SLIDINGBOX LLC

Developer documentation

Slidingbox exposes two focused API operations for short-lived, client-encrypted handoffs.

API base URL

https://slidingbox.ai

Store an encrypted item

POST /v1/dehydrate
Content-Type: application/json

{
  "ciphertext": "<base64url-encoded ciphertext>",
  "iv": "<base64url-encoded initialization vector>",
  "content_type": "application/octet-stream",
  "ttl_seconds": 300
}

The client performs client-side encryption before this request. Valid lifetimes range from 60 to 900 seconds. A successful request returns a pointer beginning with sb_.

Retrieve once

GET /v1/hydrate/:pointer

A successful request returns the stored ciphertext, initialization vector, and content type, then commits the one-time removal. Paid requests use the x402 payment challenge returned by the endpoint; eligible clients may instead use an issued evaluation key.

Operational behavior

  • Responses are marked Cache-Control: no-store.
  • API errors use a small JSON envelope with an error code.
  • The service deliberately does not accept browser cross-origin requests.
  • Items that expire, are already retrieved, or use an invalid pointer are unavailable.
Review the security modelAsk a developer question