# ColdStorage REST API

Time-locked, encrypted text storage. No accounts, no API keys. Base URL: https://cold.weslie.tk

Store up to 5000 characters (UTF-8) and lock them for a chosen time. The returned `id` is the only
secret: it is both the retrieval key and the encryption key. The server stores only ciphertext and a hash
of the id. If the id is lost the text cannot be recovered. Until the lock expires, the text is NOT returned.
All time decisions use the SERVER clock. The maximum lock is 3650 days from now.

## Endpoints (JSON in, JSON out)

POST https://cold.weslie.tk/api/v1/notes
  Body: {"text": "...", "delay": "30d"}   (also: "delay_seconds": 2592000, or "unlock_at": 1893456000 / ISO-8601)
  "delay" format: <number><unit>, unit one of s, m, h, d, w, y (y = 365 days).
  201 -> {"id","url","created_at","unlock_at","server_time"}

GET https://cold.weslie.tk/api/v1/notes/{id}
  200 -> {"locked":false,"text":"...","unlock_at","created_at","server_time"}
  423 -> {"locked":true,"remaining_seconds","unlock_at","server_time"}  (+ Retry-After header; no text)
  404 -> unknown id

POST https://cold.weslie.tk/api/v1/notes/{id}/extend
  Body: {"add": "7d"}   (also: "add_seconds": 604800, or "unlock_at": <later time>)
  Only while still locked, and only to a LATER time. 200 -> {"locked":true,"unlock_at","remaining_seconds","server_time"}
  409 -> already unlocked, 422 -> not later / too long

GET https://cold.weslie.tk/api/v1            service info and limits
GET https://cold.weslie.tk/openapi.json      OpenAPI 3.1 description

Errors: {"error":{"code":"...","message":"..."}} with a matching HTTP status. 429 = rate limited (see Retry-After).
Human link for an id: https://cold.weslie.tk/?id={id}

## Example

curl -s -X POST https://cold.weslie.tk/api/v1/notes -H 'Content-Type: application/json' \
  -d '{"text":"my seed phrase","delay":"90d"}'
curl -s https://cold.weslie.tk/api/v1/notes/<id>
curl -s -X POST https://cold.weslie.tk/api/v1/notes/<id>/extend -H 'Content-Type: application/json' -d '{"add":"30d"}'