# REST API v1

## Overview

Public REST API for programmatic access to APRS packet data.

**Base URL:** `/api/v1`
**Content-Type:** `application/json`
**Auth Pipeline:** `:api` — JSON accepts, rate-limited (100 req/min), API CSRF protection

## Endpoints

### `GET /api/v1/callsign/:callsign`

Returns the latest packet for a given amateur radio callsign.

**Controller:** `AprsmeWeb.Api.V1.CallsignController`
**View:** `AprsmeWeb.Api.V1.CallsignJSON`

**Parameters:**
| Param | Type | Required | Description |
|---|---|---|---|
| `callsign` | string | yes | Valid amateur radio callsign (path param) |

<!-- TODO: Document response schema, example request/response -->

### `GET /api/v1/weather/nearby`

Returns nearby weather station data.

**Controller:** `AprsmeWeb.Api.V1.WeatherController`
**View:** `AprsmeWeb.Api.V1.WeatherJSON`

<!-- TODO: Document query parameters (lat, lon, radius, limit), response schema, example -->

## Error Handling

API errors are rendered via `ErrorJSON` and `ChangesetJSON` view modules. The `FallbackController` handles generic error cases.

<!-- TODO: Document error response format, status codes -->

## Rate Limiting

API endpoints are rate-limited to 100 requests per minute per client via `RateLimiter` plug (ETS-based).

## CSRF Protection

API requests must include either:
- `X-Requested-With: XMLHttpRequest` header, or
- Valid CSRF token

Enforced by `ApiCSRF` plug.

## Interactive Docs

A live API documentation page with interactive testing form is available at `/api` (`ApiDocsLive`).