Is there more documentation on the xml api? there's this:

www.gelbooru.com/index.php?page=help&topic=dapi

but it seems that is lacking quite a bit...

That's it as far as formal documentation. What do you need help with in specific? I may be able to help.

Is there a way to search through tags?
I found this link, but dunno how to send my query string:
www.gelbooru.com/index.php?page=dapi&s=tags&q=index

like this link will give you the first 20 tags which ends with "love". (glove, yujin_love, elflove, doaralove, ... etc.)
danbooru.donmai.us/tags.json?search[name_matches]=*love

*** EDIT ***

NVM, i just found out by myself.
it's "name_pattern=".

doesn't support asterisks, tho.
can't do a "wildcard match".

*** EDIT 2 ***

and the thing that bugs me the most is, when I ask it to order by count, it gives me a ascending list (instead of a descending list...)
so I get the tags with the least count >______<

... can you just fix the sql by adding "ORDER BY count DESC" at the end of the query?

If you want desc you can now do so by adding &ordering=1 to the query... It will default to ASC if you leave it out. This is a temporary thing until we get back to work on 0.3.

How to get latest posted picture at the moment?

That's always the very first entry unless you specify a sorting method.

When performing API query, I get response "Our API is being abused at the moment and is disabled to anonymous users".
Based on the wording "to anonymous users", I assume some kind of authorization can be performed before requesting API.

Am I right and how do I do it?

You are correct. You need to be logged in to access the API. If you're accessing from a web browser, just signing in normally with cookies enabled should do the trick. If it's for an app, you will need to log in to the site as though you were logging in on a web browser and keep the user_id and pass_hash cookies. You will need to send these cookies in your request header when making an API request.

For more information, see this thread: gelbooru.com/index.php?pa...ew&id=3264&pid=40

Why not add the login-specific infos (URL and POST data to send) into the API docs ? It's now a full part of the API process. Same goes about the Cookie tips you're giving (excluding language-specific infos).

I know they are in a thread, but it would be better if those infos were also in the API docs, as well as a list of most API commands.

The change is a recent one, and is only temporary. It will change in the future to simply including your access key in the url and your account username or id in the url.