{"openapi":"3.1.0","info":{"title":"swx.sh API","version":"1.0.0","description":"Short-lived file and text sharing. Links expire, can carry a password, can burn after one view, and can self-destruct after wrong passwords."},"servers":[{"url":"https://swx.sh"}],"paths":{"/api/v1/up":{"post":{"summary":"Create a share","description":"Multipart (fields: f or text, expiry in minutes 1 to 60, pw, burn, destroy_fails, vault) or a raw body with metadata headers (x-filename, x-expiry, x-password, x-burn, x-destroy-after-fails, x-webhook-url). Anonymous callers need a Turnstile token; Bearer token callers skip it and get higher limits.","security":[{},{"bearer":[]}],"responses":{"200":{"description":"Share created","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"url":{"type":"string"},"deleteToken":{"type":"string"},"expiresAt":{"type":"integer"},"burn":{"type":"boolean"},"passwordProtected":{"type":"boolean"},"selfDestructAfterFails":{"type":["integer","null"]}}}}}},"4XX":{"$ref":"#/components/responses/Error"}}}},"/f/{id}":{"get":{"summary":"Fetch a share's bytes","description":"Browsers get an HTML page; every other client gets the bytes. Password goes in the x-pw header. Fetching a burn share consumes it.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"x-pw","in":"header","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"The file"},"401":{"description":"Password required or wrong"},"410":{"description":"Expired, viewed, or destroyed"}}}},"/api/v1/shares/{id}":{"get":{"summary":"Share metadata","description":"Existence and settings only. Never the content, never the filename.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Metadata"},"404":{"$ref":"#/components/responses/Error"},"410":{"$ref":"#/components/responses/Error"}}},"delete":{"summary":"Delete a share early","description":"Authorize with the x-delete-token returned at upload, or the Bearer upload token.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"x-delete-token","in":"header","required":false,"schema":{"type":"string"}}],"security":[{},{"bearer":[]}],"responses":{"200":{"description":"Deleted"},"403":{"$ref":"#/components/responses/Error"},"404":{"$ref":"#/components/responses/Error"}}}}},"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer"}},"responses":{"Error":{"description":"Error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}}}}}}}}}}}