{ "openapi": "3.1.0", "info": { "title": "exl.ink API", "version": "1.0.0", "summary": "Ephemeral, no-login HTTP utilities for humans, scripts, and AI agents.", "description": "Every endpoint works over plain HTTP with **no account, no API key, and no database**.\nResources are ephemeral and identified by unguessable random ids; there is **no list or search** endpoint.\n\n**Auth (optional):** all limits below are the free tier. A paid \"Pro pass\" (a signed bearer token, bought over HTTP — see `/api/pro/*`) multiplies every per-window limit by its tier factor. Present it any one of three ways: `Authorization: Bearer `, the `X-Exl-Pass` header, or a `?pass=` query parameter.\n\n**Headline limits:** uploads ≤ 100 MB, 3/12h per IP, single download, purged after 6h.\n\nProse reference: https://exl.ink/llms-full.txt · Index: https://exl.ink/llms.txt", "termsOfService": "https://exl.ink/terms", "contact": { "name": "exl.ink", "url": "https://exl.ink" }, "license": { "name": "exl.ink Terms of Service", "url": "https://exl.ink/terms" } }, "servers": [ { "url": "https://exl.ink", "description": "Production" } ], "externalDocs": { "description": "Full prose reference", "url": "https://exl.ink/llms-full.txt" }, "tags": [ { "name": "File", "description": "One-time file links." }, { "name": "Tunnel", "description": "Reverse HTTP relay to your machine." }, { "name": "Bin", "description": "Capture & inspect incoming requests (webhooks)." }, { "name": "Pipe", "description": "Stream bytes between two machines." }, { "name": "Secret", "description": "Burn-after-reading secrets." }, { "name": "Short", "description": "Ephemeral short links." }, { "name": "Network", "description": "Server-vantage inspection: IP, port, HTTP/TLS, DNS." }, { "name": "Scheduled", "description": "One-shot deferred HTTP callbacks." }, { "name": "Bus", "description": "Live pub/sub over Server-Sent Events." }, { "name": "Inbox", "description": "Disposable receive-only email." }, { "name": "Security", "description": "Out-of-band & client-side testing aids — authorized use only." }, { "name": "QR", "description": "QR code rendering." }, { "name": "Pro", "description": "Buy and use limit-raising passes." }, { "name": "Abuse", "description": "Report a link." } ], "security": [ {}, { "proPassBearer": [] }, { "proPassHeader": [] }, { "proPassQuery": [] } ], "components": { "securitySchemes": { "proPassBearer": { "type": "http", "scheme": "bearer", "description": "Pro pass as `Authorization: Bearer exlpro…`." }, "proPassHeader": { "type": "apiKey", "in": "header", "name": "X-Exl-Pass", "description": "Pro pass in the `X-Exl-Pass` header." }, "proPassQuery": { "type": "apiKey", "in": "query", "name": "pass", "description": "Pro pass as `?pass=exlpro…`." } }, "parameters": { "Format": { "name": "format", "in": "query", "required": false, "description": "Override content negotiation: `json` or `text`. Default follows the `Accept` header (text for `curl`).", "schema": { "type": "string", "enum": [ "json", "text" ] } } }, "schemas": { "UploadResult": { "type": "object", "required": [ "id", "url", "expiresAt", "filename", "size", "mime" ], "properties": { "id": { "type": "string" }, "url": { "type": "string", "format": "uri", "description": "The one-time download link (`/d/`)." }, "expiresAt": { "type": "integer", "description": "Unix epoch ms after which an unread file is purged." }, "filename": { "type": "string" }, "size": { "type": "integer" }, "mime": { "type": "string" } } }, "TunnelOpen": { "type": "object", "required": [ "id", "secret", "mode", "url", "expiresAt" ], "properties": { "id": { "type": "string" }, "secret": { "type": "string", "description": "Required to pull/respond. Never shared with visitors." }, "mode": { "type": "string", "enum": [ "sink", "forward" ] }, "url": { "type": "string", "format": "uri", "description": "Public ingress (`/t/`) to hand out." }, "expiresAt": { "type": "integer" }, "ttlMs": { "type": "integer" } } }, "TunnelRequestFrame": { "type": "object", "description": "One NDJSON line from the pull stream. Blank lines are heartbeats; the first frame is `{type:'ready',…}`.", "properties": { "reqId": { "type": "string" }, "method": { "type": "string" }, "path": { "type": "string" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "bodyB64": { "type": "string", "description": "Base64-encoded request body." } } }, "BinNew": { "type": "object", "required": [ "id", "secret", "captureUrl", "inspectUrl", "apiUrl", "expiresAt" ], "properties": { "id": { "type": "string" }, "secret": { "type": "string" }, "captureUrl": { "type": "string", "format": "uri", "description": "Send any request here (`/b/`) to capture it." }, "inspectUrl": { "type": "string", "format": "uri", "description": "Browser inspector (`/bin/#`)." }, "apiUrl": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" } } }, "BinCapture": { "type": "object", "properties": { "id": { "type": "string" }, "at": { "type": "integer", "description": "Unix epoch ms." }, "method": { "type": "string" }, "path": { "type": "string" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "bodyB64": { "type": "string" }, "size": { "type": "integer" }, "truncated": { "type": "boolean", "description": "True if the body exceeded 256 KB and was cut." }, "ip": { "type": "string" } } }, "BinState": { "type": "object", "properties": { "id": { "type": "string" }, "expiresAt": { "type": "integer" }, "response": { "type": [ "object", "null" ], "description": "The custom response, if one was configured." }, "captures": { "type": "array", "description": "Newest first, up to 50.", "items": { "$ref": "#/components/schemas/BinCapture" } } } }, "ShortLink": { "type": "object", "required": [ "id", "short", "target", "expiresAt", "maxClicks" ], "properties": { "id": { "type": "string" }, "short": { "type": "string", "format": "uri" }, "target": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" }, "maxClicks": { "type": "integer", "description": "0 = unlimited within the TTL." } } }, "XssNew": { "type": "object", "required": [ "id", "secret", "probeUrl", "captureUrl", "dashboardUrl", "apiUrl", "expiresAt" ], "properties": { "id": { "type": "string" }, "secret": { "type": "string" }, "probeUrl": { "type": "string", "format": "uri", "description": "The probe script (`/x/.js`)." }, "captureUrl": { "type": "string", "format": "uri", "description": "Where fires/beacons report (`/x/`)." }, "dashboardUrl": { "type": "string", "format": "uri" }, "apiUrl": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" }, "payloads": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Ready-made injection payloads (script/attribute/img/svg/href/beacon)." } } }, "XssFire": { "type": "object", "properties": { "id": { "type": "string" }, "at": { "type": "integer", "description": "Unix epoch ms." }, "ip": { "type": "string" }, "url": { "type": "string" }, "referrer": { "type": "string" }, "userAgent": { "type": "string" }, "origin": { "type": "string" }, "cookies": { "type": "string", "description": "Non-HttpOnly cookies of the page where it fired." }, "localStorage": { "type": "string" }, "sessionStorage": { "type": "string" }, "dom": { "type": "string", "description": "Truncated DOM snapshot." }, "truncated": { "type": "boolean" } } }, "XssState": { "type": "object", "properties": { "id": { "type": "string" }, "expiresAt": { "type": "integer" }, "count": { "type": "integer" }, "fires": { "type": "array", "description": "Newest first, up to 50.", "items": { "$ref": "#/components/schemas/XssFire" } } } }, "OastNew": { "type": "object", "required": [ "id", "secret", "callbackUrl", "dashboardUrl", "apiUrl", "expiresAt" ], "properties": { "id": { "type": "string" }, "secret": { "type": "string" }, "callbackUrl": { "type": "string", "format": "uri", "description": "Your OOB target (`/o/`; any subpath works)." }, "dashboardUrl": { "type": "string", "format": "uri" }, "apiUrl": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" } } }, "OastHit": { "type": "object", "properties": { "id": { "type": "string" }, "at": { "type": "integer", "description": "Unix epoch ms." }, "method": { "type": "string" }, "path": { "type": "string" }, "host": { "type": "string" }, "proto": { "type": "string" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "bodyB64": { "type": "string" }, "size": { "type": "integer" }, "ip": { "type": "string" } } }, "OastState": { "type": "object", "properties": { "id": { "type": "string" }, "expiresAt": { "type": "integer" }, "count": { "type": "integer" }, "hits": { "type": "array", "description": "Newest first, up to 100.", "items": { "$ref": "#/components/schemas/OastHit" } } } }, "HostResult": { "type": "object", "required": [ "id", "url", "contentType", "size", "expiresAt" ], "properties": { "id": { "type": "string" }, "url": { "type": "string", "format": "uri", "description": "Public payload URL (`/h/`)." }, "contentType": { "type": "string" }, "size": { "type": "integer" }, "expiresAt": { "type": "integer" } } }, "RedirLink": { "type": "object", "required": [ "id", "short", "target", "status", "hops", "expiresAt" ], "properties": { "id": { "type": "string" }, "short": { "type": "string", "format": "uri", "description": "Follow at `/g/`." }, "target": { "type": "string", "description": "Unvalidated; any scheme or host." }, "status": { "type": "integer", "enum": [ 301, 302, 303, 307, 308 ] }, "hops": { "type": "integer", "description": "Self-referential redirects through exl.ink before the target." }, "expiresAt": { "type": "integer" } } }, "IpInfo": { "type": "object", "properties": { "ip": { "type": "string" }, "reverseDns": { "type": [ "string", "null" ] }, "country": { "type": [ "string", "null" ] }, "scheme": { "type": "string" }, "userAgent": { "type": "string" }, "acceptLanguage": { "type": [ "string", "null" ] }, "forwardedFor": { "type": [ "string", "null" ] } } }, "PortResult": { "type": "object", "properties": { "ip": { "type": "string", "description": "Your connecting IP — the only address this can probe." }, "port": { "type": "integer" }, "state": { "type": "string", "enum": [ "open", "closed", "filtered", "unreachable" ] }, "latencyMs": { "type": [ "integer", "null" ] } } }, "CheckResult": { "type": "object", "description": "A reachable target returns `reachable:true` plus the probe fields below. If the target could not be reached (DNS failure, connection refused, timeout, TLS error, redirect loop) the check still succeeds with HTTP 200 and the body is `{ reachable:false, target, error }` — it is the target that is down, not this API.", "properties": { "reachable": { "type": "boolean", "description": "True when the target answered. When false, only `target` and `error` are present." }, "target": { "type": "string", "description": "The probed URL. Present only when `reachable` is false." }, "error": { "type": "string", "description": "Why the target was unreachable. Present only when `reachable` is false." }, "status": { "type": "integer" }, "statusText": { "type": "string" }, "finalUrl": { "type": "string", "format": "uri" }, "hops": { "type": "integer" }, "timingMs": { "type": "integer" }, "ip": { "type": [ "string", "null" ] }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "tls": { "type": [ "object", "null" ], "properties": { "issuer": { "type": [ "string", "null" ] }, "validTo": { "type": [ "string", "null" ] }, "daysRemaining": { "type": [ "integer", "null" ] }, "san": { "type": "array", "items": { "type": "string" } }, "trusted": { "type": "boolean" } } } } }, "DnsResult": { "type": "object", "description": "Standard record types. For `type=EMAIL` the body is instead `{mx, spf, dmarc, dkim}`.", "properties": { "name": { "type": "string" }, "type": { "type": "string" }, "agree": { "type": "boolean", "description": "True when all three resolvers returned the same records." }, "results": { "type": "array", "items": { "type": "object", "properties": { "resolver": { "type": "string" }, "records": { "type": "array", "items": { "type": "string" } }, "error": { "type": [ "string", "null" ] } } } } } }, "LaterJob": { "type": "object", "required": [ "id", "url", "method", "fireAt", "status", "statusUrl" ], "properties": { "id": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "method": { "type": "string" }, "createdAt": { "type": "integer" }, "fireAt": { "type": "integer", "description": "Unix epoch ms the request will be sent." }, "status": { "type": "string", "enum": [ "pending", "delivered", "failed", "canceled" ] }, "result": { "type": [ "object", "null" ] }, "statusUrl": { "type": "string", "format": "uri" } } }, "BusPublishResult": { "type": "object", "properties": { "channel": { "type": "string" }, "delivered": { "type": "integer", "description": "Active subscribers that received it." } } }, "InboxNew": { "type": "object", "required": [ "id", "address", "secret", "readUrl", "expiresAt" ], "properties": { "id": { "type": "string" }, "address": { "type": "string", "format": "email", "description": "The throwaway address to receive mail at." }, "secret": { "type": "string" }, "readUrl": { "type": "string", "format": "uri" }, "inspectUrl": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" } } }, "InboxMessages": { "type": "object", "properties": { "address": { "type": "string", "format": "email" }, "expiresAt": { "type": "integer" }, "count": { "type": "integer" }, "messages": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "from": { "type": "string" }, "subject": { "type": "string" }, "date": { "type": "string" }, "text": { "type": "string" }, "codes": { "type": "array", "items": { "type": "string" }, "description": "Best-effort one-time codes detected in the body; empty when none." }, "receivedAt": { "type": "integer" } } } } } } } }, "paths": { "/api/upload": { "post": { "tags": [ "File" ], "operationId": "upload", "summary": "Upload a file, get a one-time link", "description": "Stream the raw bytes as the body (preferred) or send `multipart/form-data` with a single `file` field. Served exactly once via the returned `url`, then deleted; purged after 6h if unread. Max 100 MB; 3 uploads per 12h per IP.", "parameters": [ { "name": "filename", "in": "query", "required": false, "description": "Stored filename for raw-body uploads.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } }, "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary" } } } } } }, "responses": { "200": { "description": "Stored.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UploadResult" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "413": { "description": "File too large or over capacity.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "507": { "description": "Storage full.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/d/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "File" ], "operationId": "download", "summary": "Download a file once (consumes it)", "description": "Streams the file with `Content-Disposition: attachment`, then deletes it. A second GET returns 404. Use HEAD to read metadata without consuming.", "responses": { "200": { "description": "The file bytes.", "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "head": { "tags": [ "File" ], "operationId": "downloadHead", "summary": "File metadata without consuming", "responses": { "200": { "description": "Headers only (size, type)." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/tunnel/open": { "get": { "tags": [ "Tunnel" ], "operationId": "tunnelOpen", "summary": "Open a reverse HTTP tunnel", "description": "Returns a public `url` (`/t/`) that relays HTTP to you. `sink` auto-replies 200 and streams requests; `forward` lets you answer. Max 2 concurrent/IP, 10 opens/h/IP, 30 minutes lifetime, 8 MB/request, 120 req/min.", "parameters": [ { "name": "mode", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "sink", "forward" ], "default": "forward" } } ], "responses": { "200": { "description": "Opened.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TunnelOpen" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/tunnel/pull": { "get": { "tags": [ "Tunnel" ], "operationId": "tunnelPull", "summary": "Stream requests hitting the tunnel (long-lived NDJSON)", "description": "Authenticated long-poll. Returns `application/x-ndjson`: one JSON request per line, blank lines as heartbeats, a `{type:'ready'}` first frame.", "parameters": [ { "name": "id", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "NDJSON stream.", "content": { "application/x-ndjson": { "schema": { "$ref": "#/components/schemas/TunnelRequestFrame" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/tunnel/res": { "post": { "tags": [ "Tunnel" ], "operationId": "tunnelRespond", "summary": "Answer a tunneled request (forward mode)", "parameters": [ { "name": "id", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "reqId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "integer" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "bodyB64": { "type": "string" } } } } } }, "responses": { "200": { "description": "Delivered.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "410": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/tunnel/client": { "get": { "tags": [ "Tunnel" ], "operationId": "tunnelClient", "summary": "Download the dependency-free Node forwarder", "description": "`curl -fsSL .../api/tunnel/client -o exlink.js && node exlink.js 3000` to expose localhost:3000.", "responses": { "200": { "description": "A standalone Node.js script.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/bin/new": { "get": { "tags": [ "Bin" ], "operationId": "binNew", "summary": "Create a request bin", "description": "Returns a public `captureUrl` that records every request (last 50, 6h TTL, 5/IP). CORS is wide open.", "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BinNew" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/b/{path}": { "parameters": [ { "name": "path", "in": "path", "required": true, "description": "`` plus any extra path you like.", "schema": { "type": "string" } } ], "post": { "tags": [ "Bin" ], "operationId": "binCapture", "summary": "Capture a request into a bin", "description": "Send ANY method/body here; it is recorded and a 200 (or your configured custom response) is returned. This is the public webhook target.", "responses": { "200": { "description": "Captured." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/bin/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Bin" ], "operationId": "binRead", "summary": "Read captured requests", "responses": { "200": { "description": "Captures.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BinState" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Bin" ], "operationId": "binSetResponse", "summary": "Configure a custom response for the bin", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "integer" }, "headers": { "type": "object", "additionalProperties": { "type": "string" } }, "body": { "type": "string" } } } } } }, "responses": { "200": { "description": "Set.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "413": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "delete": { "tags": [ "Bin" ], "operationId": "binClear", "summary": "Clear captures & custom response", "responses": { "200": { "description": "Cleared." }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/pipe/new": { "get": { "tags": [ "Pipe" ], "operationId": "pipeNew", "summary": "Suggest a pipe id", "description": "Returns `{id,url,read,write}` curl hints. Stream up to 1 GB between two machines (4 concurrent/IP). The id is created on first use; you may also pick your own.", "responses": { "200": { "description": "An id and ready-made commands.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "url": { "type": "string" }, "read": { "type": "string" }, "write": { "type": "string" } } } } } } } } }, "/p/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Pipe" ], "operationId": "pipeRead", "summary": "Read end of a pipe (blocks for a writer)", "description": "1:1 rendezvous. A second reader on a busy id gets 409; no counterpart within the rendezvous window gives 504.", "responses": { "200": { "description": "Streamed bytes.", "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "409": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "504": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "put": { "tags": [ "Pipe" ], "operationId": "pipeWrite", "summary": "Write end of a pipe", "requestBody": { "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "responses": { "200": { "description": "Sent." }, "409": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "504": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/secret": { "post": { "tags": [ "Secret" ], "operationId": "secretCreate", "summary": "Store a burn-after-reading secret (server-side)", "description": "Scriptable, NOT end-to-end encrypted (the browser tool at /secret is). Raw text body or `{\"text\":\"…\"}`, ≤ 256 KB, 30/h. Viewing `url` once consumes it.", "requestBody": { "required": true, "content": { "text/plain": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "object", "required": [ "text" ], "properties": { "text": { "type": "string" } } } } } }, "responses": { "200": { "description": "Stored.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "expiresAt": { "type": "integer" } } } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "413": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/short": { "get": { "tags": [ "Short" ], "operationId": "shortCreateGet", "summary": "Create a short link (query)", "description": "Targets must be `http(s)`. Expires after ≤ 24h or the click cap. 60/h per IP.", "parameters": [ { "name": "url", "in": "query", "required": true, "schema": { "type": "string", "format": "uri" } }, { "name": "max", "in": "query", "required": false, "description": "Click cap; 0/omitted = unlimited.", "schema": { "type": "integer" } }, { "name": "ttl", "in": "query", "required": false, "description": "Hours, clamped to [5m, 24h].", "schema": { "type": "number" } } ], "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShortLink" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Short" ], "operationId": "shortCreatePost", "summary": "Create a short link (JSON)", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": [ "url" ], "properties": { "url": { "type": "string", "format": "uri" }, "max": { "type": "integer" }, "ttl": { "type": "number" } } } } } }, "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShortLink" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/r/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Short" ], "operationId": "shortRedirect", "summary": "Follow a short link", "responses": { "302": { "description": "Redirect to the target." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/ip": { "get": { "tags": [ "Network" ], "operationId": "ipInfo", "summary": "What the internet sees about the caller", "parameters": [ { "$ref": "#/components/parameters/Format" } ], "responses": { "200": { "description": "Connection info.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpInfo" } }, "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/port": { "get": { "tags": [ "Network" ], "operationId": "portCheck", "summary": "Is a port open on YOUR public IP?", "description": "The server dials back to your connecting IP only — it cannot probe arbitrary hosts.", "parameters": [ { "name": "p", "in": "query", "required": true, "description": "Port 1–65535 (alias: `port`).", "schema": { "type": "integer", "minimum": 1, "maximum": 65535 } }, { "$ref": "#/components/parameters/Format" } ], "responses": { "200": { "description": "Probe result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PortResult" } }, "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/check": { "get": { "tags": [ "Network" ], "operationId": "checkUrl", "summary": "Fetch a URL from the outside (status, redirects, TLS)", "description": "Private/reserved/loopback targets are refused (no SSRF). Follows up to 5 redirects. A target that is down still returns HTTP 200 with `reachable:false` — only a malformed/disallowed request is a 4xx.", "parameters": [ { "name": "url", "in": "query", "required": true, "description": "Bare hosts default to https.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/Format" } ], "responses": { "200": { "description": "Check result: `reachable:true` with probe data, or `reachable:false` if the target was down.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CheckResult" } }, "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Network" ], "operationId": "checkUrlPost", "summary": "Fetch a URL from the outside (JSON body)", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": [ "url" ], "properties": { "url": { "type": "string" } } } } } }, "responses": { "200": { "description": "Check result: `reachable:true` with probe data, or `reachable:false` if the target was down.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CheckResult" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/dns": { "get": { "tags": [ "Network" ], "operationId": "dnsLookup", "summary": "Resolve across three resolvers, or audit email auth", "description": "Queries Cloudflare, Google, and Quad9 and reports whether they `agree` (propagation check). `type=EMAIL` returns an SPF/DMARC/DKIM/MX audit.", "parameters": [ { "name": "name", "in": "query", "required": true, "description": "Bare hostname (alias: `domain`).", "schema": { "type": "string" } }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "A", "AAAA", "MX", "NS", "TXT", "SOA", "CNAME", "SRV", "CAA", "EMAIL" ], "default": "A" } }, { "name": "selector", "in": "query", "required": false, "description": "DKIM selector for `type=EMAIL`.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/Format" } ], "responses": { "200": { "description": "Resolver results.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DnsResult" } }, "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/later": { "get": { "tags": [ "Scheduled" ], "operationId": "scheduleGet", "summary": "Schedule a one-shot callback (query)", "description": "The server fires one HTTP request to `url`, later. Best-effort & in-memory — keep the horizon short. Delay 5s–6h.", "parameters": [ { "name": "url", "in": "query", "required": true, "schema": { "type": "string", "format": "uri" } }, { "name": "in", "in": "query", "required": false, "description": "Relative delay, e.g. `30s`, `5m`, `2h`, `1d`.", "schema": { "type": "string" } }, { "name": "at", "in": "query", "required": false, "description": "Absolute time: epoch s/ms or ISO. Wins over `in`.", "schema": { "type": "string" } }, { "name": "method", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD" ], "default": "POST" } }, { "name": "body", "in": "query", "required": false, "description": "≤ 16 KB.", "schema": { "type": "string" } }, { "name": "contentType", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Scheduled.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LaterJob" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Scheduled" ], "operationId": "schedulePost", "summary": "Schedule a one-shot callback (JSON)", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": [ "url" ], "properties": { "url": { "type": "string", "format": "uri" }, "in": { "type": "string" }, "at": { "type": "string" }, "method": { "type": "string" }, "body": { "type": "string" }, "contentType": { "type": "string" } } } } } }, "responses": { "200": { "description": "Scheduled.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LaterJob" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/later/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Scheduled" ], "operationId": "scheduleStatus", "summary": "Poll a scheduled job", "responses": { "200": { "description": "Job.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LaterJob" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "delete": { "tags": [ "Scheduled" ], "operationId": "scheduleCancel", "summary": "Cancel a pending job", "responses": { "200": { "description": "Canceled.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LaterJob" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "409": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/bus/new": { "get": { "tags": [ "Bus" ], "operationId": "busNew", "summary": "Suggest a channel id", "responses": { "200": { "description": "An id + subscribe/publish URLs.", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "channel": { "type": "string" }, "subscribe": { "type": "string" }, "publish": { "type": "string" } } } } } } } } }, "/api/bus/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "description": "`[A-Za-z0-9_-]{3,64}`.", "schema": { "type": "string" } } ], "get": { "tags": [ "Bus" ], "operationId": "busSubscribe", "summary": "Subscribe to a channel (SSE)", "description": "Returns `text/event-stream`. The last few messages are replayed to a fresh subscriber; pass `Last-Event-ID`/`?lastId` to resume.", "parameters": [ { "name": "lastId", "in": "query", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "SSE stream.", "content": { "text/event-stream": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Bus" ], "operationId": "busPublish", "summary": "Publish to a channel", "requestBody": { "description": "Raw text, ≤ 16 KB.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "responses": { "200": { "description": "Delivered.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BusPublishResult" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "413": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/inbox/new": { "get": { "tags": [ "Inbox" ], "operationId": "inboxNew", "summary": "Create a disposable receive-only email address", "description": "Returns a throwaway `address`. In-memory & ephemeral. 503 if the instance hasn't configured the Email Worker.", "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InboxNew" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/inbox/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Inbox" ], "operationId": "inboxRead", "summary": "Read received messages", "parameters": [ { "name": "burn", "in": "query", "required": false, "description": "`1`/`true` deletes after reading.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Messages.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InboxMessages" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "delete": { "tags": [ "Inbox" ], "operationId": "inboxClear", "summary": "Clear all messages", "responses": { "200": { "description": "Cleared." }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/xss/new": { "get": { "tags": [ "Security" ], "operationId": "xssNew", "summary": "Create a blind-XSS probe", "description": "Returns ready-made payloads and a secret. Inject a payload; when it renders in any browser it reports the page, cookies, storage, and DOM back. Keeps the last 50 fires, 24h TTL, 5/IP. Authorized testing only.", "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/XssNew" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/x/{path}": { "parameters": [ { "name": "path", "in": "path", "required": true, "description": "`.js` for the probe script, or `` to report a fire.", "schema": { "type": "string" } } ], "get": { "tags": [ "Security" ], "operationId": "xssProbe", "summary": "Serve the probe script or accept a beacon fire", "description": "`/x/.js` returns the probe payload; `/x/` (GET with `?d=` or a POST body) records a fire and returns a pixel or `ok`. CORS is wide open.", "responses": { "200": { "description": "Probe script, 1×1 GIF, or ok." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Security" ], "operationId": "xssReport", "summary": "Report a fire (the probe posts here)", "responses": { "200": { "description": "Recorded." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/xss/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Security" ], "operationId": "xssRead", "summary": "Read captured fires", "responses": { "200": { "description": "Fires.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/XssState" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "delete": { "tags": [ "Security" ], "operationId": "xssClear", "summary": "Clear fires", "responses": { "200": { "description": "Cleared." }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/oast/new": { "get": { "tags": [ "Security" ], "operationId": "oastNew", "summary": "Create an out-of-band callback token", "description": "Returns a unique `callbackUrl`; every HTTP request to it is logged, to detect blind SSRF/RCE/SQLi. Keeps the last 100 hits, 24h TTL, 5/IP. HTTP only. Authorized testing only.", "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OastNew" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/o/{path}": { "parameters": [ { "name": "path", "in": "path", "required": true, "description": "`` plus any extra path.", "schema": { "type": "string" } } ], "post": { "tags": [ "Security" ], "operationId": "oastHit", "summary": "Trigger and log an OOB callback", "description": "Send ANY method here; the request is recorded and `ok` returned. This is the public OOB target.", "responses": { "200": { "description": "Logged." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/oast/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "secret", "in": "query", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Security" ], "operationId": "oastRead", "summary": "Read logged hits", "responses": { "200": { "description": "Hits.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OastState" } } } }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "delete": { "tags": [ "Security" ], "operationId": "oastClear", "summary": "Clear hits", "responses": { "200": { "description": "Cleared." }, "401": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/host": { "post": { "tags": [ "Security" ], "operationId": "hostCreate", "summary": "Host a payload blob", "description": "Send the bytes as the body (≤ 64 KB); `?type=` sets the served Content-Type (or `?name=` infers it). Served repeatedly at `/h/` with open CORS. 6h TTL, 10/IP. Authorized testing only.", "parameters": [ { "name": "type", "in": "query", "required": false, "description": "Served media type, e.g. `text/html`.", "schema": { "type": "string" } }, { "name": "name", "in": "query", "required": false, "description": "Filename to infer the type from.", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/octet-stream": { "schema": { "type": "string", "format": "binary" } } } }, "responses": { "200": { "description": "Hosted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostResult" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "413": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/h/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Security" ], "operationId": "hostServe", "summary": "Fetch a hosted payload", "description": "Served with its chosen Content-Type and open CORS; rate-limited per payload.", "responses": { "200": { "description": "The payload bytes (its chosen Content-Type)." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/redir": { "get": { "tags": [ "Security" ], "operationId": "redirCreateGet", "summary": "Create a redirector (query)", "description": "30x to any `url` — NOT validated (any scheme/internal IP allowed), with optional self-referential `hops` (0–10) for SSRF/open-redirect tests. 24h TTL. Authorized testing only.", "parameters": [ { "name": "url", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "status", "in": "query", "required": false, "schema": { "type": "integer", "enum": [ 301, 302, 303, 307, 308 ], "default": 302 } }, { "name": "hops", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 10 } } ], "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RedirLink" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } }, "post": { "tags": [ "Security" ], "operationId": "redirCreatePost", "summary": "Create a redirector (JSON)", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": [ "url" ], "properties": { "url": { "type": "string" }, "status": { "type": "integer" }, "hops": { "type": "integer" } } } } } }, "responses": { "200": { "description": "Created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RedirLink" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "503": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/g/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "get": { "tags": [ "Security" ], "operationId": "redirFollow", "summary": "Follow a redirector", "description": "`?h=` counts self-referential hops before the final (unvalidated) target. The status is whatever was configured (301/302/303/307/308).", "responses": { "302": { "description": "Redirect to the next hop or the target." }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/qr": { "get": { "tags": [ "QR" ], "operationId": "qrGenerate", "summary": "Render a QR code as SVG", "description": "Encodes `text` (≤ 1024 bytes) as an SVG QR code on the server (nothing stored). Add `?format=json` for `{ text, ecLevel, version, size, svg }`.", "parameters": [ { "name": "text", "in": "query", "required": true, "description": "The text/URL to encode (alias: `data`).", "schema": { "type": "string" } }, { "name": "ec", "in": "query", "required": false, "description": "Error-correction level.", "schema": { "type": "string", "enum": [ "L", "M", "Q", "H" ], "default": "M" } }, { "name": "scale", "in": "query", "required": false, "description": "Module size in px (1–40).", "schema": { "type": "integer" } }, { "name": "margin", "in": "query", "required": false, "description": "Quiet-zone modules (0–16).", "schema": { "type": "integer" } }, { "name": "dark", "in": "query", "required": false, "description": "Hex color of dark modules.", "schema": { "type": "string" } }, { "name": "light", "in": "query", "required": false, "description": "Hex color of the background.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/Format" } ], "responses": { "200": { "description": "QR code.", "content": { "image/svg+xml": { "schema": { "type": "string" } }, "application/json": { "schema": { "type": "object", "properties": { "text": { "type": "string" }, "ecLevel": { "type": "string" }, "version": { "type": "integer" }, "size": { "type": "integer" }, "svg": { "type": "string" } } } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/pro/info": { "get": { "tags": [ "Pro" ], "operationId": "proInfo", "summary": "List pass tiers & accepted coins", "description": "Passes are valid 30 days and multiply every per-window limit by the tier factor (3x / 6x / 12x / 30x).", "responses": { "200": { "description": "Tiers.", "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "days": { "type": "integer" }, "tiers": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "mult": { "type": "integer" }, "priceUsd": { "type": "number" } } } }, "coins": { "type": "array", "items": { "type": "string" } } } } } } } } } }, "/api/pro/checkout": { "get": { "tags": [ "Pro" ], "operationId": "proCheckout", "summary": "Start a crypto checkout for a pass", "parameters": [ { "name": "tier", "in": "query", "required": true, "schema": { "type": "string", "enum": [ "3x", "6x", "12x", "30x" ] } }, { "name": "coin", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Pay `amountCoin` to `address`, then poll with `ticket`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "address": { "type": "string" }, "amountCoin": { "type": "string" }, "amountUsd": { "type": "number" }, "coin": { "type": "string" }, "ticket": { "type": "string" }, "payExpiresAt": { "type": "integer" } } } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/pro/status": { "get": { "tags": [ "Pro" ], "operationId": "proStatus", "summary": "Poll a checkout until the pass is minted", "parameters": [ { "name": "ticket", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "`{paid:false,…}` until `{paid:true, pass:'exlpro…', days}`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "paid": { "type": "boolean" }, "received": { "type": "number" }, "needed": { "type": "number" }, "confirmations": { "type": "integer" }, "pass": { "type": "string" }, "days": { "type": "integer" } } } } } }, "404": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/api/report": { "post": { "tags": [ "Abuse" ], "operationId": "report", "summary": "Report an abusive link", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "idOrUrl", "reason" ], "properties": { "idOrUrl": { "type": "string" }, "reason": { "type": "string" }, "contact": { "type": "string" } } } } } }, "responses": { "200": { "description": "Received.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "400": { "description": "Error. Body is a short plain-text message.", "content": { "text/plain": { "schema": { "type": "string" } } } }, "429": { "description": "Rate limit exceeded. A `Retry-After` header (seconds) is included where applicable.", "content": { "text/plain": { "schema": { "type": "string" } } } } } } } } }