List & delete drops

Returns the drops owned by the account, newest first. expires_at is null on subscriber drops, since those never expire.

{
"total": 12,
"drops": [
{
"slug": "launch-metrics-c2dse",
"url": "https://launch-metrics-c2dse.ship.place/",
"name": "launch-metrics",
"file_count": 3,
"redeploy_count": 7,
"password_protected": false,
"thumb": "https://launch-metrics-c2dse.ship.place/_ship/thumb/9f2c4e1a7b3d5f60.webp",
"created_at": "2026-06-02T09:14:00.000Z",
"updated_at": "2026-06-09T16:41:00.000Z",
"expires_at": null
}
]
}

Everything the dashboard shows about one drop you own: its URL, size, file count, expiry, password and takedown state, thumbnail, and once it keeps version history (history), the live version and how many versions are kept.

Answers 404 for unknown and unowned slugs alike.

Lists every file the drop serves, sorted by path, with its size in bytes and MIME type, plus the total size. Works for expired and taken down drops too, for whatever is still stored.

Downloads one file as an attachment. URL-encode each path segment and keep the slashes. Text files come back as text/plain and everything else as application/octet-stream, so nothing renders; X-Ship-Mime carries the type the drop serves the file with.

Answers 400 for paths with . or .. segments, 404 for missing files and 451 for taken down drops.

Streams the drop's files into a zip named after the slug, with the same paths, ready to deploy again. Answers 404 when no files are left and 451 for taken down drops.

The 20 most recent published versions, newest first, with their source, size and what changed since the version before. A drop keeps versions once it's opened in the site editor; until then the list is empty.

Makes a past version live again as a new version, on Pro and Team plans. Send JSON {"idempotency_key": "<uuid>"}; retrying with the same key returns the first result. The expiry and any open editor draft stay as they are.

Answers 409 with already_live for the live version, busy while another publish is going live (retry after Retry-After) and missing when some of the version's files are no longer stored; 410 for expired drops and 451 for taken down ones.

Removes a drop. The <slug> is the subdomain part of the drop's URL — for launch-metrics-c2dse.ship.place that's launch-metrics-c2dse.

{
"deleted": "launch-metrics-c2dse"
}

Attaches an anonymously deployed drop to your account. Every anonymous POST /deploy response carries a one-time claim_token (spc_…, shown once) — send it here and the drop becomes yours: listable, deletable, and redeployable on paid plans. Claiming extends the drop to the free-account lifetime of 90 days — including anonymous drops recovered during the 30 days after expiry, when they are offline but remain privately claimable.

{
"claim_token": "spc_7xk3m9q2vj8n4p1w6z5y0r2t"
}

{
"slug": "launch-metrics-c2dse",
"claimed": true,
"restored": false,
"expires_at": "2026-10-02T14:00:00.000Z",
"url": "https://launch-metrics-c2dse.ship.place/"
}

Answers 403 on a wrong token, 409 when another account claimed the drop first, and 404 for unknown slugs, and 410 once the 30-day claim window has closed. Re-claiming a drop you already own is a no-op 200.

Brings an expired drop you own back online while its files are still retained (90 days past expiry). Free accounts get the drop back at the free 90-day lifetime; for subscribers the drop never expires again.

Answers 410 once the files are purged for good, 409 on a concurrent state change (retry), and 404 for unknown or unowned slugs. Restoring a drop that is still live is a no-op 200.

Pageview analytics for a drop you own: all-time totals (within the 90-day retention window), the last 24 hours and 7 days, and a daily views series. Bots and crawlers are excluded; views count page loads of HTML pages, not raw asset requests, and previews in the ship.page dashboard don't count. The same numbers power the traffic panel on the dashboard.

Free accounts only get the view count: slug, total and "access": "locked". Pro returns "access": "pro" with the last 24 hours and 7 days, a 90-day daily series plus top_referrers, top_paths and top_countries (up to 5 entries each; a direct referrer means none was sent, and countries are uppercase ISO 3166-1 alpha-2 codes, leaving out views without a known country).

{
"slug": "vast-juice-c2dse",
"access": "pro",
"total": 128,
"last_24h": 9,
"last_7d": 41,
"window_days": 90,
"days": 90,
"daily": [{ "day": "2026-08-21", "views": 12 }],
"top_referrers": [{ "label": "chatgpt.com", "views": 30 }],
"top_paths": [{ "label": "index.html", "views": 120 }],
"top_countries": [{ "label": "US", "views": 64 }]
}

Mints a new API key. This is the one route that requires a Firebase ID token from your dashboard session — existing sp_ keys can't mint new keys.

{
"accountId": "9f1c2c4e-7b2a-4f5e-a1d3-2c8b51b6f0aa",
"apiKey": "sp_QffDmo0uWxx_BKbZjjtSwdgPaksp58XTGgj0tsLZfhU",
"keyId": "8c1f4b2e6a9d35c7e0b8a2f41d6c9e3b5a7d0f82c4e6b1a39d5f7c0e2b4a6d81",
"note": "Shown once — store it. Send as 'Authorization: Bearer <key>' …"
}

Lists the keys on the account. Only metadata comes back — the secret itself is never returned, just the prefix so you can tell keys apart.

{
"keys": [
{
"id": "8c1f4b2e6a9d35c7e0b8a2f41d6c9e3b5a7d0f82c4e6b1a39d5f7c0e2b4a6d81",
"prefix": "sp_QffDmo0",
"created_at": "2026-05-28T11:02:00.000Z",
"last_used_at": "2026-06-10T07:55:00.000Z"
},
{
"id": "2f9e7c4b1a6d8e3c5b0a9f7d4e2c6b8a1d3f5e7c9b0a2d4f6e8c1b3a5d7f9e0c",
"prefix": "sp_b7Rt2wX",
"created_at": "2026-04-12T15:30:00.000Z",
"last_used_at": null
}
]
}

Revokes a key by its id (from GET /keys) — the id is the key’s SHA-256, 64 hex chars. Takes effect on the very next request.

{
"revoked": "2f9e7c4b1a6d8e3c5b0a9f7d4e2c6b8a1d3f5e7c9b0a2d4f6e8c1b3a5d7f9e0c"
}