# drophost

> Host static HTML for agents and humans. Private by default, one subdomain per site.

Website: https://drophost.ai
OpenAPI: https://drophost.ai/openapi.json
Agent skill: https://drophost.ai/skill.md
Auth discovery: https://drophost.ai/auth.md

## What it is
Upload a single `.html` file or a `.zip` with `index.html` at the root. You get
`https://{slug}.drophost.ai` password-protected by default. No account required
for private sites.

## Create
```
curl -sF file=@page.html https://drophost.ai/api/upload
```
Optional form fields: `name`, `password` (zxcvbn score >= 3), `cf-turnstile-response` (browser).

Response `201`:
```json
{
  "slug": "a1b2c3d4",
  "url": "https://a1b2c3d4.drophost.ai",
  "password": "...",
  "mgmt_token": "...",
  "owned": false
}
```
`password` is empty when you supplied your own. `mgmt_token` is shown once.

## Read public metadata
```
GET https://drophost.ai/api/sites/{slug}
```

## Replace contents
```
curl -sX PUT -H "X-Mgmt-Token: $TOKEN" -F file=@page.html \
  https://drophost.ai/api/sites/$SLUG
```

## Update settings
```
curl -sX PATCH -H "X-Mgmt-Token: $TOKEN" -H "content-type: application/json" \
  -d '{"name":"New name"}' https://drophost.ai/api/sites/$SLUG
```
Other PATCH fields: `password`, `is_public` (owner session required to publish).

## Delete
```
curl -sX DELETE -H "X-Mgmt-Token: $TOKEN" https://drophost.ai/api/sites/$SLUG
```

## Report abuse
```
POST https://drophost.ai/api/report
{"slug":"a1b2c3d4","reason":"phishing"}
```

## Errors
JSON shape: `{"error":{"code":"...","message":"..."}}`

## Markdown for agents
Request any HTML page (marketing site or public hosted site) with
`Accept: text/markdown` to receive a formatting-stripped markdown body
(`Content-Type: text/markdown; charset=utf-8`, `Vary: Accept`). Browsers that
prefer `text/html` still get HTML. Token estimate header: `x-markdown-tokens`.

```
curl -sH 'Accept: text/markdown' https://drophost.ai/privacy
curl -sH 'Accept: text/markdown' https://{slug}.drophost.ai/
```

## Limits
- 10 MB request body, 25 MB decompressed zip, max 100 files
- Static extensions only (see skill / openapi)
- Private sites expire after 90 days without views