Developers
Sinkly API & app sign-in
Other products — like Sinkly Recruitment — can add a Sign in with Sinkly button and then read and update the same data the person can see in their console.
How it works
- 1Your app sends the person to Sinkly to sign in.
- 2Sinkly shows an approval screen naming your app and the account they're signed in as.
- 3Once approved, your app receives an access token for that person.
- 4Every API call carries the token, and Sinkly answers with exactly what that person is allowed to see or change.
Sinkly uses standard OAuth 2.1 with PKCE, so any normal OAuth client library works. Discovery lives at /.well-known/oauth-protected-resource on sinkly.cc, which points at the authorisation server, and clients can register themselves.
Getting a token
# 1. Discover the endpoints
curl https://sinkly.cc/.well-known/oauth-protected-resource
# 2. Send the person to the authorisation endpoint
# response_type=code, PKCE (S256), scope=openid email profile
# They approve on sinkly.cc, then land back on your redirect_uri with ?code=
# 3. Exchange the code for tokens at the token endpoint
# You get an access_token (and refresh_token) for that person.Redirect URIs must match exactly
Scheme, host, port, path and trailing slash all have to be identical to what your client registered.
Calling the API
curl https://sinkly.cc/api/public/v1/communities \
-H "Authorization: Bearer <access_token>"
curl https://sinkly.cc/api/public/v1/communities/the-bl-x-depot/staff?status=active \
-H "Authorization: Bearer <access_token>"
curl -X POST https://sinkly.cc/api/public/v1/communities/<id>/staff \
-H "Authorization: Bearer <access_token>" \
-H "Content-Type: application/json" \
-d '{"displayName":"Nova","robloxUserId":"12345","roleId":"<role-uuid>"}'Endpoints
| Method | Path | What it returns |
|---|---|---|
| GET | /api/public/v1/me | The signed-in person, their linked Roblox and Discord accounts and their community ids. |
| GET | /api/public/v1/communities | Every community that person belongs to. |
| GET | /api/public/v1/communities/{id} | One community, its branding and staff count. Accepts an id or a slug. |
| GET | /api/public/v1/communities/{id}/roles | Ranks and roles with their permissions and Roblox/Discord mappings. |
| GET | /api/public/v1/communities/{id}/structure | Departments, divisions and teams. |
| GET | /api/public/v1/communities/{id}/staff | Staff directory. Filter with status, departmentId, robloxUserId, discordUserId, limit. |
| GET | /api/public/v1/communities/{id}/staff/{staffId} | One staff member plus their record history. |
| POST | /api/public/v1/communities/{id}/staff | Add a staff member (needs Manage staff). |
| PATCH | /api/public/v1/communities/{id}/staff/{staffId} | Update role, title, unit or status (needs Manage staff). |
| POST | /api/public/v1/communities/{id}/staff/{staffId}/rank | Apply a Roblox group rank (needs Change Roblox ranks). |
| GET | /api/public/v1/communities/{id}/records | Behavioural records across the community. |
| POST | /api/public/v1/communities/{id}/records | Write a warning, promotion, award or note (needs Manage records). |
| GET | /api/public/v1/communities/{id}/applications | Application forms (needs Manage recruitment). |
| GET | /api/public/v1/communities/{id}/submissions | Application submissions (needs Manage recruitment). |
| GET | /api/public/v1/communities/{id}/activity | Recent activity sessions (needs View analytics). |
Permissions and errors
The token never grants more than the person already has. Each endpoint checks the same console permission you set on their role, so a recruiter can read the directory and hire, while someone without Manage staff simply gets a refusal.
- 401 — the token is missing, expired or invalid.
- 403 — signed in, but not allowed to do that in this community.
- 404 — unknown community, staff member or endpoint.
- 409 — something isn't set up, e.g. no Roblox bot for ranking.