PlainMoteHTTP API
Scripts call /api/v1 with a personal access token, obtained by device authorization as plainmote login obtains one.
Get a token
Request a code. scope is read or write; device is the name shown when approving and under Authorized apps.
$ curl -X POST -H 'Content-Type: application/json' \ -d '{"scope": "read", "device": "my-script"}' https://plainmote.link/api/v1/device/codeOpen https://plainmote.link/cli/device in a signed-in browser, enter the user_code from the response, and allow it.
Poll with the device_code every interval seconds. Until the code is allowed the answer is 400 authorization_pending; then it carries access_token.
$ curl -X POST -H 'Content-Type: application/json' \ -d '{"device_code": "…"}' https://plainmote.link/api/v1/device/tokenSend the token in the Authorization header. Tokens in the address or in cookies are not accepted.
$ curl -H "Authorization: Bearer $PLAINMOTE_TOKEN" https://plainmote.link/api/v1/resources
Endpoints
| Request | Access | Purpose |
|---|---|---|
| POST /api/v1/device/code | No token | Request a code |
| POST /api/v1/device/token | No token | Exchange the code for a token |
| GET /api/v1/me | read | The account and token in use |
| GET /api/v1/keyring | read | The account's keyring, for encrypted resources |
| GET /api/v1/resources | read | List resources; q filters by name, tag by tag |
| GET /api/v1/resources/{id} | read | Resource details |
| GET /api/v1/resources/{id}/content | read | Read the content as raw bytes |
| PUT /api/v1/resources/{id}/content | write | Save a new version; If-Match names the version the edit started from |
| POST /api/v1/resources | write | Create a resource from a multipart content file; tag fields tag it |
| PATCH /api/v1/resources/{id}/tags | write | Add and remove a resource’s tags |
| GET /api/v1/tags | read | List the account’s tags with their counts |
| POST /api/v1/quick-shares | write | Make a quick share and return its link |
| DELETE /api/v1/token | read | Revoke the token in use |
Conventions
FormatJSON, except reading and saving content, which are raw bytes. Times are RFC 3339 in UTC.
Errors
{"error": "<code>", "message": "…"}TokensValid for 90 days from sign-in. A read-only token receives 403 from the writing endpoints.
Rate limit300 requests per token per minute; beyond that, 429 rate_limited.
Encrypted contentReturned as ciphertext; the client decrypts it with the master password.
Not availableDeleting resources, managing share links, reading access history.
The full reference, with request and response formats, is in the source code: docs/api.md