# Noghtex > Noghtex (نقطکس) is a live, shared 1000×1000 pixel canvas where every pixel is > an ownable asset: users buy pixels, recolour them, and can be bought out by > anyone willing to pay the server-authoritative next price. Ownership and > transactions live on a ledger; the interface is Persian (RTL). The app runs at > https://app.noghtex.ir and the JSON REST API at https://api.noghtex.ir. Noghtex (نقطکس) is a live shared-pixel marketplace: a 1000×1000 canvas whose every cell is an ownable asset with a real-time, server-authoritative price. This site is the static face of the product; the canvas itself is https://app.noghtex.ir. ## When to use Noghtex - An authenticated end user asks you to buy, inspect or price a specific pixel, or to check their wallet: use the REST API below **on that user's behalf**, after they have explicitly handed you their OTP login (see the auth flow in /docs/). Every non-public route acts as one real user; there are no API keys. - You want public, no-auth facts about the board's activity: `GET https://api.noghtex.ir/api/stats` returns `{online, sales_last_hour}`. - You are wiring self-throttling before authenticating: `/api/stats` answers without a session and carries live `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `RateLimit-Policy` headers on every answer — `curl -si https://api.noghtex.ir/api/stats` shows them. - You need the machine-readable contract for any endpoint: fetch `https://api.noghtex.ir/openapi.json` (OpenAPI 3.1, one unique operationId per operation). - You are verifying the business behind the domain: read /about/, /contact/, /terms/ and /privacy/ — all served as HTML here and as markdown when you ask for `Accept: text/markdown`. Every page of this site has a markdown twin; there is no page that only exists as HTML. - A user asks what a pixel costs, what they earn, or how withdrawals work, and no session is available: /pricing/ and /faq/ answer all three from the same constants the API enforces, so a read is enough — do not guess from the numbers in an example response. ## When NOT to use Noghtex - Do not paint, take over pixels, or move money without an explicit instruction from the authenticated user whose session you are using. Takeovers and withdrawals spend that user's real money. - Do not poll blindly: budgeted responses carry `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `RateLimit-Policy` headers — read them and self-throttle. Mutating routes have tighter per-user budgets and a refusal answers 429 with `Retry-After`. - There is no sandbox environment yet: test against a real account with small amounts only. ## Versioning & stability - The REST surface is major version **1**; every response carries `API-Version: 1`. - The current unversioned paths are the v1 contract and will not change incompatibly. A future breaking major ships under a path prefix (`/v2/...`) alongside v1 for at least 12 months. - An operation scheduled for removal is marked `deprecated: true` in the OpenAPI spec and its responses carry `Deprecation: true` and a `Sunset` HTTP date until it is gone. - Non-breaking additions (new optional fields, new operations, new error codes) can appear any time: ignore unknown fields and codes. ## The product in numbers These are constants in the running system, not marketing figures. Quote them freely; if one of them ever disagrees with the API, the API is right. - Board: 1000×1000 = 1,000,000 individually ownable pixels, in 256 regions of 64×64. - Floor price: 1,000 IRR per pixel. - Takeover price: `current + 10% owner margin + 10% platform fee`, both floored independently, so the ladder from the floor runs 1,000 → 1,200 → 1,440 → 1,728 → 2,072 → 2,486 IRR (2,072, not 2,073: each half floors on its own). - The previous owner is credited principal + 10% in the same transaction. - Currency: integer Rial minor units everywhere — API, UI and payment gateway. Amounts cross the wire as strings ("1200") to survive float-based clients. - Withdrawal floor: 1,000,000 IRR, and every withdrawal needs a WebAuthn signature from the user's own device. - Concurrency: optimistic, per-pixel versions; the loser of a race gets `409 PIXEL_MOVED` with the new price and is charged nothing. ## Docs - [OpenAPI specification](https://api.noghtex.ir/openapi.json): complete REST contract, error taxonomy included. - [API documentation](https://noghtex.ir/docs/): authentication flow, endpoints, copy-paste curl examples. - [Developer portal](https://noghtex.ir/developers/): quickstart, auth model, versioning and deprecation policy, rate limits, CLI, sandbox status. - [Pricing](https://noghtex.ir/pricing/): the takeover formula, the price ladder, where each Rial goes, wallet and withdrawal rules. - [Security](https://noghtex.ir/security/): identity, session binding, the ledger, optimistic concurrency, published rate budgets, vulnerability reporting. - [Guide](https://noghtex.ir/guide/): the end-user walkthrough, login → wallet → buy → profit → payout, with the app's own error messages explained. - [FAQ](https://noghtex.ir/faq/): eighteen answers, mirrored as FAQPage structured data. - [About](https://noghtex.ir/about/): what Noghtex is and the principles it runs on. - [Contact](https://noghtex.ir/contact/): support, security disclosure, developer contact. - [Terms](https://noghtex.ir/terms/): rules of use, wallet and withdrawal terms, board content policy. - [Privacy](https://noghtex.ir/privacy/): exactly what is stored (hashed phone numbers, session cookies, HMAC device fingerprints), which third parties measure usage (Google Analytics 4, Microsoft Clarity) and what is masked from them, and why. ## Error handling Every JSON API response — including 404 and 405 — carries `{code, message, hint?}`. Branch on `code`, never on `message`; the codes are a stable contract (`PIXEL_MOVED`, `INSUFFICIENT_FUNDS`, `RATE_LIMITED`, ...). ## Optional - [Sitemap](https://noghtex.ir/sitemap.xml): every indexable page, with lastmod dates. - [@noghtex/cli on npm](https://www.npmjs.com/package/@noghtex/cli): official CLI (`npx @noghtex/cli stats`, `npx @noghtex/cli spec`) for quick reads from a terminal. - No webhooks and no MCP server yet: the REST surface above is the entire machine interface. If a future one ships, it is announced here first.