The 2L API

One call turns a file into a link. Everything else on this page exists because somebody who automated that call eventually wanted to list what they had made and delete some of it.

The base is https://2l.nz/api/v1. Everything speaks JSON and everything is Pro.

Authentication

Send your key as a bearer token. Keys are made in your dashboard, start with 2l_, and are shown exactly once — they are stored only as a hash, so a key that is lost is revoked and replaced rather than recovered.

A key acts as your whole account. Make a separate one for each place you use it so that revoking one does not break the others, and revoke rather than delete when a key leaks — a revoked key is refused immediately.

Unlike the rest of this site, these endpoints send CORS headers. That is safe here precisely because they authenticate with a bearer key rather than a cookie: a key is carried deliberately or not at all, so there is no ambient authority for another origin to borrow.

Your first link

The shortest useful call is a raw body with a filename header. This is the shape curl -T already speaks, so no wrapper is needed.

kind is what detection decided the file was, and it is what determines the page somebody sees when they open the link. You never choose it.

Errors

A failure is an HTTP status plus a body with a machine-readable error and a message written for a person to read in a log.

Limits

These are the Pro numbers, and they are read from the same table the server enforces.

Create a link

Three body shapes are accepted, because three shapes are how people actually call an API.

A raw body

The whole body is the file. The name comes from X-Filename, or from a Content-Disposition if one is sent. Options go in the query string.

A form

multipart/form-data. Every file part becomes an item in the link; every text part is read as an option.

JSON

For text, or for a small file sent inline as base64. Base64 costs a third more on the wire, so use the raw form for anything large.

Detection runs on text too: that body arrives as valid JSON, so the link opens a JSON tree rather than a wall of characters.

Options

List your links

Fifty at a time, newest first. q matches the code and the title. The reply carries hasMore rather than a total, because counting every row on every page is a cost paid for a number almost nobody reads.

Read one

The full record, including view count and the list of items. Never the password — not even its hash.

Update

Send only what you want changed. Accepts title, password (null removes it), expiresAt (null means never), burnAfterRead and allowDownload.

Delete

Removes the record, the analytics and the stored bytes. The bytes go first, so a link taken down for a reason stops serving content immediately even while an edge cache still holds the record.

Files over 16 MB

The same three calls the website itself uses, and they take the same bearer key. Declare what is coming, send it in chunks, then commit.

A part that fails is worth retrying — parts are addressed by number, so sending the same one twice replaces it rather than appending. A 4xx other than 429 is a decision, not a hiccup, and retrying it only makes the same answer arrive three times.

An unfinished upload is discarded after six hours and costs nothing.

Usage

Storage used, storage allowed, and every limit that applies to this key. Worth reading before a batch job rather than discovering the ceiling half way through one.

Keys

Lists your keys by prefix, name and when each was last used — never the keys themselves. Making and revoking keys is deliberately dashboard-only: a key that can mint more keys is a key whose loss cannot be contained.

Anything else

Write to support@2l.nz. If something in this page is wrong, that is a bug and worth telling us about.