Bug overview description.
All API functions returning post lists ignore deleted posts, even in cases where the website should be able to show them.

What part(s) of the site page(s) are affected?
The JSON and XML APIs, specifically the /post/index, /pool/show and /set/show calls.

What is the expected behavior?
Given the same tags parameters, both the website and the API should return the same set of posts.

What actual behavior is given instead?
Deleted posts cannot be made to appear in the JSON or XML data, even in cases where they appear on the website.

• Post listing:
• https://e621.net/post/index?tags=status%3Adeleted (All deleted posts are shown)
• https://e621.net/post/index.json?tags=status:deleted (Returns an empty list)
• https://e621.net/post/index.xml?tags=status:deleted (Returns an empty <posts> node with a reported 195151 elements, as documented)

• Pool listing:
• Website : https://e621.net/pool/show/12786 (All posts in the pool have been deleted, but are shown nonetheless)
• JSON : https://e621.net/pool/show.json?id=12786 (the posts element is empty)
• XML : https://e621.net/pool/show.xml?id=12786 (the <posts> node is empty)

• Set listing
• Website : https://e621.net/post/index/1/set:ttn_ntartf%20status:deleted (Uses the post listing, 9 deleted posts)

XML : https://e621.net/set/show.xml?id=4162 (<status>deleted</status> doesn't appear in the document)

• JSON : https://e621.net/set/show.json?id=4162 (status:"deleted" doesn't appear in the object)

Can you reproduce the bug every time?
Yes.

What steps did you take to replicate this bug?
See "Actual Behavior"

I know this has been a known "bug-or-intended" quirk for some time (see forum #201685), but considering how the purpose of the API is to have a convenient way to query the site for any data otherwise accessible from the website in a stable and easily parseable format, this makes the API incomplete. Considering how most of this data can still be accessed by parsing the site's HTML instead, this accomplishes little in terms of information security and only serves to obfuscate information about deleted posts when using the API specifically.

It's a bit more nuanced than that as there are multiple access levels associated along with the posts, and this is just one of them. I agree, it isn't ideal, but it means rewriting a bunch of logic that is currently embedded in the views and moving it to the controllers/models and trying to make it remotely sane. Something I am not looking forwards to doing because of the grand scope of it.

KiraNoot said:
Something I am not looking forwards to doing because of the grand scope of it.

I'd do it. I've got time on my hands.
But I doubt you'll let a random stranger touch your site's code.