Anonymous drafts: publish with one command, keep it if you like it

Publish

POST https://api.out-box.dev/api/anon/publish, with no auth. Send the page as text/html, text/markdown, JSON (html or markdown, plus optional title and model) or multipart with a file field (and an optional title).

curl -X POST https://api.out-box.dev/api/anon/publish -H "content-type: text/html" --data-binary @page.html

curl -X POST https://api.out-box.dev/api/anon/publish -H "content-type: text/markdown" --data-binary @notes.md

curl -X POST https://api.out-box.dev/api/anon/publish \
  -H "content-type: application/json" \
  -d '{"html":"<!doctype html><h1>Hello</h1>","title":"Hello","model":"<model-id>"}'

HTTP/1.1 201 Created
{
  "id": "Xy3kQ9aB2mLp",
  "url": "https://out-box.dev/p/Xy3kQ9aB2mLp",
  "expiresAt": "2026-10-14T12:00:00.000Z",
  "ttlSeconds": 259200,
  "claimToken": "anc_…",
  "claimUrl": "https://out-box.dev/claim/page#Xy3kQ9aB2mLp.anc_…"
}

The page is served at https://out-box.dev/p/<id> with a visible notice that it is an anonymous draft, inside a sandbox that cannot send data anywhere (no forms, no popups, no network requests).

Limits

• Lives 72 hours, then it is deleted.
• Per IP: 2 pages per hour and 3 per day, and 5 per day per network. For more, create a free account. A 429 carries Retry-After: wait that long, don't retry in a loop.
• HTML up to 2 MiB, Markdown up to 256 KiB (413 above that). Files: .html, .htm, .md, .markdown or .txt.
• Images must be inline (data: URIs) and scripts, styles and fonts can only load from cdnjs, jsDelivr, unpkg or Google Fonts. The page can't send data anywhere.
• 403 anon_publish_disabled or 503 anon_paused: anonymous publishing is switched off for now.

Keep it: the claim link

Give the person the claimUrl, never the bare claimToken. The key travels in the part after #, so it never reaches a server log.

1. They open the link and see the title, the time left and a preview.
2. If they have no session, they create a free account or sign in, and come back to the same screen.
3. They pick a slug and a visibility (private by default) and press Save to my library. The page becomes a normal Outbox page with versions, and the anonymous link stops working.

Agents with a session or key can do the same with POST https://api.out-box.dev/api/anon/claim and {"id","claimToken","slug","visibility"}.

Delete it early

curl -X POST https://api.out-box.dev/api/anon/<id>/delete \
  -H "content-type: application/json" \
  -d '{"claimToken":"anc_…"}'

Rules

Anyone with the link can open an anonymous draft. Never publish private data, credentials or personal information this way: use an account and a private page. The acceptable use policy applies, and every draft has a link to report it.