SecretSamThe quiet witness

The actual product

Sam in your terminal.

Passage, user id, mode. The signing key stays here. If a bearer key is configured on the server, add Authorization: Bearer <key>. Authenticate every call with a Bearer token. HMAC signing keys stay on the server and are never accepted from the request body.

Shield

curl -X POST https://www.secretsam.com/api/watermark/generate \
  -H 'Authorization: Bearer YOUR_GENERATED_API_KEY' \
  -H 'content-type: application/json' \
  -d '{"text":"Hello from SecretSam","userId":"user-1842","mode":"shield"}'

Enterprise · internal

curl -X POST https://www.secretsam.com/api/watermark/generate \
  -H 'Authorization: Bearer YOUR_GENERATED_API_KEY' \
  -H 'content-type: application/json' \
  -d '{"text":"Hello from SecretSam","userId":"employee-1842","mode":"enterprise","trackingType":"internal"}'

Enterprise · external

curl -X POST https://www.secretsam.com/api/watermark/generate \
  -H 'Authorization: Bearer YOUR_GENERATED_API_KEY' \
  -H 'content-type: application/json' \
  -d '{"text":"Hello from SecretSam","recipientName":"Press Agency X","mode":"enterprise","trackingType":"external"}'

Validate

curl -X POST https://www.secretsam.com/api/watermark/validate \
  -H 'Authorization: Bearer YOUR_GENERATED_API_KEY' \
  -H 'content-type: application/json' \
  -d '{"text":"<copied text>","originalText":"Hello from SecretSam","possibleIds":["user-1842","user-2201"],"mode":"enterprise"}'