{
  "openapi": "3.0.3",
  "info": {
    "title": "Burn-Once Secret Vault",
    "description": "Store a secret (API key, webhook payload, signed URL) encrypted with WebCrypto AES-256-GCM and share a claim URL that yields the secret exactly once. A Durable Object serializes reads so single-use delivery is race-free, and every burn returns an Ed25519-signed attestation. Creating a vault requires x402 payment; the recipient's claim read (GET /v/:vault_id) is free.",
    "version": "0.1.0"
  },
  "servers": [
    {
      "url": "https://burn-once-secret-vault.jannioura.workers.dev",
      "description": "Deployed Cloudflare Worker"
    }
  ],
  "paths": {
    "/": {
      "post": {
        "summary": "Create a burn-once secret vault",
        "operationId": "createSecretVault",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "secret"
                ],
                "properties": {
                  "secret": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 10240,
                    "description": "The secret payload to encrypt at rest (UTF-8, max 10KB)."
                  },
                  "ttl_seconds": {
                    "type": "integer",
                    "minimum": 60,
                    "maximum": 604800,
                    "default": 3600,
                    "description": "Time-to-live in seconds; unclaimed vaults expire (60s to 7 days)."
                  },
                  "passphrase_hint": {
                    "type": "string",
                    "maxLength": 256,
                    "description": "Optional hint shown to the recipient on claim, alongside the decrypted secret."
                  },
                  "max_reads": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 100,
                    "default": 1,
                    "description": "How many atomic claim reads are allowed before the vault burns (1 = strictly burn-once)."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Vault created (after x402 payment settled).",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "vault_id",
                    "claim_url",
                    "expires_at",
                    "burns_after",
                    "receipt_key"
                  ],
                  "properties": {
                    "vault_id": {
                      "type": "string",
                      "pattern": "^vlt_[0-9a-f]{8}$"
                    },
                    "claim_url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "expires_at": {
                      "type": "string",
                      "format": "date-time"
                    },
                    "burns_after": {
                      "type": "integer",
                      "minimum": 1
                    },
                    "receipt_key": {
                      "type": "string",
                      "description": "Location of the public key for verifying burn attestations."
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Invalid request body.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "error": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "402": {
            "description": "Payment required (x402 v2 challenge)."
          }
        }
      }
    }
  },
  "x-402": {
    "version": 2,
    "scheme": "exact",
    "network": "eip155:84532",
    "networkName": "Base Sepolia (testnet)",
    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
    "amount": "10000",
    "amountDecimal": "0.01",
    "payTo": "REPLACE",
    "facilitator": "https://x402.org/facilitator",
    "eip712Domain": {
      "name": "USDC",
      "version": "2"
    }
  }
}