# hypertext.one

> A pastebin for HTML. You send an HTML document, you get back a URL that serves
> it as a real web page. There are no accounts and no API keys.

Every page is sanitized on the server and served with a Content-Security-Policy of
`default-src 'none'`, so pasted pages cannot run JavaScript, load remote scripts,
or be framed. Each page serves on its own subdomain so one page can never affect
another, or the main site.

## Limits

- HTML: 100KB maximum per page.
- Title: 200 characters maximum.
- Password: 256 characters maximum.
- Lifetime: 3 months maximum. Pages cannot be kept forever.
- View limit: 100000 maximum, optional.
- Rate limits, per IP address: 30 pages per 10 minutes, 15 deletes per 5 minutes,
  10 password attempts per 5 minutes per page.

## What survives sanitization

Kept: standard text and layout tags, headings, lists, tables, links, images,
audio, video, inline SVG, and `<style>` blocks with CSS.

Removed: `<script>`, `<iframe>`, event-handler attributes such as `onclick`,
and any URL scheme other than http, https, mailto, and data: URIs on images.

## Create a page

POST https://hypertext.one/api/pastes
Content-Type: application/json

Request fields:
- `html` (string, required) — the page body.
- `title` (string, optional) — the browser tab title.
- `password` (string, optional) — readers must enter it before the page renders.
- `expires` (string, optional) — one of `1h`, `1d`, `7d`, `30d`, `60d`, `90d`.
  Defaults to `30d`. There is no "forever" option.
- `maxViews` (integer, optional) — the page is deleted after this many views.

Response:
```json
{
  "slug": "a1b2c3d4",
  "url": "https://a1b2c3d4.hypertext.one/",
  "ownerToken": "48-hex-characters"
}
```

The `ownerToken` is returned once and never again. It is the only proof of
ownership; the server stores a SHA-256 hash of it. It is required to edit,
change the password, change the limits, or delete the page. The field is also
returned as `deleteToken` for older clients.

Example:
```
curl -X POST https://hypertext.one/api/pastes \
  -H 'Content-Type: application/json' \
  -d '{"html":"<h1>hello</h1>","title":"demo","expires":"7d"}'
```

## Read a page

- `https://<slug>.hypertext.one/` — the rendered page.
- `https://<slug>.hypertext.one/raw` — the stored HTML as `text/plain`.
- `https://hypertext.one/p/<slug>` — redirects (308) to the subdomain.

A password-protected page answers 401 with an unlock form. POST
`password=<value>` as form data to that same subdomain URL; a correct password
returns 303 and sets a cookie that unlocks both the page and its `/raw` view.

## Edit a page

PATCH https://hypertext.one/api/pastes/<slug>
x-owner-token: <the token from the create response>
Content-Type: application/json

Every field is optional; send only what changes.
- `html` (string) — replace the page body.
- `title` (string or null) — replace or clear the title.
- `password` (string or null) — set or rotate the password, or null to remove
  it. Rotating the password invalidates every unlock already granted.
- `expires` (string) — reset the countdown from now.
- `maxViews` (integer or null) — set or clear the view limit.

GET the same URL with the owner token to read back the current source, settings,
and view count.

## Delete a page

DELETE https://hypertext.one/api/pastes/<slug>
x-owner-token: <the token from the create response>

Returns `{"deleted":true}`, or 404 if the page is gone or the token is wrong.
Humans can do the same at https://hypertext.one/delete.

## Other endpoints

- `GET https://hypertext.one/api/health` — returns `{"ok":true}` when the
  database answers.
- `https://hypertext.one/legal` — what is stored, and how sealed records are
  released.

## Notes for agents

- No authentication exists. Anyone with a page URL can read it unless it has a
  password. Do not publish secrets.
- Pages are not indexed: every page sends `<meta name="robots" content="noindex">`.
- Views are counted, viewers are not. A view increments a counter and a
  timestamp. No IP address, client string, referrer, or per-view row is stored.
- Set `expires` and `maxViews` to the smallest values that fit the task.
- Keep the `ownerToken` if the page will ever need editing or deleting.
- Source: https://github.com/AbhinavMir/hypertextone