b0x.nz — URL Shortener

public No auth required owner Requires X-Owner-Hash + X-Fingerprint headers admin Requires Authorization: Bearer <ADMIN_KEY> ⏱ Public + owner endpoints: 25 req/hour · 100 req/day per IP · Admin endpoints: unlimited

POST /api/shorten public

Shorten a URL. Optionally set a custom slug, expiry, preview mode, and link ownership to your browser fingerprint.

curl -X POST https://YOURDOMAIN/api/shorten \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://example.com/long-path",
    "customSlug": "my-link",
    "expiryDays": 30,
    "preview": false
  }'

POST /api/shorten owner

Shorten and link to your browser. Include both owner headers so the link appears in My Links. Your hash is shown in the My Links tab after creating a first link via the UI.

curl -X POST https://YOURDOMAIN/api/shorten \
  -H 'Content-Type: application/json' \
  -H 'X-Fingerprint: "YOUR_RAW_FINGERPRINT"' \
  -H 'X-Owner-Hash: YOUR_OWNER_HASH' \
  -d '{
    "url": "https://example.com/long-path"
  }'

POST /api/lookup public

Retrieve metadata for a single slug. Returns destination URL, access count, expiry, and preview mode. Private fields (creator IP, UA, full access log) are only returned to the owner or admin.

curl -X POST https://YOURDOMAIN/api/lookup \
  -H 'Content-Type: application/json' \
  -d '{ "slug": "ab3x" }'

POST /api/lookup public

Batch lookup up to 50 slugs in a single request. Returns a results array and a notFound array for any slugs that don't exist.

curl -X POST https://YOURDOMAIN/api/lookup \
  -H 'Content-Type: application/json' \
  -d '{ "slugs": ["ab3x", "yz9q", "my-link"] }'

GET /api/mylinks owner

List all links owned by your browser. Returns slug, destination, access count, and a redacted access log (datetime, country, browser/OS — no IP addresses).

curl https://YOURDOMAIN/api/mylinks \
  -H 'X-Fingerprint: "YOUR_RAW_FINGERPRINT"' \
  -H 'X-Owner-Hash: YOUR_OWNER_HASH'

PATCH /api/mylinks owner

Toggle preview mode on one of your own links.

curl -X PATCH https://YOURDOMAIN/api/mylinks \
  -H 'Content-Type: application/json' \
  -H 'X-Fingerprint: "YOUR_RAW_FINGERPRINT"' \
  -H 'X-Owner-Hash: YOUR_OWNER_HASH' \
  -d '{ "slug": "ab3x", "previewMode": true }'

DELETE /api/mylinks owner

Delete one of your own links. You can only delete links you own.

curl -X DELETE https://YOURDOMAIN/api/mylinks \
  -H 'Content-Type: application/json' \
  -H 'X-Fingerprint: "YOUR_RAW_FINGERPRINT"' \
  -H 'X-Owner-Hash: YOUR_OWNER_HASH' \
  -d '{ "slug": "ab3x" }'

GET /api/admin admin

List all shortened links with full metadata including creator IP, full user-agent, and complete access logs.

curl https://YOURDOMAIN/api/admin \
  -H 'Authorization: Bearer YOUR_ADMIN_KEY'

DELETE /api/admin admin

Delete a single link by slug.

curl -X DELETE https://YOURDOMAIN/api/admin \
  -H 'Authorization: Bearer YOUR_ADMIN_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "slug": "ab3x" }'

DELETE /api/admin admin

Delete multiple links in a single request. Pass an array of slugs — all are validated first, then deleted in parallel. Maximum 500 slugs per call.

curl -X DELETE https://YOURDOMAIN/api/admin \
  -H 'Authorization: Bearer YOUR_ADMIN_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "slugs": ["ab3x", "yz9q", "my-link"] }'

DELETE /api/admin admin

⚠ Permanently purge every link in the database. Irreversible.

curl -X DELETE https://YOURDOMAIN/api/admin \
  -H 'Authorization: Bearer YOUR_ADMIN_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "purgeAll": true }'

Access Log