API Sandbox

Explore, edit, and run requests against this Vernam Share instance.

Request builder

Choose an example, edit the request, then send it to the current origin. Requests run directly from this page.

Method

Path

Headers (JSON) Request body (JSON)

Heads up: a successful GET /api/messages/{id} consumes one view. The message is deleted when its configured view limit is reached. Use a test message and low-risk content.

Equivalent cURL

curl -i http://localhost:8080/healthz

Response

Status, elapsed time, headers, and response body from the last request.

Not sent—

Send a request to see the response here.

No response yet.

API reference

These endpoints are served by the current app. The sandbox does not add or modify API routes.

POST/api/messages

Creates a message using server-side encryption. The server receives plaintext and returns a secret key to the sender.

message — required, non-empty string
maxViews — optional integer, 1–1000; default 1

{
  "message": "secret text",
  "maxViews": 3
}

Success: 201 Created with id, key, expiresIn, and view counters.

POST/api/cipherxs

Stores cipherx produced by the browser. This endpoint accepts cipherx only; it does not receive plaintext or the one-time key.

cipherx — required, unpadded base64url string representing 1 byte to 1 MiB
maxViews — optional integer, 1–1000; default 1

{
  "cipherx": "c2FtcGxl",
  "maxViews": 3
}

Success: 201 Created with id, expiresIn, and view counters; no key is returned.

GET/api/messages/{id}

Retrieves cipherx and increments the view count. Decryption happens in the recipient's browser using the key in the URL fragment.

Success: 200 OK with cipherx, timestamps, maxViews, viewsUsed, and viewsRemaining. Missing, expired, or exhausted messages return 404.

GET/healthz

Simple health check.

{"status":"ok"}

Usage notes

All paths are relative to the current origin, so the sandbox works when hosted behind a reverse proxy or under a subpath.
For JSON requests, use Content-Type: application/json.
Message storage is in memory; restarting the service clears stored messages.
Message expiry defaults to 24 hours and can be changed with MESSAGE_TTL.
The cipherx endpoint is intended for cipherx generated with the matching key. Arbitrary sample cipherx can be stored but will not decrypt into meaningful text.
Use HTTPS for real secrets. Never paste a real one-time key into headers or request bodies.

Vernam Share · API Sandbox · Requests are sent only when you press Send request.

Request builder

Generate cipherx + key

Response