{"version":3,"auth":{"cookie":"xsscool_owner — set on first write; httpOnly","bearer":"Authorization: Bearer <token> — same token, for CLIs and agents","token":{"get":"GET /api/token → { token }","mint":"POST /api/token → { token }"}},"errors":{"shape":{"error":"string","issues":"ZodIssue[] (400 only)","hint":"string (optional)"},"codes":{"400":"invalid body","403":"not the owner","404":"unknown id","409":"share cap reached","429":"rate limited"}},"endpoints":{"crafted":{"path":"GET / (or any path) with query params","params":{"status":"integer 200-599, default 200","statuscode":"alias of status","code":"alias of status","delay":"milliseconds 0-300000 before the response starts","chunks":"integer 1-64 — split the body into N pieces","chunkdelay":"milliseconds 0-60000 between pieces (needs chunks > 1)","redirect":"URL; sets Location header","redir":"alias of redirect","html":"string body, Content-Type: text/html","script":"string, wrapped in <script>, Content-Type: text/html","js":"string, Content-Type: application/javascript","text":"string, Content-Type: text/plain","json":"string, Content-Type: application/json","body":"string, fallback body","h[Name]":"header value (qs-nested); repeat for multiples; h[Content-Type] overrides the default","header[Name]":"alternate header form","headers[Name]":"alternate header form","dryrun":"1/true to return JSON describing the response instead of sending it (also on /s/:id)"},"bodyParamPrecedence":["html","script","js","text","json","body"],"dryrunResponse":{"status":"integer","headers":"object — { Name: value | value[] }","body":"string — what would be sent","contentType":"string — final Content-Type that would be set","delay":"integer — echoed but not applied in dryrun","chunks":"integer","chunkDelay":"integer","method":"string — request method"}},"shares":{"create":{"path":"POST /api/shares","body":{"state":"EditorState","name":"string ≤80 (optional)","ttlDays":"integer 1-365 | null (optional; null/omitted = never expires)"},"response":{"id":"string","name":"string|null — auto-derived from the body when omitted on create","preview":"string — first non-empty line of the body","status":"integer","createdAt":"epoch ms","updatedAt":"epoch ms","expiresAt":"epoch ms|null","submittedPayloadId":"string|null","owned":"boolean — whether the caller may PATCH/DELETE","replayUrl":"absolute URL — /s/:id on the host you called","editorUrl":"absolute URL — /e/:id","urls":"{ [domain]: { replay, editor } } for every served domain (omitted on non-public hosts)","curlExample":"string","jsExample":"string","state":"EditorState (present on create/get/patch, omitted in lists)"}},"list":{"path":"GET /api/shares/mine","response":{"shares":"Share[] (without state)"}},"get":{"path":"GET /api/shares/:id","response":{"id":"string","name":"string|null — auto-derived from the body when omitted on create","preview":"string — first non-empty line of the body","status":"integer","createdAt":"epoch ms","updatedAt":"epoch ms","expiresAt":"epoch ms|null","submittedPayloadId":"string|null","owned":"boolean — whether the caller may PATCH/DELETE","replayUrl":"absolute URL — /s/:id on the host you called","editorUrl":"absolute URL — /e/:id","urls":"{ [domain]: { replay, editor } } for every served domain (omitted on non-public hosts)","curlExample":"string","jsExample":"string","state":"EditorState (present on create/get/patch, omitted in lists)"},"note":"public read"},"update":{"path":"PATCH /api/shares/:id","body":{"state":"EditorState (optional)","name":"string|null (optional)","ttlDays":"integer|null (optional)","submittedPayloadId":"string|null (optional)"},"response":{"id":"string","name":"string|null — auto-derived from the body when omitted on create","preview":"string — first non-empty line of the body","status":"integer","createdAt":"epoch ms","updatedAt":"epoch ms","expiresAt":"epoch ms|null","submittedPayloadId":"string|null","owned":"boolean — whether the caller may PATCH/DELETE","replayUrl":"absolute URL — /s/:id on the host you called","editorUrl":"absolute URL — /e/:id","urls":"{ [domain]: { replay, editor } } for every served domain (omitted on non-public hosts)","curlExample":"string","jsExample":"string","state":"EditorState (present on create/get/patch, omitted in lists)"},"note":"owner only"},"delete":{"path":"DELETE /api/shares/:id","response":"204","note":"owner only"},"replay":"GET|HEAD|OPTIONS /s/:id — crafted response from the saved state; ?dryrun=1 supported","editor":"GET /e/:id — editor SPA pre-loaded with the state"},"editorState":{"path":"the `state` object of a share","schema":{"type":"object","required":["status","delay","payloadParam","editorLanguage","editorContent","headers"],"properties":{"status":{"type":"integer","minimum":200,"maximum":599},"delay":{"type":"integer","minimum":0,"maximum":300000},"payloadParam":{"enum":["html","script","js","json","text","body"]},"editorLanguage":{"enum":["html","javascript","json","plaintext"]},"editorContent":{"type":"string"},"headers":{"type":"array","items":{"type":"object","required":["id","name","value"],"properties":{"id":{"type":"string","description":"Any unique non-empty string (React key, not a server identifier)."},"name":{"type":"string"},"value":{"type":"string"}}}},"chunks":{"type":"integer","minimum":1,"maximum":64,"default":1},"chunkDelay":{"type":"integer","minimum":0,"maximum":60000,"default":0}}},"example":{"status":200,"delay":0,"payloadParam":"html","editorLanguage":"html","editorContent":"<h1>hi</h1>","headers":[{"id":"h1","name":"X-Demo","value":"true"}]}},"capture":{"create":{"path":"POST /api/captures","body":{"label":"string?"},"response":{"id":"string","label":"string|null","captureUrl":"absolute","streamUrl":"absolute","requestsUrl":"absolute","createdAt":"epoch ms","expiresAt":"epoch ms"}},"list":"GET /api/captures — { captures: [...] } (owner token)","delete":"DELETE /api/captures/:id — owner only","sink":"ANY /c/:id (and subpaths) — body capped at 1MB","stream":"GET /c/:id/stream — text/event-stream; supports Last-Event-ID","requests":"GET /api/captures/:id/requests?since=<id>&limit=<n> — { requests: [{ id, method, path, query, headers, body, bodyTruncated, sourceIp, receivedAt }] }"},"payloads":{"list":"GET /api/payloads — { payloads: [{ id, title, description, tags, status, alias, state }] }","submit":"POST /api/payloads — { title, description, tags?, alias?, state } → { id, status: \"pending\" } (5/hr/owner)","mine":"GET /api/payloads/mine"},"config":{"path":"GET /api/config","response":{"domains":"string[] — public hosts the deployment serves"}}},"cli":{"command":"xsscli","install":["curl -fsSL https://xss.cool/cli/install.sh | sh","npm i -g https://xss.cool/cli/xsscool-cli.tgz"],"files":{"info":"GET /cli","bundle":"GET /cli/xsscli.js","tarball":"GET /cli/xsscool-cli.tgz"},"env":{"XSSCOOL_HOST":"base URL (default https://xss.cool)","XSSCOOL_TOKEN":"owner token"}},"ttls":{"shares":"never, unless ttlDays is set","captures":"7 days","captureRequests":"7 days (deleted with their capture)"},"limits":{"shareCreatesPerMinutePerIp":60,"sharesPerOwner":500,"captureBodyBytes":1048576}}