{"openapi":"3.1.0","info":{"title":"Slidingbox","version":"1.0.0","description":"Ephemeral, client-side-encrypted, hydrate-once blob relay. Store ciphertext for free; pay per retrieval via x402. The server never sees plaintext or key material, and every blob is delivered exactly once.","contact":{"email":"support@slidingbox.ai","url":"https://slidingbox.ai/developers"},"termsOfService":"https://slidingbox.ai/terms"},"servers":[{"url":"https://slidingbox.ai"}],"paths":{"/v1/dehydrate":{"post":{"operationId":"dehydrate","summary":"Store a client-encrypted blob, receive a one-shot pointer.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["ciphertext","iv"],"properties":{"ciphertext":{"type":"string","format":"base64url","description":"Client-encrypted payload (e.g. AES-256-GCM). Decodes to at most 131072 bytes. The server never sees plaintext."},"iv":{"type":"string","format":"base64url","description":"AES-GCM initialization vector, decodes to exactly 12 bytes."},"content_type":{"type":"string","enum":["application/octet-stream","application/json","text/plain"],"default":"application/octet-stream","description":"Declared type of the plaintext, opaque to the server."},"ttl_seconds":{"type":"integer","minimum":60,"maximum":900,"default":900,"description":"How long the blob may sit unhydrated before it expires."}}},"example":{"ciphertext":"AbCdEfGhIjKlMnOp-_09","iv":"MTIzNDU2Nzg5MDEy","content_type":"application/octet-stream","ttl_seconds":900}}}},"responses":{"201":{"description":"Stored.","content":{"application/json":{"schema":{"type":"object","properties":{"pointer":{"type":"string","pattern":"^sb_[A-Za-z0-9_-]{43}$","description":"Opaque one-shot pointer returned by dehydrate."},"expires_at":{"type":"string","format":"date-time"},"ttl_seconds":{"type":"integer"}},"required":["pointer","expires_at","ttl_seconds"]}}}},"400":{"description":"invalid_json | unknown_field | invalid field"},"413":{"description":"payload_too_large"},"429":{"description":"rate_limited"}}}},"/v1/key":{"post":{"operationId":"mintEvaluationKey","summary":"Issue an evaluation key. No account, no approval step.","description":"Returns a key covering a fixed lifetime number of free retrievals. Send it as X-API-Key on hydrate to skip payment while allowance remains. Rate limited per IP.","responses":{"201":{"description":"Key issued.","content":{"application/json":{"schema":{"type":"object","required":["api_key","header","free_hydrates"],"properties":{"api_key":{"type":"string","pattern":"^sbk_"},"header":{"type":"string"},"free_hydrates":{"type":"integer"},"note":{"type":"string"}}}}}},"429":{"description":"rate_limited"},"503":{"description":"free_tier_unavailable"}}}},"/v1/hydrate/{pointer}":{"get":{"operationId":"hydrate","summary":"Pay, receive the blob once, and destroy it.","description":"Pay per request (x402) to retrieve and permanently delete a one-shot encrypted blob by pointer. The pointer is invalidated the instant this call succeeds; a second hydrate against the same pointer always 404s, paid or not.","parameters":[{"name":"pointer","in":"path","required":true,"schema":{"type":"string","pattern":"^sb_[A-Za-z0-9_-]{43}$","description":"Opaque one-shot pointer returned by dehydrate."}},{"name":"X-API-Key","in":"header","required":false,"schema":{"type":"string","pattern":"^sbk_"},"description":"Evaluation key from POST /v1/key. Skips payment while quota lasts."},{"name":"PAYMENT-SIGNATURE","in":"header","required":false,"schema":{"type":"string"},"description":"x402 v2 payment payload, base64 JSON. Obtained by signing the challenge returned with the 402."}],"responses":{"200":{"description":"Delivered. The pointer is deleted before this response is sent.","content":{"application/json":{"schema":{"type":"object","properties":{"ciphertext":{"type":"string","format":"base64url"},"iv":{"type":"string","format":"base64url"},"content_type":{"type":"string"}},"required":["ciphertext","iv","content_type"]}}}},"400":{"description":"invalid_pointer | invalid_payment_header"},"402":{"description":"Payment required. The PAYMENT-REQUIRED header carries the x402 v2 challenge."},"403":{"description":"payment_refused (sanctions screen)"},"404":{"description":"not_found (already hydrated, or expired)"},"409":{"description":"in_progress"},"429":{"description":"rate_limited"},"503":{"description":"payment_unavailable"}}}}}}