API Question For Dummys

[trevordowdle]

I have a question surrounding the use of the PrivateBin api here. I was going to experiment with it but seeing how it's a long weekend I probably won't get to it before Tuesday, and thought I would reach out first.

If say a company is running an instance of privatebin, provided the instance has the api could I use it to programmatically generate a private bin url? Does the Create Paste action take place of the manual process of pasting the data and generating a url?

What's throwing me off maybe is that there are options I am seeing in the UI such as including a password, burn after reading, and or an expiration date that can be included. I didn't see or at least recognize anything on the api page regarding how to specify any of that when creating a paste.

Some help and insight would be appreciated. Thanks

[rugk]

Yes, due to the design of PrivateBin many actions need to be done in the client (being it a browser or CLI), such as encrypting (optionally with a password) or so,

If you look at the API doc, you find JSON-LD being linked. The one for create lists some properties.

However, in new versions of PrivateBin much of that data you mention has been included as authenticated data in the encryption scheme, as such even a server admin can hardly modify it.
There you can e.g. find an open-discussion flag, paste format, burn-after-reading flag etc.

[trevordowdle]

@rugk, and @elrido

Thank you both for the insight.

[trevordowdle]

I've been trying to perform a create paste operation by posting to our privatebin url.
Unfortunately i keep getting a 500 response from the server without any additional error messages returned. I was hoping I would get some feedback from the server but that hasn't been the case so far.

It looks like we are running privateBin version 1.4.0

I've reviewed the paste jsonid here and the encryption format page. But it hasn't quite clicked yet.

Could you help me with an example of the minimum viable format for creating a paste? Is the following data viable?

{
    v: 2,
    ct: "VGhpcyBpcyBhIHRlc3Q=",
}

For the ct value, in this instance I've just base64 encoded a string. Wasn't positive if it needed to be AES encrypted before base64 encoding it, but hoped for testing purposes it would work pan out even if the resulting text was jarbled.

It's my understanding that the meta value if not included will set the expiration to the server default.

And then I am unsure about the adata property.. Is that required when creating a paste? I did do a get request to see what the resulting paste.jsonId data looked like and got the following which I'm not really sure how to apply to a post request. I think I understood that the adata is used to authenticate the meta data? Since I am passing no meta data can this be omitted as well?

  adata: [
    [
      "PVHvmCIMT/BwIotwAqyVzw==",
      "5AiCEQCloCo=",
      100000,
      256,
      128,
      "aes",
      "gcm",
      "none",
    ],
    "plaintext",
    0,
    0,
  ]

I don't know if there are any gotchas I'm missing. I'm taking the object and stringifying it before passing it as data in the post request.

An example of a minimum viable JSON-LD object/string to post as data when creating a paste would be greatly appreciated. As I am looking to confirm if I can get it to work or not on this particular server I am working with.

Thank you

[elrido]

You can find the structure of a minimal viable paste as a PHP array, that we use for our unit tests, here (though the created property would get added by the server, not sent by your client):

PrivateBin/tst/Bootstrap.php

Lines 635 to 662 in e84a869

	/**
	* example paste version 2
	*
	* @var array
	*/
	private static $pasteV2 = array(
	'adata' => array(
	array(
	'gMSNoLOk4z0RnmsYwXZ8mw==',
	'TZO+JWuIuxs=',
	100000,
	256,
	128,
	'aes',
	'gcm',
	'zlib',
	),
	'plaintext',
	1,
	0,
	),
	'meta' => array(
	'expire' => '5min',
	'created' => 1344803344,
	),
	'v' => 2,
	'ct' => 'ME5JF/YBEijp2uYMzLZozbKtWc5wfy6R59NBb7SmRig=',
	);

If you get an error 500, you will likely find a PHP error being logged on the server, giving you some insight where exactly it tripped up.

Depending on what language you use to create your client, have a look at the sources of one of the existing 3rd party clients listed in the wiki - there are examples using python, nodejs, groovy, go and php.

[elrido]

Oh, and as an aside on how to get a sample paste - in your browser, open the F12 / developer console (Firefox or Chrome), navigate to the network tab, create a new paste on any instance and display the JSON of that POST request you just caught.

[trevordowdle]

Great, thank you for the guidance in this matter @elrido.