chat
chat
Toggle Reaction
Toggle an emoji reaction on a message.
🔒 Had no conversation/channel-membership check at all, and trusted a client-body user_id outright — any logged-in caller could react to (or silently un-react) any message anywhere, forging another user's reaction by naming their id. Authorization is on the CALLER (the token), never on the client-supplied user_id — same pattern as every other endpoint in this file/session that accepts a body-supplied identity.
post/chat/messages/{message_id}/reactions
Path parameters
message_idstring required
Headers
authorizationstring nullable
Request body
Response
Successful Response
{"stackTrail":"paths:/chat/messages/{message_id}/reactions:post:responses:200:content:application/json:schema","oasType":"schema","type":"unknown"}