why not github API

GitHub is /api/v3 plus GraphQL, OAuth device flow, and GitHub-only schemas. Forgejo kept Gitea’s /api/v1. gh + GH_HOST against git.taf.sh is a dead end (dump 036). This service is the sibling of GitHub-Stats-API, pointed at that REST.

Live probes while writing the plan:

curl -s https://git.taf.sh/api/v1/version
# {"version":"16.0.3+gitea-1.22.0"}

curl -s https://git.taf.sh/api/v1/settings/api
# max_response_items 50, default_paging_num 30

What /api/v1 gives anonymously on public data: user profile, repos, starred, orgs, activity feeds, a first-class heatmap, commits with server-side author filters that do not actually exist on this swagger (the walk filters here), per-repo languages.

Rejected names: ForgeStats (jargon), Gitea-Stats-API / Forgejo-Stats-API (each excludes a host), forgefolio, anvil (Foundry), Instance-Stats-API (buries git). Envelope still names the host via instance and software.

Native heatmap counts actions, not commits, and caps at about 371 days. That is why deep=true exists. See Deep history.

Local playground (no live hostname): http://127.0.0.1:8008/playground. Sample /taf/profile?host=git.taf.sh.

sequenceDiagram
  participant B as Browser
  participant API as GitHost :8008
  participant REG as Registry
  participant H as origin /api/v1

  B->>API: GET /taf/profile?host=taf
  API->>REG: parse GITHOST_INSTANCES
  REG->>H: GET /api/v1/version
  REG->>H: GET /api/v1/users/taf
  API-->>B: envelope platform forgejo instance taf

Custom ?base_url= runs SSRF first (https:443, no CGNAT). Tokens from GITHOST_TOKEN_<KEY> never go to the caller. SSRF and registry. Deep heatmap walk: Deep history.