POST /api/bookmarks not working?

[lifepillar]

I am a bit confused about the status of the API after upgrading to v1.8.0. In v1.7.x I was able to create bookmarks by posting to api/bookmarks and to get tags by accessing api/tags. None of those endpoints seem to be available any longer. On the other hand, api/v1/bookmarks and api/v1/tags are still todo's afaict.

Is it possible to add a bookmark via API in v1.8.0?

[lifepillar]

I may not fully grasp how Shiori is evolving, but if #640 is current, my understanding is that there is no way to add a bookmark via the new API in v1.8.0 (api/v1/tags works, however). On the other hand, it seems that the old API for adding bookmarks has been removed. So, was the feature removed without providing a replacement?

For now, I've downgraded to v1.7.4.

[fmartingr]

Hey folks, the add bookmark API should be available under /api/bookmarks as it were before, either that or I did something terribly wrong in the 1.8.0 release. The UI uses the same API call to create a bookmark, so that should be working with that API.

I'm running a branch on my server so I can't test this right now, but will do so later.

[fmartingr]

Can confirm that /api/bookmarks works on 1.8.0 (if not, the bookmark creation will be broken). The new API will be implemented when I finish with #1157 and that will be a major release (v2.0.0).

What problems do you folks see using the /api/bookmarks endpoint?

[lifepillar]

Strange, let me dig deeper then. I have a script that adds bookmarks via the API, and it started to return 501 502 after upgrading to v1.8.0.

On a related note, can you confirm that the API documentation should still be reachable at http://<shioriurl>/swagger? Because I can't access that either. Maybe I have a broken build.

[fmartingr]

On a related note, can you confirm that the API documentation should still be reachable at http:///swagger? Because I can't access that either. Maybe I have a broken build.

Swagger was changed in an old release to be disabled by default. You can enable it again by using SHIORI_HTTP_SERVE_SWAGGER.

[lifepillar]

Thanks for the tip on serving Swagger: that worked.

I've just built v1.8.0 from source, but I have the same issue. Using curl, I get an empty reply:

$ curl -X GET http://127.0.0.1:8080/api/bookmarks
curl: (52) Empty reply from server

Adding session headers doesn't change anything. This is what Shiori logs when I try to access the URL from an authenticated session in the browser:

time="2026-01-13T14:12:29+01:00" level=error msg="Failed to check token" error="error parsing token: token signature is invalid: signature is invalid" request_id=
2026/01/13 14:12:29 http: panic serving 10.xxx.xxx.xxx:48402: session has been expired                                             
goroutine 59 [running]:                                                                                                          
net/http.(*conn).serve.func1()                                                                                                   
        /skeleton/usr/local/go124/src/net/http/server.go:1947 +0xbe                                                              
panic({0xe0cce0?, 0x870128380?})                                                                                                 
        /skeleton/usr/local/go124/src/runtime/panic.go:792 +0x132                                                                
github.com/go-shiori/shiori/internal/webserver.checkError(...)                                                                   
        /root/shiori/internal/webserver/utils.go:29                                                                              
github.com/go-shiori/shiori/internal/webserver.(*Handler).ApiGetBookmarks(0x870303110, {0x1ed0c48, 0x87033f950}, 0x87026c640, {0x8700df9e0?, 0x46eb52?, 0xf1678e?})                                                                                               
        /root/shiori/internal/webserver/handler-api.go:52 +0x1007                                                                
github.com/go-shiori/shiori/internal/http/handlers.(*LegacyHandler).HandleGetBookmarks(0x8700629f0, {0x8700dfa20?, 0x4e6c33?}, {0x1ed6638, 0x87011e0f0})                                                                                                          
        /root/shiori/internal/http/handlers/legacy.go:79 +0x97                                                                   
github.com/go-shiori/shiori/internal/http.(*HttpServer).Setup.ToHTTPHandler.func11({0x1ecf898, 0x8700001c0}, 0x870074b38?)       
        /root/shiori/internal/http/http.go:26 +0x17d                                                                             
net/http.HandlerFunc.ServeHTTP(0x8700ca600?, {0x1ecf898?, 0x8700001c0?}, 0x7cfa96?)                                              
        /skeleton/usr/local/go124/src/net/http/server.go:2294 +0x29                                                              
net/http.(*ServeMux).ServeHTTP(0x471439?, {0x1ecf898, 0x8700001c0}, 0x87026c500)                                                 
        /skeleton/usr/local/go124/src/net/http/server.go:2822 +0x1c4                                                             
net/http.serverHandler.ServeHTTP({0x87034e8d0?}, {0x1ecf898?, 0x8700001c0?}, 0x6?)                                               
        /skeleton/usr/local/go124/src/net/http/server.go:3301 +0x8e                                                              
net/http.(*conn).serve(0x87042e240, {0x1ed1ba8, 0x870408210})                                                                    
        /skeleton/usr/local/go124/src/net/http/server.go:2102 +0x625                                                             
created by net/http.(*Server).Serve in goroutine 13                                                                              
        /skeleton/usr/local/go124/src/net/http/server.go:3454 +0x485                                                             

[fmartingr]

Thanks for the tip on serving Swagger: that worked.

I've just built v1.8.0 from source, but I have the same issue. Using curl, I get an empty reply:

$ curl -X GET http://127.0.0.1:8080/api/bookmarks
curl: (52) Empty reply from server

Adding session headers doesn't change anything. This is what Shiori logs when I try to access the URL from an authenticated session in the browser:

time="2026-01-13T14:12:29+01:00" level=error msg="Failed to check token" error="error parsing token: token signature is invalid: signature is invalid" request_id=
2026/01/13 14:12:29 http: panic serving 10.xxx.xxx.xxx:48402: session has been expired                                             
goroutine 59 [running]:                                                                                                          
net/http.(*conn).serve.func1()                                                                                                   
        /skeleton/usr/local/go124/src/net/http/server.go:1947 +0xbe                                                              
panic({0xe0cce0?, 0x870128380?})                                                                                                 
        /skeleton/usr/local/go124/src/runtime/panic.go:792 +0x132                                                                
github.com/go-shiori/shiori/internal/webserver.checkError(...)                                                                   
        /root/shiori/internal/webserver/utils.go:29                                                                              
github.com/go-shiori/shiori/internal/webserver.(*Handler).ApiGetBookmarks(0x870303110, {0x1ed0c48, 0x87033f950}, 0x87026c640, {0x8700df9e0?, 0x46eb52?, 0xf1678e?})                                                                                               
        /root/shiori/internal/webserver/handler-api.go:52 +0x1007                                                                
github.com/go-shiori/shiori/internal/http/handlers.(*LegacyHandler).HandleGetBookmarks(0x8700629f0, {0x8700dfa20?, 0x4e6c33?}, {0x1ed6638, 0x87011e0f0})                                                                                                          
        /root/shiori/internal/http/handlers/legacy.go:79 +0x97                                                                   
github.com/go-shiori/shiori/internal/http.(*HttpServer).Setup.ToHTTPHandler.func11({0x1ecf898, 0x8700001c0}, 0x870074b38?)       
        /root/shiori/internal/http/http.go:26 +0x17d                                                                             
net/http.HandlerFunc.ServeHTTP(0x8700ca600?, {0x1ecf898?, 0x8700001c0?}, 0x7cfa96?)                                              
        /skeleton/usr/local/go124/src/net/http/server.go:2294 +0x29                                                              
net/http.(*ServeMux).ServeHTTP(0x471439?, {0x1ecf898, 0x8700001c0}, 0x87026c500)                                                 
        /skeleton/usr/local/go124/src/net/http/server.go:2822 +0x1c4                                                             
net/http.serverHandler.ServeHTTP({0x87034e8d0?}, {0x1ecf898?, 0x8700001c0?}, 0x6?)                                               
        /skeleton/usr/local/go124/src/net/http/server.go:3301 +0x8e                                                              
net/http.(*conn).serve(0x87042e240, {0x1ed1ba8, 0x870408210})                                                                    
        /skeleton/usr/local/go124/src/net/http/server.go:2102 +0x625                                                             
created by net/http.(*Server).Serve in goroutine 13                                                                              
        /skeleton/usr/local/go124/src/net/http/server.go:3454 +0x485                                                             

That request is authenticated, you need to provide the auth token or cookie.

Just tried it with a fresh 1.8.0:

# Running Shiori using docker
$ docker run -d -p 8888:8080 docker.io/shioriapp/shiori:v1.8.0
Unable to find image 'shioriapp/shiori:v1.8.0' locally
v1.8.0: Pulling from shioriapp/shiori
c61fc36716d5: Pull complete
551ec4e66c66: Pull complete
7207b6b1b13c: Pull complete
b68967d02b0e: Pull complete
d7142d8a12be: Pull complete
Digest: sha256:d3bdfc1b68b8f267a04cf74d73b8a0e1d99ac71c3a9047375e97202f079eb1f6
Status: Downloaded newer image for shioriapp/shiori:v1.8.0
2cdcc1f998e078c98f32874405fd7e008e5b64b87fb29d0d104a8999588dc1d3

# Authenticating
$ http localhost:8888/api/v1/auth/login username=shiori password=gopher
HTTP/1.1 200 OK
...

{
    "message": {
        "expires": 1768395305,
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhY2NvdW50Ijp7ImlkIjoxLCJ1c2VybmFtZSI6InNoaW9yaSIsIm93bmVyIjp0cnVlLCJjb25maWciOnsiU2hvd0lkIjpmYWxzZSwiTGlzdE1vZGUiOmZhbHNlLCJIaWRlVGh1bWJuYWlsIjpmYWxzZSwiSGlkZUV4Y2VycHQiOmZhbHNlLCJUaGVtZSI6IiIsIktlZXBNZXRhZGF0YSI6ZmFsc2UsIlVzZUFyY2hpdmUiOmZhbHNlLCJDcmVhdGVFYm9vayI6ZmFsc2UsIk1ha2VQdWJsaWMiOmZhbHNlfX0sImV4cCI6MTc2ODM5NTMwNX0.TRfsRdYkDw-7x0ihiB_FJ0kkeiSn33frnXCoQ0bLHvQ"
    },
    "ok": true
}

# Adding a bookmark
$ http POST localhost:8888/api/bookmarks "Authorization: Bearer (token)" url=https://fmartingr.com
HTTP/1.1 200 OK
...

{
    "message": {
        ...
    },
    "ok": true
}

# Listing bookmarks
$ http localhost:8888/api/bookmarks "Authorization: Bearer (token here)"
HTTP/1.1 200 OK
...

{
    "message": {
        "bookmarks": [
            {
                ...
            }
        ],
        "maxPage": 1,
        "page": 1
    },
    "ok": true
}

[lifepillar]

Ah, got it. The new API seems to require a Cookie header, so I had replaced the Authorization header with Cookie, but I did it for all requests including those to api/bookmarks, which still require the Authorization header. Feel free to close this.

[lifepillar]

There's still the problem that an empty response is returned in some cases, e.g., when the request is not authenticated.

[mariusrugan]

@fmartingr this is also related #1167
tldr; PUT to /api/bookmarks with a deleted tag from a bookmark with 3 tags, is not being processed correctly,

i'm debugging locally too, was looking to see if i can fix it, don't know if you already have a fix for it or not ?
thanks in advance!

shiori/internal/webserver/handler-api.go

Line 407 in 585ea34

// Set new tags

sorry for the EDIT
the question is, this soft delete functionality - the deleted true/false on a tag - seems has no effect.

[mariusrugan]

I've succeeded to localize the source:
I'm using a Postgres db,

tldr;
t := tag.ToDTO() is not creating a correct DTO; the Deleted = true property of the Tag object is not getting into the DTO. In the history of the codebase that check (and i also am using it) is:

				// If it's deleted tag, delete and continue
				if tag.Deleted {

shiori/internal/database/pg.go

Line 228 in 585ea34

if t.Deleted {