{
  "openapi": "3.0.3",
  "info": {
    "title": "deny.sh API",
    "version": "0.2.0",
    "description": "Deniable encryption API. Encrypt, decrypt, create deniable control files, manage vault.",
    "contact": { "email": "hello@deny.sh" },
    "license": { "name": "AGPL-3.0", "url": "https://www.gnu.org/licenses/agpl-3.0.html" }
  },
  "servers": [{ "url": "https://deny.sh/api" }],
  "security": [{ "bearerAuth": [] }],
  "components": {
    "securitySchemes": {
      "bearerAuth": { "type": "http", "scheme": "bearer", "description": "API key from /api/register" }
    }
  },
  "paths": {
    "/register": {
      "post": {
        "summary": "Register for an API key",
        "security": [],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["email"], "properties": { "email": { "type": "string" }, "name": { "type": "string" } } } } }
        },
        "responses": {
          "201": { "description": "API key created" },
          "409": { "description": "Email already registered" }
        }
      }
    },
    "/health": {
      "get": {
        "summary": "Service health check",
        "security": [],
        "responses": { "200": { "description": "OK" } }
      }
    },
    "/usage": {
      "get": {
        "summary": "Check your usage stats",
        "responses": { "200": { "description": "Usage stats" } }
      }
    },
    "/encrypt": {
      "post": {
        "summary": "Encrypt a message",
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["message", "password1", "password2"], "properties": { "message": { "type": "string" }, "password1": { "type": "string" }, "password2": { "type": "string" }, "controlDataHex": { "type": "string" } } } } }
        },
        "responses": { "200": { "description": "Encrypted ciphertext + control data (hex)" } }
      }
    },
    "/decrypt": {
      "post": {
        "summary": "Decrypt a message",
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["ciphertextHex", "password1", "password2", "controlDataHex"], "properties": { "ciphertextHex": { "type": "string" }, "password1": { "type": "string" }, "password2": { "type": "string" }, "controlDataHex": { "type": "string" } } } } }
        },
        "responses": { "200": { "description": "Decrypted message" } }
      }
    },
    "/deny": {
      "post": {
        "summary": "Generate deniable control data (paid)",
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["ciphertextHex", "password1", "password2", "fakeMessage"], "properties": { "ciphertextHex": { "type": "string" }, "password1": { "type": "string" }, "password2": { "type": "string" }, "fakeMessage": { "type": "string" } } } } }
        },
        "responses": {
          "200": { "description": "New control data (hex)" },
          "403": { "description": "Requires paid plan" }
        }
      }
    },
    "/vault/store": {
      "post": {
        "summary": "Store encrypted control file (paid)",
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["encryptedData", "iv", "salt"], "properties": { "label": { "type": "string" }, "encryptedData": { "type": "string" }, "iv": { "type": "string" }, "salt": { "type": "string" } } } } }
        },
        "responses": {
          "201": { "description": "Item stored" },
          "403": { "description": "Requires paid plan" }
        }
      }
    },
    "/vault/list": {
      "get": {
        "summary": "List vault items (paid)",
        "responses": { "200": { "description": "List of vault items" } }
      }
    },
    "/vault/{id}": {
      "get": {
        "summary": "Retrieve vault item (paid)",
        "parameters": [{ "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }],
        "responses": { "200": { "description": "Vault item with encrypted data" } }
      },
      "delete": {
        "summary": "Delete vault item (paid)",
        "parameters": [{ "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }],
        "responses": { "200": { "description": "Deleted" } }
      }
    },
    "/audit": {
      "get": {
        "summary": "Audit log (Pro only)",
        "responses": {
          "200": { "description": "Audit entries" },
          "403": { "description": "Requires Pro plan" }
        }
      }
    }
  }
}