List the caller's community bots
Every bot the caller has registered, newest first. Scoped to the caller: another user's bot is not in this list and is not reachable by id either. There is no community-wide list, because a bot carries a chat id on it and the community's membership is not putty's to publish.
Every bot the caller has registered, newest first. Scoped to the caller: another user's bot is not in this list and is not reachable by id either. There is no community-wide list, because a bot carries a chat id on it and the community's membership is not putty's to publish.
Authorization
bearerAuth A bearer token. The Account routes accept a Privy access token; the MCP transport accepts an sk- API key issued by POST /account/api-keys.
In: header
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/community/bots"{ "bots": [ { "id": "string", "ownerId": "string", "platform": "telegram", "chatId": "string", "displayName": "string", "chainSlug": "ethereum", "tokenAddress": "string", "tokenSymbol": "string", "autoPostReceipts": true, "postCountdowns": true, "createdAt": "string", "updatedAt": "string" } ]}The public Receipts page GET
The same trust document the JSON route returns, rendered as a static HTML page. **No bearer token is required.** §7.1 day 4 asks for "a live Receipts page" and this is the page half of that: the JSON read is for a client, and this is the link a holder pastes into a post, a bio, or a DM. The page reads the chain at request time exactly as the JSON route does, so the two cannot disagree about what a contract says. **Every string on it is attacker-controlled and every one is escaped.** A token's `symbol()`, a module's `label`, and a split recipient's `label` are all chosen by whoever deployed the contract, and this page is reached by pasting a URL into a social post — so the page's implicit claim is "trust this document". Every such value is HTML-escaped at its interpolation, every `href` is built from a value putty itself composed, and the response carries a `Content-Security-Policy` with `script-src 'none'`, so a missed escape could not execute anything even if it got through. The page carries no script of its own and no forms. A 404 (no contract at the address) and a 422 (a contract that is not an ERC-20) are rendered as the same document shape rather than as a JSON body, so a reader who followed a bad link lands on a page that says what went wrong.
Register a community bot POST
Registers a bot that gates a chat on holdings of one token. The bot's own platform token is **not** accepted here and putty never stores one: the bot runs on the user's own host, which holds the credential. What this registers is the gate — the chain, the token, and the chat — which is the part putty can prove and the host cannot. Both auto-post switches default to false. A bot that posts every Receipts update and every countdown on its own spends the community's attention, so turning them on is a separate, deliberate call.