This page is the authoritative contract for how identity works. `/profile` is the signed-in control plane, and `/<username>` is the canonical public projection. It defines user behavior, developer interfaces, data guarantees, and operational trust boundaries.
Identity in Receiz is not a display layer. It is a constrained state machine: authenticated root (`/profile`), canonical public route (`/<username>`), proof-aware originals, and policy-controlled distribution.
`/profile` is the signed-in identity control plane. `/<username>` is the public projection of that identity.
Identity naming, privacy, and profile data are bounded by strict validation and predictable fallbacks.
Avatar/banner updates are not cosmetic-only uploads; each image is processed, stored, and minted into a verifiable Receiz record.
Identity is social and operational: follows, showcased originals, download policies, and witnessed analytics are all first-class state.
Route, policy, and proof behaviors reflected directly from runtime + API code paths.
The shortest path to a trusted, policy-controlled public identity surface.
If signed out, the route redirects to `/signin?next=/profile`. After sign-in, identity is guaranteed server-side before the profile UI renders.
Use lowercase + underscores only. Availability checks are live through `/api/profile/username/availability`, and conflicts are rejected before commit.
Upload media through profile controls. Receiz processes the image, stores it, and mints verification metadata so profile media has audit-grade provenance.
Each original carries ownership class (`creator` or `verified`), proof state, and show/hide controls. Visibility updates are persisted per receiz ID.
Original and derivative download rights, limits, release locks, and optional paid checkout are enforced via profile-original APIs.
Your public surface projects deterministic identity + proof-backed originals + witness metrics, with follow graph and analytics continuity.
Identity includes a full analytics stack: event capture, witness depth, conversion math, attribution, and timelines.
Core profile activity is tracked across all-time + rolling 90d/30d/7d/24h windows for every top-level metric.
Listening/viewing depth is modeled, not just click counts, through duration capture and witnessed rollups.
Download and paid checkout analytics are directly connected to profile original access and revenue outcomes.
Attribution is aggregated by source, referrer, and path with conversion-rate fields for each bucket.
Event taxonomy is typed and scope-classified (`profile`, `original`, `stream`, `commerce`) before storage.
{
"overview": {
"profileViews": { "all": 0, "d90": 0, "d30": 0, "d7": 0, "d1": 0 },
"streamPlays": { "all": 0, "d90": 0, "d30": 0, "d7": 0, "d1": 0 },
"checkoutPaid": { "all": 0, "d90": 0, "d30": 0, "d7": 0, "d1": 0 }
},
"stream": {
"totalListenSeconds": 0,
"avgListenSecondsPerPlay": null,
"completionRate": null
},
"commerce": {
"lifetimeRevenueCents": 0,
"checkoutToPaidRate": null
},
"funnel": {
"viewsToOpenRate": null,
"openToPlayRate": null,
"playToDownloadRate": null,
"checkoutToPaidRate": null
},
"traffic": {
"sources": [],
"referrers": [],
"paths": [],
"attributedRevenueCents": 0,
"unattributedRevenueCents": 0
},
"timelines": {
"30m": [],
"6h": [],
"24h": [],
"7d": [],
"30d": [],
"90d": [],
"1y": [],
"3y": []
},
"originals": [],
"recentActivity": []
}Everything required to integrate, validate, and reason about profile identity behavior.
Identity root: username, display metadata, privacy state, avatar/banner URLs, timestamps. Username is unique and format constrained.
Directed witness graph: follower_user_id -> following_user_id with anti-self-follow constraint and indexed traversal.
Explicit profile showcase policy per (user_id, receiz_id); used for owner toggles and public filtering.
Event stream for profile/original/stream/commerce activity; bounded payload fields and typed event-name contract.
Realtime witness aggregates (view_ms, stream_ms) maintained via trigger logic for durable profile authority metrics.
^[a-z0-9_]{3,24}$, lowercase canonicalization, reserved-word rejection.Load caller profile + resolved profilePath.
Update profile fields (username, bio, links, privacy, avatar/banner URLs).
Resolve profile view state for any username (manage mode for owner).
Follow target profile and return updated relationship state.
Unfollow target profile and return updated relationship state.
Validate and suggest canonical username alternatives.
Upload/process avatar or banner, mint media Receiz, update profile URL.
Set public showcase state for an original (ownership + entitlement enforced).
Multipart original upload with SHA-256 verification.
Initialize signed-upload flow for large originals.
Seal uploaded original into verifiable artifact and return verify path.
Create embedded Stripe checkout for paid original/derivative access.
Authorize and stream original/derivative/moment-record download with limits + payment checks.
Best-effort ingestion of profile analytics events with typed event validation.
PATCH /api/profile/me
content-type: application/json
{
"username": "operator_prime",
"displayName": "Operator Prime",
"bio": "Canonical issuer profile",
"websiteUrl": "https://example.org",
"socialXUrl": "https://x.com/operator_prime",
"isPrivate": false
}POST /api/profile/analytics/track
content-type: application/json
{
"username": "operator_prime",
"event": "original_open",
"receizId": "00000000-0000-0000-0000-000000000000",
"source": "profile_public_page",
"durationSeconds": 12.4,
"meta": {
"ownershipKind": "creator",
"layout": "single"
}
}A profile page that can serve creator trust, institutional traceability, and verifiable social presence.
One username route that carries authored identity, verifiable artifacts, and witness feedback loops.
Identity and originals stay linked at the claim/proof level, making “source of record” defensible.
Download rights, release locks, limits, and paid checkout become policy objects, not ad-hoc decisions.
Teams can treat profile identity as a standard interface for evidence publication and audit traceability.