> ## Documentation Index
> Fetch the complete documentation index at: https://docsdrop.erikraft.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Public API v1

> Versioned capability discovery and integration contract for ErikrafT Drop.

# Public API v1

ErikrafT Drop exposes a small, read-only discovery endpoint for developers integrating compatible clients.

## Capability discovery

`GET https://drop.erikraft.com/api/v1/capabilities`

Returns JSON describing the API version, supported integration transports, capability flags, and related endpoints. The response contains public metadata only; it must never contain room secrets, pairing keys, credentials, or file contents.

Example:

```javascript theme={"dark"}
const response = await fetch(
  "https://drop.erikraft.com/api/v1/capabilities",
  { headers: { Accept: "application/json" } }
);

if (!response.ok) {
  throw new Error(`Drop API returned HTTP ${response.status}`);
}

const capabilities = await response.json();
console.log(capabilities.apiVersion, capabilities.capabilities);
```

## Existing CLI metadata endpoint

`GET /api/cli` remains available for backward compatibility with iSearch CLI™. It describes the current CLI integration contract and existing WebSocket protocol messages. Consumers should not assume this endpoint is a general-purpose file-transfer REST API.

## Transfer architecture

The API does not upload or store files. Discovery and signaling use the existing Drop infrastructure; compatible clients negotiate transfers through the existing WebSocket/WebRTC protocol. A capability flag is descriptive and does not guarantee that every client runtime supports every transport. In particular, clients that advertise `webrtc_supported=false` must not be assumed to support browser WebRTC data channels.

## Public access and limits

The capability endpoint is public and does not require an API key. It is limited to 60 requests per minute per server process, and may also be subject to deployment-level limits. In horizontally scaled or serverless deployments, this in-memory limit is not a shared global quota. Do not embed private credentials in browser or CLI clients.

## Current scope

This is the first version of the public integration contract, not a stable REST interface for initiating, accepting, or controlling transfers. Those operations require a separately specified client SDK and explicit consent/authorization rules before they can be published as supported API methods.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.