The Platform API

Not Published

The hosted service has an HTTP interface — it is what the apps talk to — but it is not a published API. There is no public document, no published version, and no stability promise. We do not describe it here, because describing it would imply a promise to keep it as described.

And It Holds Nothing Of Yours

That is the smaller half. The larger one is that there are no user-specific routes on the platform at all, and there is no plan to add any.

A route that answered “what is Mary’s code?” would need the secret that produces the code, which means the server would have to hold it. From that moment the end-to-end promise is no longer true — not through misuse, but by construction: a server that CAN read your codes is a server whose compromise reads everybody’s codes. Care on our side does not change what an attacker would take.

So no user secret is stored on any server we run. The platform’s interface is system-level, machine-to-machine work that touches no personal data, and an account holder has no access to it in any case.

Read that as the reassurance it is meant to be. The absence is not a feature we have not got round to. It is the shape of a system designed so that the worst day at our end is not the worst day at yours.

What to Use Instead

Run the desktop companion and talk to its local API. The daemon holds the account’s session and keys, and reaches the platform on your behalf. Everything in this section documents that surface.

This is the only arrangement in which anything can answer for your account: the keys are on your machine, so the answering has to happen there too.

For a server or a machine account with no person at a screen, the companion runs headless and the same routes apply.

When That Changes

If the platform API is published, it will get its own pages here, alongside the local one, with the same route map and the same statement of what is guaranteed. Until you see them, treat the platform interface as private.

What will not change is the part above: whatever is published will be system-level, and it will still hold no secret of yours.