{
 "info": {
  "name": "NoTrust.now API",
  "description": "Endpoints documented at https://notrust.now/en/api.\n\nEvery secret is post-quantum: encrypted on YOUR machine with ML-KEM-768 (to the recipient's public key) plus a mandatory passphrase, ChaCha20-Poly1305 and an optional ML-DSA-65 signature. Postman cannot run ML-KEM, so the encrypted body is produced by the CLI and pasted here; the server only ever sees ciphertext.\n\nEnvironment variables:\n- baseUrl: https://notrust.now\n- apiKey: your API key (sk_live_...), created in your account at https://notrust.now/en/account (sign in at https://notrust.now/en/login). Account keys carry the scopes secrets:create, secrets:read and secrets:delete. Creating secrets through the API requires one: without it the server answers 401 API_KEY_REQUIRED_FOR_PQC; an unknown or deleted key gets 401 INVALID_API_KEY, a revoked or deactivated one 401 REVOKED_API_KEY and an expired one 401 EXPIRED_API_KEY.\n- pqcBody: the output of  NOTRUST_PASSPHRASE='...' ./createpqc.sh -b -r recipient.kem.pub \"the secret\"  (download createpqc.sh and keygenpqc.sh from https://notrust.now/scripts/).\n- token: filled in by 'Create secret'.\n\nLimits for API calls today: ttl 1 to 60 minutes (default 15) and maxViews 1 to 10 (default 1). A body that is not ML-KEM-768 + ChaCha20-Poly1305 gets 400 PQC_REQUIRED.\n\nTo read the secret, save the body of 'Retrieve secret' to a file and run  ./decryptpqc.sh -k you.kem.key -i response.json",
  "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
 },
 "variable": [
  {
   "key": "baseUrl",
   "value": "https://notrust.now"
  },
  {
   "key": "apiKey",
   "value": ""
  },
  {
   "key": "pqcBody",
   "value": ""
  },
  {
   "key": "token",
   "value": ""
  }
 ],
 "item": [
  {
   "name": "1. Health & capabilities (no auth)",
   "item": [
    {
     "name": "GET /health",
     "request": {
      "method": "GET",
      "url": {
       "raw": "{{baseUrl}}/api/v1/health",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "health"
       ]
      }
     }
    },
    {
     "name": "GET /crypto/capabilities",
     "request": {
      "method": "GET",
      "url": {
       "raw": "{{baseUrl}}/api/v1/crypto/capabilities",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "crypto",
        "capabilities"
       ]
      }
     }
    }
   ]
  },
  {
   "name": "2. Secrets (create needs X-API-Key)",
   "item": [
    {
     "name": "POST /secrets — Create secret",
     "event": [
      {
       "listen": "prerequest",
       "script": {
        "type": "text/javascript",
        "exec": [
         "// The body is encrypted locally by createpqc.sh -b; Postman only sends it.",
         "if (!pm.variables.get('pqcBody')) {",
         "  throw new Error('Set pqcBody to the output of: ./createpqc.sh -b -r recipient.kem.pub \"the secret\"');",
         "}"
        ]
       }
      },
      {
       "listen": "test",
       "script": {
        "type": "text/javascript",
        "exec": [
         "const json = pm.response.json();",
         "pm.test('201 Created', () => pm.response.to.have.status(201));",
         "pm.test('token present', () => pm.expect(json.token).to.be.a('string'));",
         "pm.collectionVariables.set('token', json.token);",
         "console.log('Share link:', json.secretUrl);"
        ]
       }
      }
     ],
     "request": {
      "method": "POST",
      "header": [
       {
        "key": "Content-Type",
        "value": "application/json"
       },
       {
        "key": "X-API-Key",
        "value": "{{apiKey}}"
       }
      ],
      "body": {
       "mode": "raw",
       "raw": "{{pqcBody}}"
      },
      "url": {
       "raw": "{{baseUrl}}/api/v1/secrets",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "secrets"
       ]
      }
     }
    },
    {
     "name": "GET /secrets/{token}/metadata (does not consume a view)",
     "request": {
      "method": "GET",
      "url": {
       "raw": "{{baseUrl}}/api/v1/secrets/{{token}}/metadata",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "secrets",
        "{{token}}",
        "metadata"
       ]
      }
     }
    },
    {
     "name": "GET /secrets/{token} — Retrieve secret (consumes a view)",
     "event": [
      {
       "listen": "test",
       "script": {
        "type": "text/javascript",
        "exec": [
         "const json = pm.response.json();",
         "pm.test('200 OK', () => pm.response.to.have.status(200));",
         "const ed = typeof json.encryptedData === 'string' ? JSON.parse(json.encryptedData) : json.encryptedData;",
         "pm.test('post-quantum envelope (ML-KEM-768)', () => pm.expect(ed.kyberData.ciphertext).to.be.a('string'));",
         "console.log('Save this response and open it with: ./decryptpqc.sh -k you.kem.key -i response.json');"
        ]
       }
      }
     ],
     "request": {
      "method": "GET",
      "url": {
       "raw": "{{baseUrl}}/api/v1/secrets/{{token}}",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "secrets",
        "{{token}}"
       ]
      }
     }
    }
   ]
  },
  {
   "name": "3. PQC helpers (X-API-Key with crypto scopes)",
   "description": "POST /crypto/kyber/encapsulate needs the crypto:encrypt scope and POST /crypto/dilithium/verify needs crypto:verify. Keys created at https://notrust.now/en/account carry only secrets:create, secrets:read and secrets:delete, so they get 403 INSUFFICIENT_SCOPE here: the crypto scopes are not self-service. Creating and reading secrets needs neither endpoint.",
   "item": [
    {
     "name": "POST /crypto/kyber/encapsulate",
     "request": {
      "method": "POST",
      "header": [
       {
        "key": "Content-Type",
        "value": "application/json"
       },
       {
        "key": "X-API-Key",
        "value": "{{apiKey}}"
       }
      ],
      "body": {
       "mode": "raw",
       "raw": "{\n  \"publicKey\": \"<Base64 ML-KEM-768 public key, 1184 bytes: the .kem.pub from keygenpqc.sh>\"\n}"
      },
      "url": {
       "raw": "{{baseUrl}}/api/v1/crypto/kyber/encapsulate",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "crypto",
        "kyber",
        "encapsulate"
       ]
      }
     }
    },
    {
     "name": "POST /crypto/dilithium/verify",
     "request": {
      "method": "POST",
      "header": [
       {
        "key": "Content-Type",
        "value": "application/json"
       },
       {
        "key": "X-API-Key",
        "value": "{{apiKey}}"
       }
      ],
      "body": {
       "mode": "raw",
       "raw": "{\n  \"message\":   \"<Base64 message>\",\n  \"signature\": \"<Base64 ML-DSA-65 signature, 3309 bytes>\",\n  \"publicKey\": \"<Base64 ML-DSA-65 public key, 1952 bytes>\"\n}"
      },
      "url": {
       "raw": "{{baseUrl}}/api/v1/crypto/dilithium/verify",
       "host": [
        "{{baseUrl}}"
       ],
       "path": [
        "api",
        "v1",
        "crypto",
        "dilithium",
        "verify"
       ]
      }
     }
    }
   ]
  }
 ]
}