The API

A handful of endpoints, no authentication, and one secret that is shown exactly once.

Base URL: https://share.simplicidade.org/api/v1. Everything answers JSON. There is a machine-readable description of all of it:

curl 'https://share.simplicidade.org/api?openapi=1' -o share-openapi.json

Or ask for it by content type — application/json, application/openapi+json or application/vnd.oai.openapi+json all return the document rather than this page:

curl -H 'accept: application/openapi+json' 'https://share.simplicidade.org/api'

Worth knowing, because it is easy to assume otherwise: the OpenAPI Specification says nothing about how a description document should be served, and no openapi media type is registered with IANA. The types above are a convention that tooling grew. ?openapi=1 is the unambiguous way to ask.

Endpoints

Method	Path	What it does
`GET`	`/api/v1/files`	List the live files for a session
`POST`	`/api/v1/files`	Upload a file and get the URL to hand over
`GET`	`/api/v1/files/{id}`	Metadata for one file
`DELETE`	`/api/v1/files/{id}`	Delete a file early
`GET`	`/api/v1/files/{id}/content`	The bytes
`GET`	`/api/v1/health`	Liveness

Uploading

Three body shapes, in order of how pleasant they are to type:

curl --data-binary @report.md   'https://share.simplicidade.org/api/v1/files?filename=report.md&session_id=$SESSION'

curl -F [email protected] 'https://share.simplicidade.org/api/v1/files'

curl -H content-type:application/json 'https://share.simplicidade.org/api/v1/files'   -d '{"filename":"doc.pdf","content_base64":"'"$(base64 -w0 doc.pdf)"'"}'

The response is 201 with the file's metadata. Three fields matter: url is what you give a person, content_url is what a machine fetches, and delete_password is the only copy you will ever get of it.

Deleting

Reading and deleting are separate capabilities. The share URL grants reading; the delete password grants removal, and no other call will tell you it. Lose it and the file simply expires on its own in 15 days.

curl -X DELETE -H "x-delete-password: $PASSWORD"   'https://share.simplicidade.org/api/v1/files/<id>'

A wrong password and a file that never existed get the same answer, with the same status. That is deliberate: it means this endpoint cannot be used to find out which ids exist.

Limits

Markdown (.md), images (.png .jpg .gif .webp .svg .heic) and .pdf. The extension must match the actual bytes.
At most 32.0 MB per file.
Uploads are rate limited: 1 per second, and 10 per minute, per caller. Over it you get a 429 with a Retry-After header saying how long to wait. Attempts count, not just the ones that succeed — a rejected file still uses up a slot.
Everything is deleted after 15 days.
This instance holds at most 50.0 GB in total. Past that the oldest files are removed to make room, whatever their expiry says.
This is a public demo, open to anyone who finds it. Do not put anything private here.

How to use it covers the MCP side.