{"openapi":"3.1.0","info":{"title":"Drop2p API","version":"1.0.0","description":"Programmatic access to your Drop2p account. Transfers happen peer-to-peer (DSTP/1) — there is no file-upload endpoint by design. Authenticate with an API key created in your account (Ultimate plan).","contact":{"name":"Drop2p","url":"https://drop2p.com/developers"}},"servers":[{"url":"https://api.drop2p.com/v1","description":"Production"}],"security":[{"apiKey":[]}],"tags":[{"name":"Account","description":"Your account and plan"},{"name":"History","description":"Transfer history (metadata only)"},{"name":"Keys","description":"API key management (account JWT only)"},{"name":"Webhooks","description":"Register endpoints to receive signed `transfer.*` events. Each delivery carries a `Drop2p-Signature: t=<unix>,v1=<hex>` header — `v1` is HMAC-SHA256 over `\"<t>.<rawBody>\"` keyed by the endpoint secret. Management is account-JWT only. Payloads are metadata only — never filenames or contents."}],"paths":{"/me":{"get":{"tags":["Account"],"summary":"Get the authenticated account","operationId":"getMe","responses":{"200":{"description":"Account and plan","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Account"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/history":{"get":{"tags":["History"],"summary":"List recent transfers (metadata only — never filenames or contents)","operationId":"listHistory","responses":{"200":{"description":"Recent transfers (most recent first, up to 100)","content":{"application/json":{"schema":{"type":"object","properties":{"transfers":{"type":"array","items":{"$ref":"#/components/schemas/Transfer"}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/keys":{"get":{"tags":["Keys"],"summary":"List API keys","description":"Requires the account JWT — an API key cannot list or manage keys.","operationId":"listKeys","responses":{"200":{"description":"Your keys","content":{"application/json":{"schema":{"type":"object","properties":{"keys":{"type":"array","items":{"$ref":"#/components/schemas/ApiKey"}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}},"post":{"tags":["Keys"],"summary":"Create an API key (Ultimate plan)","description":"The plaintext key is returned exactly once and stored only as a hash.","operationId":"createKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","maxLength":80}}}}}},"responses":{"201":{"description":"Created — `key` is shown only here","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiKey"},{"type":"object","properties":{"key":{"type":"string","example":"d2p_…"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"description":"Not on the Ultimate plan"}}}},"/keys/{id}":{"delete":{"tags":["Keys"],"summary":"Revoke (then delete) an API key","description":"First call revokes the key; a second call removes the row.","operationId":"deleteKey","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"Revoked or deleted"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"description":"No such key"}}}},"/webhooks":{"get":{"tags":["Webhooks"],"summary":"List webhook endpoints","description":"Requires the account JWT. Secrets are masked — the full value is shown only at creation.","operationId":"listWebhooks","responses":{"200":{"description":"Your webhook endpoints","content":{"application/json":{"schema":{"type":"object","properties":{"webhooks":{"type":"array","items":{"$ref":"#/components/schemas/WebhookEndpoint"}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}},"post":{"tags":["Webhooks"],"summary":"Register a webhook endpoint (Ultimate plan)","description":"The signing `secret` is returned exactly once. Use it to verify the `Drop2p-Signature` header on each delivery. `url` must be https in production.","operationId":"createWebhook","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri","example":"https://example.com/hooks/drop2p"}}}}}},"responses":{"201":{"description":"Created — `secret` is shown only here","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/WebhookEndpoint"},{"type":"object","properties":{"secret":{"type":"string","example":"whsec_…"}}}]}}}},"400":{"description":"Missing or invalid `url`"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"description":"Not on the Ultimate plan"}}}},"/webhooks/{id}":{"delete":{"tags":["Webhooks"],"summary":"Delete a webhook endpoint","operationId":"deleteWebhook","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"Deleted"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"description":"No such webhook"}}}}},"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","description":"An API key created in your account, sent as `Authorization: Bearer d2p_…`."}},"responses":{"Unauthorized":{"description":"Missing or invalid credentials"},"RateLimited":{"description":"Too many requests — see the `RateLimit-*` response headers"}},"schemas":{"Account":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"email":{"type":"string","format":"email"},"plan":{"type":"string","enum":["free","pro","ultimate"]},"role":{"type":"string","enum":["user","admin"]},"emailVerified":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"}}},"Transfer":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"direction":{"type":"string","enum":["sent","received"]},"sizeBytes":{"type":"integer"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}}},"ApiKey":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"},"prefix":{"type":"string","example":"d2p_AbC123"},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"revokedAt":{"type":"string","format":"date-time","nullable":true}}},"WebhookEndpoint":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"url":{"type":"string","format":"uri"},"secret":{"type":"string","description":"Masked in lists (`whsec_…abcd`); full value only at creation."},"createdAt":{"type":"string","format":"date-time"},"lastDeliveryAt":{"type":"string","format":"date-time","nullable":true},"lastError":{"type":"string","nullable":true,"description":"Last delivery error, or null if the last delivery succeeded."}}},"WebhookEvent":{"type":"object","description":"The signed JSON body POSTed to your endpoint. Verify the `Drop2p-Signature` header before trusting it.","properties":{"id":{"type":"string","example":"evt_9f8e…"},"type":{"type":"string","enum":["transfer.completed","transfer.failed"]},"created":{"type":"integer","description":"Unix seconds"},"data":{"$ref":"#/components/schemas/Transfer"}}}}}}