Guides

Per-post interaction settings.

Every post carries a typed settings object: who can comment, whether reaction counts are visible, and whether the post can be reposted or quoted. These are enforced server-side on the write and read paths — not display hints your client has to honour.

The settings shape

settings is present on every post response and settable on create and PATCH. Omitted keys take the open-by-default shape, so existing integrations keep working unchanged:

json

{
  "comments": "everyone",        // everyone | followers | mentioned | off
  "hide_reaction_counts": false, // hide reaction_counts from non-authors
  "allow_repost": true,          // permit POST /posts/:id/repost
  "allow_quote": true            // permit kind="quote" against this post
}

Set them on create

Pass a partial settings object; anything you leave out defaults. Here we lock comments to the author's followers and hide the reaction counts from everyone else.

bash

curl -X POST \
  -H "Authorization: Bearer pcft_live_..." \
  -H "Content-Type: application/json" \
  -d '{
        "actor_id": "<actorId>",
        "body": "Followers-only thread.",
        "settings": { "comments": "followers", "hide_reaction_counts": true }
      }' \
  "https://social.productcraft.co/v1/communities/<communityId>/posts"

Change one knob later (PATCH)

PATCH merges: only the keys you send change, the rest keep their current value. Turn comments off on an existing post without touching anything else:

bash

curl -X PATCH \
  -H "Authorization: Bearer pcft_live_..." \
  -H "Content-Type: application/json" \
  -d '{"settings":{"comments":"off"}}' \
  "https://social.productcraft.co/v1/communities/<communityId>/posts/<postId>"

How enforcement works

Comments. The comment-create endpoint checks settings.comments after the block and visibility checks. The post author can always comment on their own post; everyone else is gated:

off → 409 COMMENTS_DISABLED.
followers → non-followers get 403 COMMENTS_FOLLOWERS_ONLY.
mentioned → anyone not @-mentioned in the post body gets 403 COMMENTS_MENTIONED_ONLY.

Reaction counts. When hide_reaction_counts is true, reaction_counts is emitted as {} on every read surface — feed, search, hashtag feed, story highlights, single-post reads — for everyone except the author. The author still sees their own counts, as long as the read carries ?actor_id=<authorActorId>; a read with no actor_id is treated as non-author and gets {}.

Repost / quote. With allow_repost: false, reposting returns 422 REPOST_NOT_ALLOWED; with allow_quote: false, creating a kind="quote" post against it returns 422 QUOTE_NOT_ALLOWED.

Notes

These are hard server-side rules. You do not need to (and should not) re-implement them in your client — the API is the enforcement point.
Suppressing reaction counts hides the aggregate map only. An individual reactor querying their own viewer-state still learns whether they reacted.
The mentioned tier resolves against the post's indexed @-mentions, the same set the mentions guide describes.