REST API Reference

Retrieves the pre-derivation parameters for a specific email. Because the server does not store passwords, clients must request the unique salt for an email address to derive the AuthHash locally before attempting to log in.

{
  "email": "user@example.com"
}

{
  "salt": "base64_encoded_salt",
  "kdfParams": "{\"algorithm\":\"argon2id\",\"memoryCost\":65536}",
  "encryptedMasterKey": "wrapped_blob",
  "masterKeyNonce": "nonce_blob"
}

Authenticates a user session using the client-derived AuthHash. Returns a JWT access token valid for 24 hours.

{
  "email": "user@example.com",
  "authHash": "blake2b_hex_string"
}

{
  "token": "jwt_token_string",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "role": "user"
  }
}

Creates a new folder. Because folder names are encrypted, the server only receives an opaque payload to append to the metadata tree.

{
  "parentId": "optional_parent_uuid",
  "encryptedMetadata": "updated_json_blob"
}

{
  "success": true,
  "folderId": "new_uuid"
}

Retrieves the encrypted metadata blob containing the user's directory structure. The client is responsible for downloading this blob, decrypting it with the Master Key, and rendering the folder tree.

Uploads an encrypted file blob to the network. This endpoint requires multipart/form-data. The server never sees the plaintext file name; it only sees the encrypted ciphertexts and nonces.

cURL Example

curl -X POST https://api.nest.lazybird.io/files/upload \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -F "file=@encrypted_blob.bin" \
  -F "folderId=5" \
  -F "encryptedKey=base64_wrapped_file_key" \
  -F "keyNonce=base64_nonce" \
  -F "metadata=encrypted_json_metadata"

Updates the encrypted metadata blob for the user. This is called whenever a file or folder is renamed, moved, or deleted, ensuring the server stays blind to the directory structure.