Deploy a drop (anonymous allowed)

Body format is picked by Content-Type: text/html (or any non-JSON/non-zip type) stores the raw body as index.html; application/json expects a files map; application/zip unpacks an archive (single root dir auto-stripped). Limits: 100 files/request anonymous+free, 10,000 paid; zip 25 MB free / 100 MB paid (4× decompression cap); non-zip bodies 10 MB. Rate: 10 deploys/min per IP anonymous and free, 120/min per account on paid plans; 429 responses carry Retry-After: 60. To password-protect a drop, send X-Ship-Password with encodeURIComponent(password) and an active paid Pro/Team credential. Never send a password in the query string or files body. Omitting the header on a live named redeploy preserves protection; recreating an expired or purged named drop requires sending the password again. A top-level JSON password property is rejected. The /_ship/ namespace is reserved and cannot be uploaded; an empty header is invalid. Protected reads return 401 until the visitor unlocks in a browser and are never cached. Password creation/rotation returns 503 if billing cannot be verified.

post/deploy

Request

  • Base URL: https://ship.page
  • URL: https://ship.page/deploy
  • Auth: one of:
    • none
    • HTTP bearer

Query parameters

ttlinteger

Drop lifetime in seconds. Anonymous default/max: 2592000 (30 days). Signed-in free default/max: 7776000 (90 days). Subscribers may set any value and default to no expiry.

namestring

Named drop (subscribers only). Stable alias scoped to the account; redeploying the same name replaces content and keeps the URL.

emailstring email

Anonymous deploys only: the one-time claim link is mailed to this address, so the drop stays recoverable if the claim_token from the response is lost. Echoed back as claim_email. Ignored for authenticated deploys.

agentstring

Name of the AI agent or app publishing the drop, e.g. chatgpt, claude, cursor. Stored trimmed and lowercased; empty counts as not sent. AI agents: this is required; e.g. ChatGPT, Claude, etc.

Headers

X-Ship-Passwordstring

Optional encodeURIComponent(password). Decoded password: 8-128 Unicode characters, at most 512 UTF-8 bytes. Requires an active paid Pro/Team account. Omit to preserve protection on a live named redeploy; use DELETE /drops/{slug}/password to remove it.

Request body

filesobject required

Path → content map. Values are a string, or { encoding: "base64", content: string } for binary.

Response

Drop deployed.

slugstring required
urlstring uri required
filesstring[] required
plan'free' | 'pro' | 'team' required
expires_atstring date-time nullable required

Null for drops that never expire (subscribers).

namestring

Present when ?name= was used.

replacedboolean

Present when ?name= was used; true if an existing named drop was replaced.

password_protectedboolean required

Whether visitors must unlock the drop with a password.

claim_tokenstring

One-time claim token, present only on anonymous deploys and shown exactly once. Anyone holding it can attach the drop to an account via POST /drops/{slug}/claim.

claim_urlstring uri

Present on anonymous API and MCP deploys: a browser link that saves the drop to whichever account opens it. It carries the claim token, so keep it private.

next_stepstring

Present with claim_url: one sentence on keeping the page online, written to be passed on to the person the page was made for.

claim_emailstring email

Present when ?email= was accepted on an anonymous deploy; the claim link was mailed to this address.

Example response

{
  "slug": "vast-juice-c2dse",
  "url": "https://vast-juice-c2dse.shipped.run/"
}

Changes

Changes to this operation have not been checked yet.