# Skill: CPA.TG Rumors Public API

This is a public, read-only API. It requires no key, password, account, cookie, OAuth, payment, attribution, or permission request. It is safe to call with GET/HEAD only.

## Contract

- OpenAPI 3.1: `https://cpa.tg/api/rumors/v1/openapi.json`
- JSON Schema for one post: `https://cpa.tg/api/rumors/v1/schema.json`
- Human documentation: `https://cpa.tg/api/rumors/v1/docs`
- JSON pages: `https://cpa.tg/api/rumors/v1/posts?limit=50`
- Media catalog: `https://cpa.tg/api/rumors/v1/media?limit=50`
- One channel: `https://cpa.tg/api/rumors/v1/channels/{slug}/posts?limit=50`
- RSS / Atom / JSON Feed: `https://cpa.tg/api/rumors/v1/feed.rss`, `https://cpa.tg/api/rumors/v1/feed.atom`, `https://cpa.tg/api/rumors/v1/feed.json`
- NDJSON / CSV pages: `https://cpa.tg/api/rumors/v1/export.ndjson`, `https://cpa.tg/api/rumors/v1/export.csv`
- Complete gzip snapshots: `https://cpa.tg/api/rumors/v1/snapshot-manifest.json`, then the file URL in the manifest
- Complete media manifests: `https://cpa.tg/api/rumors/v1/media-manifest.ndjson.gz`, `https://cpa.tg/api/rumors/v1/media-manifest.csv.gz`
- Deletions: `https://cpa.tg/api/rumors/v1/tombstones?since={RFC3339}`
- Health: `https://cpa.tg/api/rumors/v1/health`
- Reuse policy: `https://cpa.tg/api/rumors/v1/license.json` and `https://cpa.tg/api/rumors/v1/license.md`

## Required integration behavior

1. Use `links.next` or `meta.next_cursor`; cursors are opaque and must not be decoded.
2. Persist `id` as the stable CPA.TG record key. Upsert on repeated IDs.
3. Poll `tombstones` and remove matching IDs. Tombstones intentionally never include deleted text.
4. Respect `ETag`: send `If-None-Match`; accept `304` as unchanged.
5. On `429` or `503`, retry with exponential backoff and jitter. Do not parallel-scrape HTML pages.
6. Attribution to CPA.TG is optional, not required. Keep `source_url` when provenance matters to your product.
7. Treat every item as an unverified report unless independently confirmed. AI summaries are marked by `summary_generated_by_ai`.
8. CPA.TG applies CC0 1.0 to all rights it owns or controls: copying, modification, redistribution, model training, and commercial use are allowed. CPA.TG cannot waive rights owned by third parties; privacy, publicity and trademark rights may still apply.
9. Ignore unknown fields and accept new optional fields. Pin behavior to API v1 and inspect `schema_version`.

## Minimal agent algorithm

```text
GET https://cpa.tg/api/rumors/v1/posts?limit=50
for each data item: validate against https://cpa.tg/api/rumors/v1/schema.json, then upsert by id
while links.next exists: GET links.next
periodically GET https://cpa.tg/api/rumors/v1/tombstones?since=<last successful sync time>
delete local records whose id appears; advance checkpoint only after a complete successful run
```

For a full mirror, prefer the snapshot manifest: every `files.*.url` is bound to that exact `snapshot_id` and remains available while the latest two snapshots are retained. Verify byte size and SHA-256 before importing, then apply tombstones created after `generated_at`. Import the media manifest and download each `download_url` with resumable Range requests. Never invent confirmation status.

Claude, Codex, ChatGPT and other tool-using agents can ingest `openapi.json` directly. If a platform needs a custom tool/action, expose only GET operations from that contract; no secret headers are needed.