{ "query": "<name>", "pars": { … } }

callAuthApi:

1. Obtains the JWT via getAuthTokenFromSession() (cached while valid; silently refreshed through Amplify when near expiry).
2. If no token and requireAuth is true (default), calls signInWithRedirect() and returns undefined.
3. On HTTP 401/403 with requireAuth true, forces one session refresh and retries the request; redirects to login only if the retry also fails.
4. On HTTP 401/403 with requireAuth false, returns the response without redirecting.

Full catalog: Auth queries.

Response envelope

API Gateway often wraps responses as:

{ "statusCode": 200, "body": "<JSON string>" }

Components typically:

const result = await res.json();
if (result.statusCode !== 200) { /* handle error */ }
const data = JSON.parse(result.body);

The canonical helper is parseAuthResponse.js (used by Game Move, feedback, announcements, and similar). botApi.js also defines a local parseAuthResponse() for bot management calls.

Direct fetch for auth queries

Some code posts directly (e.g. push subscription in subscription.js) using the same envelope shape instead of callAuthApi.

WebSocket

Real-time updates use a separate WebSocket endpoint (WS_ENDPOINT). See WebSockets and Backend WebSockets.

External static APIs

Not part of node-backend:

Related

• Authentication — obtaining the JWT
• API overview
• Architecture