curl -sS -w '\nHTTP_STATUS:%{http_code}\n' -X POST http://127.0.0.1:8128/api/secret \
  -H 'Content-Type: application/json' \
  -d '{"passphrase":"Q1w2e3r4","secret":"compose-deploy-check-4n7pQx","expire":"3d","tries":5}'

{"response":{"details":"Secret successfully created.","expires_on":"October 30, 2026 at 00:16 UTC","external_id":"Y_IB12WWjoJooUnQDoaz","link":"http://127.0.0.1:8128/secret/Y_IB12WWjoJooUnQDoaz","status":"created"}}

HTTP_STATUS:201

curl -sS -w '\nHTTP_STATUS:%{http_code}\n' \
  'http://127.0.0.1:8128/api/secret?external_id=UXFGOP3h76Wryp6L8oXe&passphrase=Q1w2e3r4'

{"response":{"msg":"api-full-flow-ok-5t5t5t","status":"success"}}

HTTP_STATUS:200

{"response":{"msg":"Sorry, we can't find a secret, it has expired, been deleted or has already been read.","status":"expired"}}

HTTP_STATUS:404

---POST create tries=3---
HTTP 201
{"response":{"details":"Secret successfully created.","expires_on":"October 28, 2026 at 00:21 UTC","external_id":"eRhSSZ2dbfqWhwctrmGa","link":"http://127.0.0.1:8128/secret/eRhSSZ2dbfqWhwctrmGa","status":"created"}}

---GET wrong passphrase #1---
HTTP 401
{"response":{"msg":"Sorry, the passphrase is not valid. Number of tries remaining: 2","status":"invalid"}}

---GET wrong passphrase #2---
HTTP 401
{"response":{"msg":"Sorry, the passphrase is not valid. Number of tries remaining: 1","status":"invalid"}}

---GET wrong passphrase #3---
HTTP 401
{"response":{"msg":"The passphrase is not valid. You've exceeded the number of tries and the secret has been deleted.","status":"invalid"}}

---GET correct after exhausted---
HTTP 404
{"response":{"msg":"Sorry, we can't find a secret, it has expired, been deleted or has already been read.","status":"expired"}}

HTTP 422
{"response":{"details":"Missing data for required field.","status":"error"}}

{"response":{"details":"Missing data for required field. Missing data for required field.","status":"error"}}

{"response":{"details":"Sorry, your passphrase is too weak. It needs minimum 8 characters, with 1 number and 1 uppercase.","status":"error"}}

{"response":{"details":"The secret should not exceed 250 characters.","status":"error"}}

{"response":{"details":"Must be one of: 10m, 30m, 1h, 3h, 6h, 1d, 2d, 3d, 5d, 7d.","status":"error"}}

{"response":{"details":"Must be one of: 3, 5, 10.","status":"error"}}

HTTP 400
<!doctype html><html lang=en> <title>400 Bad Request</title> <h1>Bad Request</h1> <p>The browser (or proxy) sent a request that this server could not understand.</p>

HTTP 404
{"response":{"msg":"Sorry, we can't find a secret, it has expired, been deleted or has already been read.","status":"expired"}}

#!/usr/bin/env bash
# shhh-create.sh —— 创建一条秘密并打印分享链接
SHHH_URL="${SHHH_URL:-http://127.0.0.1:8128}"

create_secret() {
  local secret="$1" passphrase="$2" expire="${3:-3d}" tries="${4:-5}"
  curl -sS -X POST "$SHHH_URL/api/secret" \
    -H 'Content-Type: application/json' \
    -d "{\"passphrase\":\"$passphrase\",\"secret\":\"$secret\",\"expire\":\"$expire\",\"tries\":$tries}" \
    | python3 -c 'import sys,json; r=json.load(sys.stdin)["response"]; print(r["link"]); print(r["external_id"])'
}

read_secret() {
  local external_id="$1" passphrase="$2"
  curl -sS "$SHHH_URL/api/secret?external_id=$external_id&passphrase=$passphrase" \
    | python3 -c 'import sys,json; r=json.load(sys.stdin)["response"]; print(r["status"]); print(r.get("msg",""))'
}

创建与读取各跑一次（实测调用与输出）：

```bash
create_secret "db-root-password-9k2mTz-x" "Q1w2e3r4" "1d" 5

http://127.0.0.1:8128/secret/u6GDN7yzaYADZQFKRAm3
u6GDN7yzaYADZQFKRAm3

read_secret "u6GDN7yzaYADZQFKRAm3" "Q1w2e3r4"

success
db-root-password-9k2mTz-x

User-Agent: *

Disallow: /secret/
Disallow: /api/