API docs

All error responses are JSON { "statusCode", "message" }. An invalid or unknown identifier responds 404.

Capture URL

Any method on https://<domaine>/h/:id and any sub-path. The request is stored, then the response is a 200 JSON:

{ "ok": true, "id": "…" }

The last 50 requests are kept per session.
1 MiB maximum per request, headers included: beyond that, 413and nothing is stored.
OPTIONS is stored and responds 204 with the CORS headers.
Received content is never returned.
Session erased 24 h after the last activity.

Sessions

Method	Route	Response	Limit
POST	/api/sessions	201 · SessionMeta	10 / min / IP
GET	/api/sessions/:id	200 · SessionMeta	300 / min / IP
DELETE	/api/sessions/:id	204	300 / min / IP
GET	/api/sessions/:id/requests	200 · { session, requests[] }	300 / min / IP
DELETE	/api/sessions/:id/requests	204	300 / min / IP
GET	/api/sessions/:id/stream	200 · text/event-stream	30 / min / IP
PUT	/api/sessions/:id/password	200 · cookie hs_<id>	300 / min / IP
DELETE	/api/sessions/:id/password	204	300 / min / IP
POST	/api/sessions/:id/unlock	200 · cookie hs_<id>	5 / min / IP · 20 / min / session

Password (optional)

A session can be protected by a password (8–128 characters). Only the browser that created it can set the first password (ownerToken returned only once by POST /api/sessions). A protected session responds 401 on read without an access cookie; POST …/unlock with { "password" } sets an HttpOnly cookie valid for 12 h, scoped to the session's path. The capture URL stays open: your webhooks don't need to change anything. The password is never stored, only a scrypt fingerprint in the encrypted marker.

SSE stream

Every message uses the event: field and a data: JSON. Events: ready, request, cleared, evicted, deleted, ping. A ping is sent every 15 s.

Rate limits

Responses carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. When a limit is reached, you get a 429 with Retry-After.

← Back to home