back

API Reference

// every endpoint of the server, v0

~/serbekun/api $ man api --version 0
base url

no endpoints match the filter.

01 — general

All API responses are JSON unless stated otherwise. Errors use the shape {"error": "...", "message": "..."}, where message is omitted when absent. Auth is registered per endpoint but currently disabled for all of them — no Authorization header is required. Resource tokens (repository, short url, file) are separate from that and always required where listed.

get /api/v0/version

Returns the build version of the running server.

response 200
{
  "version": "1.4.0"
}
example
curl -s $BASE/api/v0/version
02 — cipher / aes

AES-GCM helpers. Keys and payloads travel as Base64 strings; the server never stores them.

get /api/v0/cipher/aes

Generates a fresh AES key. The key is returned once and never persisted.

response 200
{
  "key": "b64-encoded-aes-key"
}
statuses
200key generated 500key generation failed
example
curl -s $BASE/api/v0/cipher/aes
post /api/v0/cipher/aes/encrypt

Encrypts data with the given AES key.

body — application/json
fieldtypedescription
datastringrequiredplain text to encrypt
keystringrequiredBase64 AES key
response 200
{
  "data": "b64-cipher-text"
}
statuses
200encrypted 400data or key blank 500encryption failed
example
curl -s -X POST $BASE/api/v0/cipher/aes/encrypt \
  -H 'Content-Type: application/json' \
  -d '{"data":"hello","key":"<key>"}'
post /api/v0/cipher/aes/decrypt

Decrypts data produced by the encrypt endpoint using the same key.

body — application/json
fieldtypedescription
datastringrequiredBase64 cipher text
keystringrequiredthe same Base64 AES key
response 200
{
  "data": "hello"
}
statuses
200decrypted 400data or key blank 500wrong key or corrupted payload
example
curl -s -X POST $BASE/api/v0/cipher/aes/decrypt \
  -H 'Content-Type: application/json' \
  -d '{"data":"<cipher>","key":"<key>"}'
03 — short url

The delete token is returned only once, at creation time. Without it a short url cannot be removed.

post /api/v0/short-url

Creates a short url pointing at url.

body — application/json
fieldtypedescription
urlstringrequiredtarget url
namestringoptionalhuman readable label
descriptionstringoptionalfree form note
response 201
{
  "id": "aB3xY",
  "token": "8f14e45f-…"
}
statuses
201created 400url missing or invalid
example
curl -s -X POST $BASE/api/v0/short-url \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com"}'
get /api/v0/short-url/{id}

Resolves a short url and redirects to the target. This is the link you share.

path params
paramtypedescription
idstringrequiredshort id from creation
statuses
302redirect to target url 400id missing 404unknown id
example
curl -sI $BASE/api/v0/short-url/aB3xY
del /api/v0/short-url/{id}

Deletes a short url. The token may be passed as a query param or in the JSON body.

params
paramindescription
idpathrequiredshort id
tokenquery / bodyrequireddelete token from creation
statuses
204deleted 403token mismatch 404unknown id
example
curl -s -X DELETE "$BASE/api/v0/short-url/aB3xY?token=<token>"
05 — uploaded files

Files are stored with an optional TTL and are swept by a background cleanup task once expired. Every read and delete needs the token handed out at upload time.

post /api/v0/uploaded-files

Uploads a single file as multipart/form-data.

form fields
fieldtypedescription
filefilerequiredthe file itself; exactly one
namestringoptionaldisplay name, defaults to the original filename
ttlnumberoptionallifetime in seconds; 0 or absent means no expiry
response 201
{
  "uuid": "7c2d…-uuid",
  "token": "4e5f…-uuid",
  "name": "report.pdf",
  "expiredTime": 1785000000000
}
statuses
201uploaded 400no file in the request 413over the configured size limit 500failed to store the file
example
curl -s -X POST $BASE/api/v0/uploaded-files \
  -F '[email protected]' \
  -F 'name=report.pdf' \
  -F 'ttl=3600'
get /api/v0/uploaded-files/max-size

Returns the configured upload limit, so clients can reject oversized files before sending them.

response 200
{
  "megabytes": 100,
  "bytes": 104857600
}
example
curl -s $BASE/api/v0/uploaded-files/max-size
get /api/v0/uploaded-files/{uuid}

Metadata of one file. The token is never included in the response.

params
paramindescription
uuidpathrequiredfile uuid
tokenqueryrequiredfile access token
response 200
{
  "uuid": "7c2d…-uuid",
  "name": "report.pdf",
  "expiredTime": 1785000000000
}
statuses
200found 400malformed uuid 403invalid or missing token 404unknown or expired file
example
curl -s "$BASE/api/v0/uploaded-files/<uuid>?token=<token>"
get /api/v0/uploaded-files/{uuid}/download

Streams the file content as application/octet-stream with a Content-Disposition attachment header.

params
paramindescription
uuidpathrequiredfile uuid
tokenqueryrequiredfile access token
statuses
200file bytes 403invalid or missing token 404unknown, expired, or missing on disk 500read error
example
curl -sOJ "$BASE/api/v0/uploaded-files/<uuid>/download?token=<token>"
del /api/v0/uploaded-files/{uuid}

Deletes the file and its metadata. The token may be a query param or a JSON body field.

params
paramindescription
uuidpathrequiredfile uuid
tokenquery / bodyrequiredfile access token
statuses
204deleted 403token mismatch 404unknown file 500failed to delete from disk
example
curl -s -X DELETE "$BASE/api/v0/uploaded-files/<uuid>?token=<token>"
get /api/v0/uploaded-files

Listing every uploaded file is deliberately not allowed — the route exists but always refuses. Files are reachable only by uuid plus token.

response 403
{
  "error": "Listing all files is not allowed"
}
06 — youtube

Backed by yt-dlp on the server. Playlist parameters are ignored, age-restricted videos need server-side cookies, and each call is capped at a 120 second timeout.

get /api/v0/youtube/info

Returns the raw yt-dlp metadata JSON for a video.

query params
paramtypedescription
urlstringrequiredvideo url
statuses
200metadata json 400url missing or rejected 500yt-dlp failure
example
curl -s "$BASE/api/v0/youtube/info?url=https://youtu.be/<id>"
get /api/v0/youtube/download

Downloads the video on the server and returns the MP4 bytes (video/mp4).

query params
paramtypedescription
urlstringrequiredvideo url
statuses
200mp4 bytes 400url missing or rejected 500yt-dlp failure
example
curl -s -o video.mp4 "$BASE/api/v0/youtube/download?url=https://youtu.be/<id>"
07 — network
get /api/v0/network/ip

Returns the caller's ip as the server sees it. Behind a proxy the value comes from CF-Connecting-IP, then X-Forwarded-For, then the socket address — good enough to show users their own ip, not for auth or rate limiting.

response 200
{
  "ip": "203.0.113.7"
}
example
curl -s $BASE/api/v0/network/ip
08 — static

Classpath resources served straight from the jar. Every category behaves the same way: without a name it lists what is available, with a name it returns the file.

get /

The index page listing every service.

statuses
200html 404index resource missing
get /icon

The site favicon (ss_icon.svg).

get /static/v0/{category}

Lists the files available in a category.

categories
categorycontent
htmlservice pages
cssstylesheets
jsclient scripts
imagesraster images
svgvector images
jsonstatic datasets
pdfdocuments
domaindomain files
example
curl -s $BASE/static/v0/json
get /static/v0/{category}/{name}

Returns one static file with the content type of its category.

statuses
200file content 404no such resource
example
curl -s $BASE/static/v0/html/api_docs.html