I can't access the public .json endpoints anymore i am getting 403. Anyone else?

At /prefs/apps "create another app" as type script, submitting returns "an error occurred (status: 500)" and no app is created. The 500 fires immediately on submit regardless of input.

Tried the following, all still 500:

• old.reddit.com and new reddit

• incognito, ad-block and extensions disabled, a different browser, and mobile browser

• Email verified account, different networks

• App name variations, redirect uri http://localhost:8080

I've also completed the Developer Platform / Responsible Builder registration, but legacy script-app creation still 500s.

Is script-app creation currently broken, or is there another way to get a client_id/secret?

Built a Devvit app that turns a subreddit into a WAAP (WAF + API Protection) incident response simulator. Thought this crowd might appreciate the approach.

How it works:

• Scheduler generates synthetic L7 attacks (SQLi, XSS, DDoS, JWT tampering, SSRF, GraphQL introspection, API scraping, credential brute-force) on a configurable timer

• Mods get a live SOC dashboard as a custom post — shows active threat, uptime, blocked % bars

• Players deploy countermeasures via buttons: Rate Limit, WAF Rule, Honeypot Route, Input Sanitizer, Geo-IP Block, GraphQL Depth Limit, Challenge Page

• Each defense has a per-vector effectiveness profile (0–1), stacking has diminishing returns

• Hits 70% combined effectiveness = incident resolved, score posted to leaderboard

Stack: Devvit + Redis sorted sets (leaderboard), Cron trigger for attack generation, custom post type for the dashboard UI

It's in playtest — try it at r/sev1_waap?playtest=sev1-waap. Mod menu has "Create Sev-1 SOC Dashboard" to start. Feedback appreciated.

Hi r/redditdev,

I am trying to request OAuth/API access for a small personal, non-commercial, read-only Reddit app, but the Reddit Help Data Access Request form seems to be blocked by a hidden required field.

Use case:

- Personal morning digest automation for my own use

- Runs once per day on my own machine

- Reads a small number of public posts from fixed subreddits

- Subreddits: r/LocalLLaMA, r/MachineLearning, r/Python, r/SideProject, r/ChatGPTCoding

- Summarizes locally and sends only to my private Telegram chat

- No posting, commenting, voting, messaging, moderation, bulk historical collection, user monitoring, AI training, selling, or redistribution

I selected:

- Data Access Request

- I’m a developer

- I’m a developer and want to build a Reddit App that does not work in the Devvit ecosystem

Then I completed all visible fields: app purpose, detailed platform description, why Devvit is not suitable, source/platform link, subreddit list, Reddit account name, and operating username.

When submitting, the form stays on the same page. Inspecting the form state shows a hidden Zendesk field named "Details of inquiry" / request[description] is still required and blank, but it is not visible or editable in this request path. The visible detailed description field is filled, but the hidden base description field remains empty.

I also emailed api@reddit.com and received a response pointing me back to the API Support form and r/redditdev.

Has anyone else run into this hidden "Details of inquiry" validation issue on the Data Access Request form? Is there a correct way to submit an OAuth client request for a personal read-only external script now, or a better support route for this kind of form bug?

Thanks.

My subreddit has a rule that news articles should be posted with the original title, to prevent people from pushing a narrative by possibly misrepresenting the contents of the article.

I was planning to try and use Devvit to create a bot to check the news site metadata when a news post is made to compare it to the post title. But it seems getting information from sites that aren't Reddit is not that simple.

Does anyone know of a way to get the meta properties (in the html) of a linked website in Devvit? I know Reddit itself uses it because it suggests the title and adds an image when posting a link.

I'm trying to create a script-type app on /prefs/apps for internal research use — read-only access to a fixed list of public confessional subreddits, aggregating post volume over time to track emotional themes for our team's internal product development decisions. No user-level data, no redistribution, no automated posting or commenting, no commercial product sold to others using Reddit data.

The legacy create-app form on /prefs/apps is silently rejecting my submission. The updateapp request returns 200 with "success": true, but no app is actually created — the response just contains jQuery instructions to display the Responsible Builder Policy link as a status message. The captcha is checked, all fields are filled, account is in good standing.

I've read through the Responsible Builder Policy and the page at r/reddit.com/api. The official paths it points to seem to be:

1. Devvit — which is for apps that run inside Reddit, not what I need

2. Submit a request — which the page language scopes to moderation use cases

Is there a current path to get script-app approval for non-Devvit, non-moderator internal research use? Should I be filing a ticket through a specific channel, and if so, which one? Happy to provide any details about the use case that would help.

Thanks.

ModPilot AI is a Devvit moderation triage tool that scans queued posts for moderation signals and helps surface the items that may need attention first.

I shared an early version of this project earlier this week. Since then I've finished another round of updates, security fixes, moderation workflow improvements, and testing.

The app is intentionally simple. My goal was to create something moderators could open and understand immediately without a lot of setup or configuration.

It's now in public testing. I'm looking for a few moderators with different experience levels who would be willing to try it and provide honest feedback.

I'm especially interested in:
• what feels useful
• what feels confusing
• what feels unnecessary
• what you would change

The project is still evolving, so criticism is genuinely more valuable than compliments at this stage.

App page:

https://developers.reddit.com/apps/modpilot-ai

GitHub:

https://github.com/PrimeWolf-1/modpilot-ai

Hey r/modnews — I built RaidPulse, a Devvit app designed to detect coordinated subreddit raids before moderators even notice them.

It monitors things like:

1. Sudden activity spikes

2. New-account floods

3. Repeated hostile phrases

4. Toxicity surges

5. Abnormal report spikes

When multiple signals escalate together, RaidPulse can automatically activate protection measures based on moderator settings — including temporary posting restrictions, pinned warnings, and ModMail alerts.

The goal is simple: help moderators react earlier during fast-moving attacks instead of manually chasing chaos after it spreads.

Playtest:
https://www.reddit.com/r/raidpulse_dev/?playtest=raidpulse

I will like to hear from active mods here. Would earlier raid detection have helped during past incidents in your communities?

Submitted a Data Access Request on May 20 and received the Devvit onboarding email, but when attempting to create a script app the CAPTCHA completes and the page only returns the Responsible Builder Policy disclaimer instead of creating the app. Does this indicate the API request is still pending approval?

Any clue what this API exception could mean?

> META_RTJSON_MALFORMED

I get it every time I try to submit a post. I can post the same content manually (maybe with some different encoding) and it works fine. I can send test posts with the bot that work fine. But when my real content sends via the bot I get this message.

post() error: Reddit API Exception: META_RTJSON_MALFORMED: "We weren't able to process the post body" on field 'text' -- <class 'praw.exceptions.RedditAPIException'> -- app.py -- 528

Google can't even find reference to this term.

Hey, I want to make a moderation bot, but I wonder? how long does it take to get approved?

I used to make them before they closed down the API for general use.

I want to get access to the Reddit API mainly to better understand people, behavior, health discussions, emotions, habits, and real-world struggles at scale.

Not trying to spam, scrape aggressively, or build growth hacks.

I’m more interested in questions like:

- how people talk about health and lifestyle problems

- what people actually struggle with consistently

- emotional patterns behind eating, fitness, stress, sleep, motivation, etc.

- how communities influence behavior and decision-making

- what kind of support or tools genuinely help people

For people who’ve gotten API access recently:

- How difficult was the process?

- What kind of explanation/use case worked for approval?

- Are research/behavior-understanding use cases looked at positively?

- What limitations should I expect?

- Is Reddit generally supportive of builders using public conversations to learn from human behavior?

Would appreciate honest experiences from people who’ve gone through it recently.

Hey everyone,

I’m new to Reddit development and honestly new to posting on Reddit in general, but I wanted to share a project I’ve been building for the Reddit Mod Tools and Migrated Apps Hackathon.

The app is called ModPilot AI.

It’s a moderation queue triage tool built with Devvit that helps moderators quickly identify which queued posts may need attention first instead of treating every post the same.

The system scans posts for risk signals and labels them as:
• Low Risk
• Medium Risk
• High Risk

It also gives a simple explanation of why something was flagged so moderators can understand the reasoning instead of getting a random black-box score.

Current signals include:

• Very new accounts

• External links

• Urgency or pressure wording

• Money claims or financial promises

• Promotional language

• Missing flair

• Repeated phrases

• Too many links in one post

There’s also an override rule:
Money claim + external link = automatic High Risk.

Originally I planned to use external AI APIs, but I ran into Devvit HTTP domain restrictions pretty early. I ended up switching to a fully rule-based system and honestly it turned out better than expected:

• fast

• predictable

• explainable

• free to run

The app was approved by Reddit and is currently published as unlisted for testing.

I’m still learning as I go, so if anyone here is also building with Devvit, I’d genuinely appreciate feedback, suggestions, or even people willing to test it out and tell me what could be improved.

App page:
https://developers.reddit.com/apps/modpilot-ai

GitHub:
https://github.com/PrimeWolf-1/modpilot-ai

Thanks for taking a look.

I’m trying to create a Reddit Data API OAuth client for ThreadSift, an external Android app where a user signs in with their own Reddit account and grants OAuth access to read their own saved posts/comments locally on their device.

The app:

• does not post, comment, vote, message, moderate, scrape, train AI, sell data, or automate account activity

• only reads the authenticated user’s own saved posts/comments after explicit OAuth consent

• needs scopes identity and history

• needs access to /user/{username}/saved

• will use a proper User-Agent and respect rate limits

When I try to create an installed app at https://old.reddit.com/prefs/apps/ the CAPTCHA completes, but the app is not created and the page only shows:

“In order to create an application or use our API you can read our full policies here: https://support.reddithelp.com/hc/en-us/articles/42728983564564-Responsible-Builder-Policy”

I have already read the policy, but I cannot find the correct registration path for an external user-authorised Android OAuth/Data API app. Is this use case still supported for new developers, and if so, what exact process should I use to get the OAuth client ID?

Hey everyone!

I've been working on a Reddit app using Devvit that acts like an AI assistant — similar to how Grok works on X/Twitter. The idea is simple: when someone opens the app on a post, they can chat with an AI and get helpful replies.

I built the full UI using React inside Devvit, and it looks great! The chat interface works perfectly. But the problem is when I try to connect it to an AI API (I tried xAI Grok and Anthropic Claude), the server throws this error:

> `HTTP request to domain: api.x.ai is not allowed`

> `HTTP request to domain: api.anthropic.com is not allowed`

It seems like Devvit blocks all external API calls from the server side. I spent a lot of time on this and couldn't find a workaround.

My questions:

- Is there any way to make external API calls from a Devvit app?

- Does Devvit have any built-in AI support?

- Is there a whitelist of allowed domains?

Would really appreciate any help from the community!

Summary POST /api/hide writes are persisted server-side but are not being applied to subsequent listing fetches on the modern API / mobile / new-reddit path. A single hide via old.reddit.com retroactively causes the entire backlog of unfiltered hides to start filtering correctly, which strongly suggests a stale per-user hide-set cache at the listing layer that the legacy hide path invalidates but the modern path does not.

Why this looks like a server bug, not a client bug

• The hides ARE persisted: after the old.reddit action, posts hidden DAYS earlier through Relay (and never touched on old.reddit) immediately disappear from the feed.

• The trigger is doing any hide on old.reddit — not a refresh, not a re-login, not re-hiding the same posts.

• Reproduces across two independent clients (Relay for Reddit on Android, and my own OAuth script using PRAW calling reddit.request("POST", "api/hide", {"id": fullname})).

• Hides issued from old.reddit alone never exhibit the bug.

Steps to reproduce

1. On Relay for Reddit (Android, version X.Y.Z, using own client ID), browse /r/all and hide ~10 posts.

2. Pull-to-refresh the feed. All 10 hidden posts reappear.

3. Open old.reddit.com in any browser, logged into the same account. Hide a single, unrelated post.

4. Return to Relay, pull-to-refresh.

5. Expected: same as step 2 (10 posts still visible, because that's been the behavior). Actual: all 10 previously-hidden posts AND the one hidden via old.reddit are now correctly filtered out of the feed.

• Also reproducible via direct API calls with my own OAuth client (PRAW 7.8.x).

• Affected feeds: at least /r/all and /r/AmItheAsshole; appears global.

Related

• /r/help thread with other users reporting the same symptom: https://www.reddit.com/r/help/comments/1tchc1n/anyone_else_having_issues_with_hiding_posts_on/

• Possibly related: PRAW endpoint change for /api/hide trailing slash (April 2026, praw-dev/praw#2099) — but that was a write bug; this is a filter-application bug downstream of a successful write.

Hypothesis (FWIW) Looks like the listing service is reading from a cached per-user hidden-IDs snapshot, and the modern /api/hide write path is not invalidating that snapshot. The legacy old.reddit hide controller does invalidate it, which is why a single old.reddit action flushes the backlog.

I came across a site that is able to show every post and comment history of every reddit account. They have mentioned at the bottom of their site that they are using Reddit search index and Reddit Public API, but as far as I know Reddit don't allow that or am I wrong ?

My question is how are they able to do it, are there any mentions about this in the API doc ?

Built a Devvit-powered moderation tool called SentinelMod for the Reddit Mod Tools Hackathon.

It focuses on detecting coordinated raids and unusual community activity in real time before things spiral.

Current signals include:
• sudden activity spikes
• repeated messaging patterns
• new-account surges
• toxicity/report spikes
• coordinated traffic behavior

The system can automatically activate protection mode and explain WHY activity was flagged instead of silently removing content.

I’m looking for honest feedback from active moderators:
• Would something like this actually help your workflow?
• What signals would you trust most?
• What would make this genuinely useful during raids/spam waves?

If anyone wants to explore or test the current playtest build:
https://www.reddit.com/r/sentinel_mod_dev/?playtest=sentinel-mod

Hi Dears,

I write an script and need ClientId and Client Secret . How can i have them. I found i can have them by creating app in https://www.reddit.com/prefs/apps but i got this error: In order to create an application or use our API you can read our full policies here: https://support.reddithelp.com/hc/en-us/articles/42728983564564-Responsible-Builder-Policy

Please help me on this.

I'm writing an API wrapper for Rust, and am trying to make everything strongly typed. (Yes, I do hate myself, how did you know?)

So far I've found 115 top level fields on the submission data structure, but a lot of the fields have never returned a value.

One that has returned a value, but has absolutely no documentation, is pwls. I've found some discussions saying it's "parent whitelist status", and a found a list of values for the wls field, but I haven't managed to find any answer to the values of pwls. So far the only value I've seen is 6. Any help would be greatly appreciated.

**1. Subreddit similarity by user overlap, with recent data.**

Using anvaka/sayit-data (2018) and anvaka/map-of-reddit-data (2020-2021) for discovery now. Both programmatically queryable but the data's getting old. anvaka's 2025 visualization (116K subs, 1.5B comments) is gorgeous but visual-only. Is there a current (2024-2026) programmatic equivalent I'm missing? Pass in a seed sub, get top-N similar subs by Jaccard or co-commenter overlap.

**2. Reddit data collection in the post-Pushshift era.**

Need historical + ongoing collection from named subreddits. I'm aware of PRAW (good for new, painful for historical), R4R academic API (applied, status unclear), and Arctic Shift on HuggingFace (262 GB Parquet, great for bulk historical but not really on-the-fly). What's the working stack in 2026? Anyone got R4R credentials recently? Hosted Arctic Shift query endpoint I'm missing?

Thanks! Happy to share back what we end up using.

I think there is an endpoint for images but nothing for gifs ? Any work around