$ CS4 Telegram Core API Service

# a hardened REST gateway in front of CS4.TelegramCore.Data

Authentication

Every /Message/* request is a POST whose body carries an apiKey field. It is checked against user_info.api_key — a bad or missing key returns 401, and repeated failures from one IP are temporarily blocked (403).

Endpoints

The outbound message API (ported from CS4.TelegramCore.Apx, same routes). Every /Message/* call is a POST whose body carries an apiKey (validated by the global filter). The inbound Telegram webhook is authenticated by its per-bot URL, not a key.

GET /health (no key)
POST /Message/SendMessage
POST /Message/SendImage
POST /Message/SendDocument
POST /Message/SendQuery
POST /Message/SendInvitation
POST /Message/Notify
POST /WebHook/{bot} (no key; Telegram callback)

Help

Api keys are issued per user in the user_info table, not in appsettings.json.
Brute-force guard: 3 bad api-key attempts from one IP block it for ~30 min (auto-expiring).
Request/response bodies are logged to logs/requests-yyyyMMdd.jsonl; apiKey/password fields are always redacted.
HTTPS only in production — the api key travels in the request body.