The openckey.org API.

POST /api/entries

Creates hosted text or a short query. Requires Content-Type: application/json and a Cloudflare Turnstile token issued for the action create_entry on openckey.org, so it is meant for the form on the home page. Creation is rate-limited.

{"kind":"text","body":"Hello","style":{"theme":"cream","font":"serif","size":"medium","width":"comfortable","align":"left"},"expiry":"7d","turnstileToken":"…"}

    {"kind":"sq","destination":"https://example.org/page","expiry":"7d","expiryBehavior":"root","turnstileToken":"…"}

• Omit style for literal text/plain output. Styles use fixed values only; no creator HTML or CSS runs.
• expiry is 1d, 7d, or 30d. Without it, a record lasts up to 24 months before retirement.
• Short query destinations must be public HTTPS URLs with a domain name. IP literals, local names, credentials, non-standard ports, internationalised hostnames, and openckey.org itself are rejected.
• expiryBehavior root (default) redirects to the same host’s home page after expiry; message shows “The creator of this link has revoked redirects”.

Returns 201 with {"kind","id","status","url","expiresAt"}. Text is active at once; a short query is pending until its safety scan clears.

GET /api/status/{kind}/{id}

Returns {"status","expiresAt","preserveUntil"}, where status is pending, active, blocked, expired, or retired.

GET /text/{id} and /sq/{id}

• /text/{id} serves the text as text/plain, or as a minimal reading page when the creator chose a design.
• /sq/{id} answers 302 to the destination once the Cloudflare URL Scanner report is clean, and 503 with Retry-After while the scan is pending.
• Revoked or blocked records return 410; retired records return 410 with “This record has been retired.”; unknown identifiers return 404.
• Identifiers are seven URL-safe Base64 characters, separate per route, and never reused. Records cannot be edited.

POST /api/reports

Reports a hosted text or short query for review. Use the report form, which supplies the Turnstile token (action report_entry).

{"kind":"sq","id":"Ab3_Xy7","reason":"phishing","details":"optional context","turnstileToken":"…"}

reason is one of phishing, malware, spam, illegal, or other. No IP address is stored with a report.

Telemetry

• POST /api/telemetry/v1/batch receives one aggregate batch (schema 1, at most 4,096 bytes) from an SDK. Replies 204 when accepted, 400 for an invalid batch, 413 if too large, and 429 when rate-limited.
• GET /api/telemetry/v1/summary?days=30 returns summed aggregates for the last 1 to 400 days, labelled as reported by SDKs with telemetry on.

See Telemetry for what a batch may contain.

GET /api/config

Returns the public Turnstile site key used by the site’s forms.

Administration

Revocation and preservation extension are admin-only endpoints that require a bearer token. Revocation never deletes or reassigns an identifier.