BUILD WITH MUSIC

A sound worth sharing.

Listening links, embedded players, editable scores and a scoped connection to Synthoverse.

Listen anywhere.

Public read endpoints support CORS without credentials. Tracks marked unlisted are available through their exact link but never appear in Discover. Draft projects have no public endpoint.

Method and endpoint	Result
`GET /api/v1/tracks`	`{items, next_cursor}`. Pass `?cursor=…` for the next 24 releases.
`GET /api/v1/tracks/{slug}`	`{track}` with title, artist, BPM, key, duration, listening URL, audio URL and remix availability.
`GET /api/v1/tracks/{slug}/audio`	PCM WAV. Supports one `Range: bytes=…` range and HEAD.
`GET /api/v1/tracks/{slug}/source`	`{data, attribution}`. Only available after the creator enables remixing.
`GET /api/oembed?url=…`	oEmbed JSON with an iframe player. The URL must be a Music listening link.

const response = await fetch(
  'https://music.pattalium.com/api/v1/tracks'
);
const { items, next_cursor } = await response.json();

An embed uses /embed/{slug}. Audio starts only when the listener presses Play. Published audio and source return 404 as soon as their listening link is unpublished; previously downloaded or shared copies cannot be recalled.

Private until you share.

The studio uses Synthoverse OAuth with PKCE to identify its member. Access tokens are encrypted on the Music server. The browser receives only an HttpOnly, Secure, host-only session cookie. No bearer tokens are placed in local storage.

Private project endpoints are for the first-party studio. External sites should use the public listening API. Cross-site cookie requests are rejected.

Method and endpoint	Request / result
`GET /api/v1/session`	Member identity, `csrf_token`, `social_connected`, expiry. Signed-out members receive `user: null`.
`GET /api/v1/projects`	`{items}`, owner only.
`POST /api/v1/projects`	`{data: Project}` → 201 `{project}`.
`GET /api/v1/projects/{id}`	`{project: {id, data, revision, updated_at, published}}`.
`PATCH /api/v1/projects/{id}`	`{data: Project, revision}`. A stale revision returns 409.
`PUT /api/v1/projects/{id}/audio?revision=…`	`Content-Type: audio/wav`, a PCM WAV body matching the saved revision.
`POST /api/v1/projects/{id}/publish`	`{revision, visibility: "public" \| "unlisted", remix: boolean}` → `{track}`.
`DELETE /api/v1/projects/{id}/publish`	Unpublish the listening link, audio and shared score.
`DELETE /api/v1/projects/{id}`	Delete the private project and its publication.
`DELETE /api/v1/session`	Sign out of this Music session.

All writes require an exact Music Origin and X-CSRF-Token. Download a project file in the studio to see the versioned pattalium-music/v1 format; its validator and generator are in the corresponding source. Ownership is checked independently for every operation. Editing a draft does not change the published version until it is published again.

One deliberate post.

Basic sign-in requests profile:read. “Connect Synthoverse” additionally asks for posts:write and media:write. Music sends a rendered WAV to Synthoverse’s audio API, waits for processing, and creates a post only after the member chooses Publish.

POST /api/v1/projects/{id}/social
{
  "revision": 3,
  "caption": "Something I made today.",
  "audience": "friends",
  "request_id": "a new UUID for this publishing intent"
}

The response is 202 {share: {id, status, url, error}}. Poll GET /api/v1/shares/{id}. Status moves through uploading, processing, posting and posted. It can also be failed or uncertain.

Reuse the same request ID when checking an interrupted request. If a post is uncertain, check the Synthoverse profile before making a new request. The server never repeats an ambiguous post. Synthoverse audiences are public, friends, close_friends and only_me. The Music listening link is independently accessible to anyone who has it.

Synthoverse grants currently last up to one hour. Expired or revoked grants require a new sign-in. Device drafts remain available. Unpublishing a Music link does not delete a Synthoverse post or its separately uploaded audio.

Room to create.

Up to 12 tracks, 12 scenes and five minutes per arrangement; 50–200 BPM.
Project requests up to 256 KiB and scores up to 18,000 characters.
50 cloud projects and 256 MiB of saved audio per account.
Music accepts exported PCM WAV up to 54 MiB. Synthoverse accepts up to 50 MiB; a five-minute stereo export may need a slightly shorter arrangement for Synthoverse.
Up to eight audio uploads per minute and six Synthoverse publishing jobs per hour per member.
Guest drafts and exports stay on the device. The studio does not upload live microphone audio or run user code on its server.

Errors use {error: {code, message}}. A 429 response includes Retry-After. Keep project files as a portable backup.