Agentic Fabriq
Revolt (Stoat)
MESSAGING · MESSAGING
Channel messages, pins, reactions, and roles on the server they connected.
Connecting Revolt (Stoat) in practice
Revolt is now Stoat, and the hostnames moved with the rename: api.revolt.chat became stoat.chat/api, the websocket became stoat.chat/events, and file uploads moved from autumn.revolt.chat to cdn.stoatusercontent.com. Rate limits are fixed-window buckets that refill 10 seconds after the first request in them, and posting messages gets 10 per bucket while every unlisted route gets 20.
Scopes that draw scrutiny
X-Bot-TokenA bot token created from user settings. Stoat has no OAuth consent screen for bots, so the token is the whole grant and its reach is whatever permissions the bot’s roles carry on each server.X-Session-TokenA user session token copied from the client or obtained through the API. It acts as that human across every server they are in, not just the one you meant.Masquerade (1 << 28)Lets a message be sent under a custom nickname and avatar, so a bot holding it can post as someone else.ManageWebhooks (1 << 24) and ManageMessages (1 << 23)Creating webhook entries on a channel and deleting other people’s messages — the two permissions that turn a read-only integration into one that can rewrite a channel’s history.
Rate limits
- Fixed-window buckets, replenished 10 seconds after the initial request: POST /channels/:id/messages 10, /channels 15, /bots 10, /users 20, PATCH /users/:id 2, /servers 5, /auth 3, /safety 15, /safety/report 3, and /* 20.
- X-RateLimit-Limit, X-RateLimit-Bucket, X-RateLimit-Remaining and X-RateLimit-Reset-After (milliseconds) are returned on responses.
- A 429 body is {"retry_after": <milliseconds>} — milliseconds, not seconds.
- Instance limits published at the API root: message length 2,000 characters, 5 attachments and 5 embeds per message, 20 reactions, 100 members per group, 200 roles and 200 channels per server.
- Upload sizes: 20,000,000 bytes for attachments and 4,000,000 for avatars.
Worth knowing
- Buckets are independent and do not affect each other, so a bot can be locked out of sending messages while still able to read — a partial outage that looks like a permission change.
- Permissions are applied as allows then denies and are bit flags on 64-bit values, so a library that stores them in a 32-bit integer silently loses Video (1 << 32) and above.
- The rename is not only cosmetic: the old vortex.revolt.chat voice service has no equivalent and is superseded by Voice Chats v2, and revolt.chat/api has no replacement at all.
- The instance exposes its own limits and feature flags at the API root, including whether captcha and invite_only are on, so a client should read them rather than hardcode them.
Checked against Rate limits (2026-09-29), Authentication (2026-09-29), Permissions (2026-09-29), Stoat migration guide (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Revolt (Stoat) behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.