HTTP API

POST/api/secret

Store ciphertext. Returns the public id used to fetch it back.

Body {ct, iv, ttl, views} → {id}

• ct, iv: base64url, unpadded. Lengths and encoding are validated; the contents are never interpreted.
• ttl: seconds until it expires on its own, up to 7 days.
• views: how many reads it survives, 1 to 10.

Rate limited per IP.

GET/api/secret/{id}/meta

Expiry and remaining views, so a client can render a gate before committing to a read.

→ {expiresAt, views}

Does not burn.

GET/api/secret/{id}

Return the ciphertext and spend one view, in one atomic step. When the last view goes, the ciphertext is dropped on the spot.

→ {ct, iv}

Burns. There is no second call.

GET/api/secret/{id}/receipt

When the secret was opened, as a list of timestamps. Outlives the ciphertext: it keeps answering for the original lifetime, so a sender can still learn that a burned link was read.

→ {opens: [RFC3339, ...]}

Does not burn.

GET/api/stats

The aggregate counters behind /numbers: totals only, nothing per-secret and nothing per-person. Public so anyone can watch the same numbers we do.

→ {created, opened, burned, answered, sealed, ...}

Does not burn.

GET/healthz

Liveness, plus the deployment's own size ceiling so a client can refuse an oversized body before uploading it.

→ {ok, maxBytes}