---
title: "Toggle Reaction"
method: POST
path: "/chat/messages/{message_id}/reactions"
tags: ["chat", "chat"]
---

# Toggle Reaction

`POST /chat/messages/{message_id}/reactions`

Toggle an emoji reaction on a message.

🔒 Had no conversation/channel-membership check at all, and trusted a
client-body `user_id` outright — any logged-in caller could react to (or
silently un-react) any message anywhere, forging another user's reaction
by naming their id. Authorization is on the CALLER (the token), never on
the client-supplied user_id — same pattern as every other endpoint in
this file/session that accepts a body-supplied identity.

## Path parameters

- `message_id` string, required

## Headers

- `authorization` string, nullable

## Request body

- ToggleReactionRequest
  - `emoji` string, required
  - `user_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored.md) · [All operations](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fluentea/aurqa-language-learning-platform-refactored/revisions/45cbba31aa7d/schema)