{"name":"slidingbox","summary":"Ephemeral, client-side-encrypted, hydrate-once blob relay. Pay per retrieval via x402; the server never sees plaintext or keys.","version":"1","payment":{"scheme":"x402","version":2,"payment_header":"PAYMENT-SIGNATURE","price":"$0.02","network":"eip155:8453","pay_to":"0xFB745C37586da6a02f96c19ef0124a38a36F1606","authorization":"EIP-3009 transferWithAuthorization signed as EIP-712 typed data: exact amount, exact recipient, validBefore window, single-use nonce. No token approval is requested or required.","screened_before_charge":"The payer address is screened against the OFAC SDN list before the pointer is reserved or settled. A listed payer is refused 403 payment_refused and is never charged.","single_settlement":"One pointer settles at most once. A concurrent paid request receives 409 in_progress rather than a second charge."},"free_tier":{"max_uses_per_key":20,"auth":"X-API-Key: sbk_<id>.<hmac>","mint":{"method":"POST","path":"/v1/key"}},"limits":{"max_ciphertext_bytes":131072},"mcp":{"package":"@slidingbox/hydrate-dehydrate-mcp","command":"npx -y @slidingbox/hydrate-dehydrate-mcp","transport":"stdio","tools":["store_secret","retrieve_secret","verify_endpoint"],"note":"Encrypts client-side; the decryption key never reaches this API. Local stdio only: there is deliberately no hosted instance, because a remote one would receive plaintext before it became ciphertext."},"links":{"docs":"https://slidingbox.ai/developers","pricing":"https://slidingbox.ai/pricing","llms_txt":"https://slidingbox.ai/llms.txt","openapi":"https://slidingbox.ai/openapi.json","x402":"https://slidingbox.ai/.well-known/x402","agent_card":"https://slidingbox.ai/.well-known/a2a/agent-card","compliance":"https://slidingbox.ai/.well-known/compliance.json","mcp":"https://www.npmjs.com/package/@slidingbox/hydrate-dehydrate-mcp","terms":"https://slidingbox.ai/terms","privacy":"https://slidingbox.ai/privacy","acceptable_use":"https://slidingbox.ai/acceptable-use","restricted_businesses":"https://slidingbox.ai/acceptable-use#s2","regulatory_status":"https://slidingbox.ai/compliance#regulatory-status","contact":"support@slidingbox.ai"},"endpoints":{"dehydrate":{"method":"POST","path":"/v1/dehydrate","paid":false,"description":"Store a client-encrypted blob and receive a one-shot pointer. Exactly the four documented keys are accepted; any extra key is rejected.","request":{"content_type":"application/json","schema":{"type":"object","additionalProperties":false,"required":["ciphertext","iv"],"properties":{"ciphertext":{"type":"string","format":"base64url","description":"Client-encrypted payload (e.g. AES-256-GCM). Decodes to at most 131072 bytes. The server never sees plaintext."},"iv":{"type":"string","format":"base64url","description":"AES-GCM initialization vector, decodes to exactly 12 bytes."},"content_type":{"type":"string","enum":["application/octet-stream","application/json","text/plain"],"default":"application/octet-stream","description":"Declared type of the plaintext, opaque to the server."},"ttl_seconds":{"type":"integer","minimum":60,"maximum":900,"default":900,"description":"How long the blob may sit unhydrated before it expires."}}},"example":{"ciphertext":"AbCdEfGhIjKlMnOp-_09","iv":"MTIzNDU2Nzg5MDEy","content_type":"application/octet-stream","ttl_seconds":900}},"response":{"status":201,"schema":{"type":"object","properties":{"pointer":{"type":"string","pattern":"^sb_[A-Za-z0-9_-]{43}$","description":"Opaque one-shot pointer returned by dehydrate."},"expires_at":{"type":"string","format":"date-time"},"ttl_seconds":{"type":"integer"}},"required":["pointer","expires_at","ttl_seconds"]},"example":{"pointer":"sb_a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V","expires_at":"2026-07-21T12:15:00.000Z","ttl_seconds":900}},"errors":{"400":"invalid_json | unknown_field | invalid ciphertext/iv/content_type/ttl_seconds","413":"payload_too_large","429":"rate_limited"}},"hydrate":{"method":"GET","path":"/v1/hydrate/:pointer","paid":true,"free_tier_header":"X-API-Key","description":"Pay per request (x402) to retrieve and permanently delete a one-shot encrypted blob by pointer. The pointer is invalidated the instant this call succeeds; a second hydrate against the same pointer always 404s, paid or not.","request":{"path_params":{"pointer":{"type":"string","pattern":"^sb_[A-Za-z0-9_-]{43}$","description":"Opaque one-shot pointer returned by dehydrate."}},"example":"/v1/hydrate/sb_a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V"},"response":{"status":200,"schema":{"type":"object","properties":{"ciphertext":{"type":"string","format":"base64url"},"iv":{"type":"string","format":"base64url"},"content_type":{"type":"string"}},"required":["ciphertext","iv","content_type"]},"example":{"ciphertext":"AbCdEfGhIjKlMnOp-_09","iv":"MTIzNDU2Nzg5MDEy","content_type":"application/octet-stream"}},"errors":{"400":"invalid_pointer","402":"payment required — x402 PAYMENT-REQUIRED header","404":"not_found (already hydrated or expired)","409":"in_progress (another paid request is settling this pointer)","429":"rate_limited"}},"verify":{"method":"GET","path":"/v1/verify","paid":true,"price":"$0.01","description":"Pre-flight an x402 endpoint before paying it: whether it is live and payable, whether its live price and payee still match the CDP Bazaar catalog, and when either last changed. Returns a bounded JSON verdict with reason codes.","request":{"query_params":{"resource":{"type":"string","format":"uri","description":"Absolute http(s) URL of the x402 resource to check. Percent-encode it as a query value."}},"example":"/v1/verify?resource=https%3A%2F%2Fapi.onesource.io%2Fapi%2Fchain%2Fblock-number"},"response":{"status":200,"schema":{"type":"object","required":["resource","payable","challenge_shape","reason_codes","checked_at"],"properties":{"resource":{"type":"string","format":"uri"},"payable":{"type":"boolean","description":"The endpoint answered 402 with terms a client can actually pay against."},"challenge_shape":{"type":"string","description":"PAYABLE | EMPTY_CHALLENGE | NO_TERMS | EMPTY_BODY | UNREACHABLE | HTTP <status>"},"http_status":{"type":["integer","null"]},"live":{"type":["object","null"],"description":"Base-USDC terms read from the live challenge.","properties":{"price_usd":{"type":"number"},"pay_to":{"type":"string"}}},"catalog":{"type":["object","null"],"description":"What the CDP Bazaar catalog last advertised. Null if the resource is not listed.","properties":{"price_usd":{"type":"number"},"pay_to":{"type":"string"},"method":{"type":"string"},"seen_at":{"type":"string","format":"date-time"}}},"price_matches_catalog":{"type":["boolean","null"]},"pay_to_matches_catalog":{"type":["boolean","null"]},"last_changed_at":{"type":["string","null"],"format":"date-time","description":"When this resource's catalog terms or observed behaviour last changed. Null if it has never been seen to change."},"reason_codes":{"type":"array","items":{"type":"string","enum":["not_in_catalog","template_url","unreachable","no_terms","not_402","price_drift","pay_to_drift"]}},"checked_at":{"type":"string","format":"date-time"}}},"example":{"resource":"https://api.onesource.io/api/chain/block-number","payable":true,"challenge_shape":"PAYABLE","http_status":402,"live":{"price_usd":0.02,"pay_to":"0xfb745c37586da6a02f96c19ef0124a38a36f1606"},"catalog":{"price_usd":0.02,"pay_to":"0xfb745c37586da6a02f96c19ef0124a38a36f1606","method":"GET","seen_at":"2026-09-08T06:15:00.000Z"},"price_matches_catalog":true,"pay_to_matches_catalog":true,"last_changed_at":null,"reason_codes":["template_url"],"checked_at":"2026-09-08T12:00:00.000Z"}},"note":"The catalog comparison is refreshed daily from the CDP Bazaar. A resource absent from the catalog is still probed and still answers; it carries reason code not_in_catalog.","errors":{"400":"invalid_resource | self_reference | invalid_payment_header","402":"payment required — x402 PAYMENT-REQUIRED header","403":"payment_refused (sanctions screen)","429":"rate_limited","503":"payment_unavailable"}}}}