# httpresponder.com

Public, no login, no API key, no rate limits.
API contract: https://httpresponder.com/openapi.json
HTML documentation: https://httpresponder.com/docs
Discovery: https://httpresponder.com/sitemap.xml
All APIs allow cross-origin requests. Errors: {"error":{"code":400,"message":"..."}}.
Use POST JSON or application/x-www-form-urlencoded for mutations. GET creation is also supported.
Save delete_token returned by paste/link creation. POST /api/pastes/{id}/delete or /api/links/{id}/delete with {"delete_token":"..."}. Never share deletion tokens.
GET/POST /base64 with data, mode=decode|encode, content_type; /base64/{encoded} and /b64 aliases. Standard and URL-safe base64 accepted. /respond with status,body,base64,content_type,headers,delay; /mix/s=201/h=content-type:text%2Fplain/b64=SGVsbG8=. /anything, /get, /post, /headers, /status/{code}, /redirect-to, /cookies, /basic-auth/{user}/{pass}, /bearer, /bytes/{n}, /delay/{seconds}, /stream/{count}, /sse, /drip, /etag/{tag}. Request body <=1 MiB, generated bytes <=1 MiB, delays/streams <=10 seconds. Go templates, OAuth, shell runners, TLS emulation and LLM mocks are not implemented.