API docs

zpe-paste API

mount /paste · base https://zpe.vc/paste · v1.0.0 · 6 operations · 3 write · 4 need no account · beta

versions 4.0.0 (current) 3.0.0 2.0.0 1.0.0

archived: committed 2026-10-25, from 810709d5. Contract: https://zpe.vc/paste/_/api/v1/openapi.json

GET /_/api/v1/me GET /_/api/v1/me getMe no account

GET /_/api/v1/me

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
200Who is asking, as the door sees them. A stranger is a 200 with `signedIn: false` and a sign-in URL, not a 401: the question has an answer whoever asks it.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
429Too many requestsobject

Example

GET /_/api/v1/me.

GET /_/api/v1/me
curl -X GET 'https://zpe.vc/paste/_/api/v1/me'
200 application/json
{
  "signedIn": false,
  "accountId": null,
  "rung": 0,
  "email": null,
  "tenant": null,
  "signin": null
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

POST /_/api/v1/paste POST /_/api/v1/paste postPaste

POST /_/api/v1/paste

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
201The paste was written. The id is the capability the link carries; the deletion token is answered once and never again.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
413The body is larger than this deployment accepts (`MAX_BODY_BYTES`, 4 MiB by default).object
415The body is not `application/json`, and this path reads nothing else.object
429Too many requestsobject

Example

POST /_/api/v1/paste, with a token from the door.

POST /_/api/v1/paste
curl -X POST 'https://zpe.vc/paste/_/api/v1/paste' \
  -H 'Authorization: Bearer $ZPE_TOKEN'
201 application/json
{
  "id": "string",
  "deletetoken": "string"
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

GET /_/api/v1/pastes GET /_/api/v1/pastes getPastes

GET /_/api/v1/pastes

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
200The pastes filed under the caller's account, newest first, each with the state it is in.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
429Too many requestsobject

Example

GET /_/api/v1/pastes, with a token from the door.

GET /_/api/v1/pastes
curl -X GET 'https://zpe.vc/paste/_/api/v1/pastes' \
  -H 'Authorization: Bearer $ZPE_TOKEN'
200 application/json
{
  "pastes": [
    {
      "id": "string",
      "burn": false,
      "created": 0,
      "expires": null,
      "consumedAt": null,
      "state": "live"
    }
  ]
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

GET /_/api/v1/paste/{id} GET /_/api/v1/paste/:id getPasteById no account

GET /_/api/v1/paste/:id

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
200The paste in the format its client wrote — or only its head when it is one-time, because an ambient GET (a prefetch, a link scanner) must not spend a paste it merely learned the id of.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
410A one-time paste whose id has already been read, or that has expired: the id is the capability, and it is spent. Nothing else will ever answer at this address.object
429Too many requestsobject

Example

GET /_/api/v1/paste/:id.

GET /_/api/v1/paste/{id}
curl -X GET 'https://zpe.vc/paste/_/api/v1/paste/{id}'
200 application/json
{
  "v": 0,
  "ct": "string",
  "wk": "string",
  "adata": {},
  "meta": {
    "expire": "string",
    "created": 0
  }
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

DELETE /_/api/v1/paste/{id} DELETE /_/api/v1/paste/:id deletePasteById no account

DELETE /_/api/v1/paste/:id

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
200The row is gone. The deletion token or the owner's session allowed it, and the answer names what it removed.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
429Too many requestsobject

Example

DELETE /_/api/v1/paste/:id.

DELETE /_/api/v1/paste/{id}
curl -X DELETE 'https://zpe.vc/paste/_/api/v1/paste/{id}'
200 application/json
{
  "status": "deleted",
  "id": "string"
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

POST /_/api/v1/paste/{id}/consume POST /_/api/v1/paste/:id/consume postPasteByIdConsume no account

POST /_/api/v1/paste/:id/consume

Parameters

No parameters.

Request body

None: this operation takes its arguments in the path and the query.

Responses

statusmeaningbody
200The ciphertext, to the one caller whose statement won the row. `X-Burn-Intent: consume` is required, so a cross-site page cannot burn a paste by linking to it.object
400The request could not be readobject
401The credential is missing or does not open this accountobject
403This account may not do thatobject
404Nothing is hereobject
410Someone else consumed it first, or it has expired. The row is gone and no second read exists.object
429Too many requestsobject

Example

POST /_/api/v1/paste/:id/consume.

POST /_/api/v1/paste/{id}/consume
curl -X POST 'https://zpe.vc/paste/_/api/v1/paste/{id}/consume'
200 application/json
{
  "v": 0,
  "ct": "string",
  "wk": "string",
  "adata": {},
  "meta": {
    "expire": "string",
    "created": 0
  }
}

The example is generated from the schema in the contract: the shape is the document's, the values are placeholders.

Check this page