Dropto Abuse API

openapi: 3.2.0
info:
  title: Drop2Run.Api | v1 Abuse API
  version: 1.0.0
  description: 'Reporting a published site for phishing, malware or other misuse. Open to anybody with no account and no credential, deliberately: requiring one would cost more reports than it would gain in follow-up.'
servers:
- description: Production
  url: https://dropto.run
tags:
- description: 'Reporting a published site for phishing, malware or other misuse. Open to anybody with no account and no credential, deliberately: requiring one would cost more reports than it would gain in follow-up.'
  name: Abuse
paths:
  /api/abuse:
    post:
      operationId: ReportAbuse
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReportAbuseRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReportAbuseResponse'
          description: OK
        '400':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
          description: Bad Request
      summary: Reports a hosted site for abuse. Public and rate limited
      tags:
      - Abuse
components:
  schemas:
    ReportAbuseResponse:
      description: Response of `POST /abuse`.
      properties:
        reportId:
          description: 'Reference for the report. Given back so a reporter following up has something to quote, and so a

            retried submission can be recognised as a duplicate by hand.'
          type: string
      required:
      - reportId
      type: object
    ReportAbuseRequest:
      description: Request body of `POST /abuse`.
      properties:
        reason:
          description: What is wrong with it.
          maxLength: 2000
          minLength: 3
          type: string
        reporterEmail:
          description: 'Optional contact address. Deliberately not required: insisting on one costs more reports than it

            gains in follow-up.'
          maxLength: 320
          minLength: 0
          type:
          - 'null'
          - string
        url:
          description: Full address of the offending page.
          example: https://example-site.dropto.live/landing/index.html
          maxLength: 2048
          minLength: 8
          type: string
      required:
      - url
      - reason
      type: object
    ProblemDetails:
      properties:
        detail:
          type:
          - 'null'
          - string
        instance:
          type:
          - 'null'
          - string
        status:
          format: int32
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
        title:
          type:
          - 'null'
          - string
        type:
          type:
          - 'null'
          - string
      type: object
  securitySchemes:
    accessToken:
      description: 'A personal access token, created at /account/tokens. Sent as `Authorization: Bearer d2r_...`. A rejected token answers 401 with `invalid_token`, which is deliberately distinct from the 403 a valid credential gets for something it may not do.'
      scheme: bearer
      type: http
    claimToken:
      description: Returned once when an anonymous site is created, and the only credential that site has until somebody signs in and claims it.
      in: header
      name: X-Claim-Token
      type: apiKey
    session:
      description: The browser session, set by signing in with Google. HttpOnly, so a script cannot read it and a client outside a browser cannot send it.
      in: cookie
      name: d2r_session
      type: apiKey