SecretPaste

API reference

Generated from the OpenAPI document the handlers are validated against.

  • GET /scim/v2/ServiceProviderConfig

    What this SCIM endpoint supports. Read by an identity provider before it provisions.

    200

  • GET /scim/v2/Users

    The members of the workspace the directory key belongs to, in SCIM's shape.

    200 401 403

  • POST /scim/v2/Users

    Provision a member. Grants a seat and an audit trail, never access to a secret.

    201 401 403 409

  • DELETE /scim/v2/Users/{id}

    Deprovision a member. The account remains; the membership does not.

    204 401 403 404

  • GET /scim/v2/Users/{id}

    One provisioned member.

    200 401 403 404

  • PATCH /scim/v2/Users/{id}

    Activate or deactivate a member. Deactivating removes the membership and frees the seat.

    200 401 403 404

  • GET /v1/api-keys

    The caller's API keys: names, prefixes and when each was last used.

    200 401

  • POST /v1/api-keys

    Create an API key. The key itself is returned once and stored only as a hash.

    201 401 403

  • DELETE /v1/api-keys/{id}

    Revoke an API key. It stops working on the next request.

    200 401 404

  • POST /v1/auth/adopt-secrets

    Attach secrets created anonymously in this browser to the signed-in account.

    200 401 429

  • GET /v1/auth/jwks

    The public keys access tokens are signed with.

    200

  • POST /v1/auth/logout

    Revoke this device's session.

    200

  • POST /v1/auth/logout-all

    Revoke every session for the signed-in user.

    200 401

  • POST /v1/auth/otp/resend

    Send the code again, subject to its own cooldown.

    200 429

  • POST /v1/auth/otp/start

    Send a sign-in code. The response is identical for known and unknown addresses.

    200 429

  • POST /v1/auth/otp/verify

    Exchange a code for a session; creates the account on first sign-in.

    200 401 403 429

  • POST /v1/auth/refresh

    Rotate the refresh token and issue a new access token.

    200 401

  • GET /v1/auth/sessions

    The signed-in user's devices.

    200 401

  • POST /v1/auth/tos

    Record acceptance of a terms version.

    200 401

  • POST /v1/billing/checkout

    Start a Checkout session for a plan. The caller is checked against the target it names.

    201 400 401 403 409 429

  • POST /v1/billing/enterprise-inquiry

    An enterprise sales enquiry. Creates no Stripe object; it opens a conversation.

    202 400 429

  • GET /v1/billing/invoices

    Invoices for the caller's customer, newest first, for the billing screen.

    200 401 404

  • POST /v1/billing/portal

    A Customer Portal link for the caller's own customer record.

    201 401 403 404

  • PATCH /v1/billing/seats

    Change a Team subscription's seat count, prorated. Never below the member count.

    200 400 401 403 404

  • GET /v1/billing/subscription

    The caller's subscription, the tier it resolves to, and this period's usage.

    200 401

  • POST /v1/billing/webhook

    Stripe delivers subscription and invoice events here. Signature verified on the raw body.

    200 400

  • POST /v1/cli/install

    Count a CLI install. Called by the install script and the package managers, never by the binary.

    202 429

  • POST /v1/curl

    Create a server-encrypted secret from a raw body (curl mode).

    200 413 429

  • GET /v1/domains

    The workspace's domains and where each one is in verification.

    200 401 404

  • POST /v1/domains

    Claim a hostname for a workspace's links. Verification is a TXT record you publish.

    201 401 403 404 409

  • DELETE /v1/domains/{id}

    Stop serving links on a hostname. Links already sent on it stop resolving.

    200 401 403 404

  • POST /v1/domains/{id}/verify

    Check the TXT record now. Safe to repeat; DNS takes as long as it takes.

    200 401 403 404

  • POST /v1/events

    Record a product event from an authenticated surface.

    202 400 401

  • POST /v1/feedback/reveal

    Thumbs up or down from a reveal page. Carries no identifier of any kind.

    202 429

  • POST /v1/files/multipart

    Open a presigned multipart upload. File bytes never pass through the API.

    200 403 429

  • POST /v1/files/multipart/abort

    Abort a multipart upload and delete its parts.

    200 404

  • POST /v1/files/multipart/complete

    Complete a multipart upload and activate the secret.

    200 409 413

  • GET /v1/flags

    Feature flags for the caller's context, as booleans.

    200

  • GET /v1/regions

    Which region this API serves, and where the others are. No authentication needed.

    200

  • POST /v1/reports

    Report a secret for abuse.

    202 429

  • GET /v1/requests

    The caller's request links and how many responses each has.

    200 401

  • POST /v1/requests

    Publish a request link. The server stores the public key and never the private one.

    201 401 403

  • DELETE /v1/requests/{id}

    Close a request link. Responses already received stay readable.

    200 401 404

  • GET /v1/requests/{id}

    What a responder's page needs: the public key, the prompt, and whether it is still open.

    200 404 410

  • GET /v1/requests/{id}/inbox

    The requester's inbox: each response and the wrapped key only they can open.

    200 401 404

  • POST /v1/requests/{id}/responses

    Attach a secret to a request, with its content key wrapped to the requester's key.

    201 404 409 410 429

  • GET /v1/secrets

    The owner's own secrets. Metadata only; no payload is ever returned here.

    200 401

  • POST /v1/secrets

    Create a secret. The server receives ciphertext and public parameters only.

    201 400 403 429

  • DELETE /v1/secrets/{id}

    Revoke a secret with its delete token or as its owner.

    204 403 404

  • GET /v1/secrets/{id}

    Read a secret's metadata. Performs no claim and is never cached.

    200 404

  • POST /v1/secrets/{id}/claim

    Consume exactly one view and return the payload.

    200 401 403 404 410 423 425 429

  • POST /v1/secrets/{id}/gate/start

    Send a code to an address, so a restricted recipient can prove it is theirs.

    200 404 429

  • POST /v1/secrets/{id}/gate/verify

    Exchange the emailed code for a short session bound to this secret and address.

    200 401 404 429

  • GET /v1/secrets/{id}/receipts

    Receipts for one secret. Free sees the time and channel; Pro sees location and device.

    200 401 403 404

  • DELETE /v1/secrets/{id}/recipients/{recipientId}

    Revoke one per-recipient link. The other links and the secret itself keep working.

    200 401 404

  • GET /v1/slack/callback

    Slack's install callback. Stores a bot token for one team, sealed at rest.

    200 401 403

  • POST /v1/slack/commands

    The /secret slash command. Answers with a composer link; composes nothing itself.

    200 403

  • POST /v1/slack/subscribe

    Remember which Slack user to tell when a secret is opened. Carries no link.

    200 400 403 404

  • GET /v1/usage

    What this account is holding right now: live secrets, bytes stored, calls this month.

    200 401

  • GET /v1/usage/history

    The daily usage series behind the meters, from the hourly rollup.

    200 401

  • GET /v1/webhooks

    The caller's endpoints, with the consecutive-failure count for each.

    200 401

  • POST /v1/webhooks

    Register an endpoint for secret lifecycle events. The signing secret is shown once.

    201 400 401 403

  • DELETE /v1/webhooks/{id}

    Remove an endpoint. Deliveries already queued for it stop.

    200 401 404

  • GET /v1/webhooks/{id}/deliveries

    The delivery log for one endpoint: what was sent, how it went, how many attempts.

    200 401 404

  • POST /v1/webhooks/{id}/test

    Send a signed test delivery, so an endpoint can be verified before a secret depends on it.

    202 401 404

  • GET /v1/workspaces

    The workspaces the caller belongs to, and the role they hold in each.

    200 401

  • POST /v1/workspaces

    Make a workspace. Membership decides who is billed and audited, never who can read.

    201 401 409 421

  • GET /v1/workspaces/{id}/audit

    The workspace's own history: who changed what, and why.

    200 401 404

  • GET /v1/workspaces/{id}/audit/export

    The same rows as a CSV or JSON file.

    200 401 404

  • PUT /v1/workspaces/{id}/branding

    The name, logo and accent a Team's reveal page carries. Display only.

    200 401 403 404

  • POST /v1/workspaces/{id}/invitations

    Invite an address to a workspace, inside the seats it has paid for.

    201 401 403 404

  • GET /v1/workspaces/{id}/members

    Members and outstanding invitations. Membership required; a stranger gets a 404.

    200 401 404

  • DELETE /v1/workspaces/{id}/members/{userId}

    Remove a member. Their own secrets are untouched.

    200 401 403 404 409

  • PATCH /v1/workspaces/{id}/members/{userId}

    Change a member's role. Owners only, and never the last owner.

    200 401 403 404 409

  • PUT /v1/workspaces/{id}/policy

    What every secret sent inside this workspace has to satisfy.

    200 401 403 404

  • PUT /v1/workspaces/{id}/sso

    Name the directory a workspace trusts and the email domain it speaks for.

    200 401 403 404 409

  • POST /v1/workspaces/{id}/transfer

    Hand a workspace over. The previous owner stays as an admin.

    200 401 403 404

  • POST /v1/workspaces/invitations/accept

    Turn an emailed invitation token into a seat.

    200 401 403 404 410

  • GET /v1/workspaces/sso/discover

    Which directory an address should sign in through, if any. Public by necessity.

    200 400