Moving from the PirateDiffusion API to Not Safu API

Not Safu API is the adult-branded HTTPS front door for the same PirateDiffusion API you already call. In most integrations you change only the host to api.notsafu.com and keep /api/v3/… paths, headers and your existing key.

URL map

Your API key stays the same

Not Safu is a relay: it forwards your Authorization header unchanged to the rendering backend. The key you already use for the PirateDiffusion API keeps working. There is no re-issue step on this site. If a key is compromised, reply to your access email right away.

Before / after

Only the host changes in these samples. Keep the same env var name you already use, or rename it to NOTSAFU_API_KEY for clarity.

curl — before

curl -sS -X POST "https://OLD_HOST/api/v3/render" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{"prompt":"/images:1 lingerie editorial, soft window light","callback_url":"https://your-app.example/webhooks/render"}'

curl — after

curl -sS -X POST "https://api.notsafu.com/api/v3/render" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{"prompt":"/images:1 lingerie editorial, soft window light","callback_url":"https://your-app.example/webhooks/render"}'

Python — before

import os, requests
BASE = "https://OLD_HOST/api/v3"
r = requests.post(
    f"{BASE}/render",
    headers={
        "Authorization": f"Bearer {os.environ['API_KEY']}",
        "Content-Type": "application/vnd.api+json",
        "Accept": "application/vnd.api+json",
    },
    json={"prompt": "/images:1 lingerie editorial, soft window light",
          "callback_url": "https://your-app.example/webhooks/render"},
    timeout=120,
)
print(r.json())

Python — after

import os, requests
BASE = "https://api.notsafu.com/api/v3"  # or "https://api.notsafu.com/v1"
r = requests.post(
    f"{BASE}/render",
    headers={
        "Authorization": f"Bearer {os.environ['API_KEY']}",
        "Content-Type": "application/vnd.api+json",
        "Accept": "application/vnd.api+json",
    },
    json={"prompt": "/images:1 lingerie editorial, soft window light",
          "callback_url": "https://your-app.example/webhooks/render"},
    timeout=120,
)
print(r.json())

JavaScript — before

const res = await fetch("https://OLD_HOST/api/v3/render", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.API_KEY}`,
    "Content-Type": "application/vnd.api+json",
    Accept: "application/vnd.api+json",
  },
  body: JSON.stringify({
    prompt: "/images:1 lingerie editorial, soft window light",
    callback_url: "https://your-app.example/webhooks/render",
  }),
});
console.log(await res.json());

JavaScript — after

const res = await fetch("https://api.notsafu.com/api/v3/render", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.API_KEY}`,
    "Content-Type": "application/vnd.api+json",
    Accept: "application/vnd.api+json",
  },
  body: JSON.stringify({
    prompt: "/images:1 lingerie editorial, soft window light",
    callback_url: "https://your-app.example/webhooks/render",
  }),
});
console.log(await res.json());

What is different

• Host only for REST. /api/v3/… paths, JSON:API envelopes, and Bearer auth match the PirateDiffusion API. /v1/… is an identical shorter alias.
• Media URLs. Image/video/audio links in responses are rewritten to https://api.notsafu.com/v1/assets/…. Download and store your own copy; you can pass those URLs back as inputs.
• Webhooks. Your callback_url / error_url still receive POSTs from the rendering backend when a job finishes. Payload shape is unchanged; media links inside webhooks may still use backend storage hosts until the optional scrubbing relay is enabled.
• WebSocket. Prefer Authorization: Bearer on the handshake. ?token= remains for compatibility. Events are the same JSON shapes.
• Blocked paths. /virtualuser/login and /virtualuser/otp stay refused (they return auto-login links for the web app, not for API customers).
• No CORS. Call from your server only.

Checklist

1. Point the base URL at https://api.notsafu.com/api/v3 (or https://api.notsafu.com/v1).
2. Keep Authorization: Bearer and your existing key.
3. Keep Content-Type / Accept: application/vnd.api+json.
4. Update any hardcoded media host allowlists to accept https://api.notsafu.com/v1/assets/.
5. Update WebSocket clients to wss://api.notsafu.com/v1/render-events/….
6. Smoke-test: GET https://api.notsafu.com/api/v3/concepts with your key; start one render with a webhook you control.
7. Read the acceptable use policy (18+, legal and consensual, no real or realistic-looking minors).

Support and abuse

Product / access questions: reply to the email that issued your key.

Abuse reports and takedown requests: legal@notsafu.com. See Abuse and takedown.

Full endpoint reference: Developer guide.