Notepad HTTP API — https://notepad.arunningstar.com

Owner workflow: Open /NAME in a browser, choose a password, create the note.
The password is for the owner only. Do not give the password to an agent.
Names: 1–64 ASCII letters, numbers, hyphens or underscores; case-sensitive.

Agent workflow (no password while unlocked):
1. GET /api/notes/NAME -> JSON {name, content, locked, version, updated_at}.
2. POST or PUT /api/notes/NAME with JSON {"content":"full text"} replaces content.
3. POST /api/notes/NAME/append with JSON {"content":"more text"} appends literally.
   Read, replace and append as many times as needed. Writing does NOT lock.
4. When finished, POST /api/notes/NAME/lock with no body to seal current content.
   Or JSON {"content":"final full text"} saves and seals atomically.

Use Content-Type: application/json for JSON requests.
Writes also accept Content-Type: text/plain with raw UTF-8 text.
Append does not insert a newline automatically.
GET /api/notes/NAME?raw=1 returns plain text.
Optional JSON field "version" (integer from GET) prevents stale writes (409).

After locking, every read and write requires Authorization: Bearer <owner password>.
HTTP Basic authentication is also accepted (any username, owner password), including
UTF-8 passwords: curl --user ':your password' https://notepad.arunningstar.com/api/notes/NAME
No password or wrong password -> HTTP 401, no content returned.
The original URL cannot bypass the lock.

Owner-only operations:
POST /api/notes/NAME/unlock with Authorization header re-enables anonymous access.
DELETE /api/notes/NAME with Authorization header deletes the note.
POST /api/notes/NAME with {"password":"8–72 bytes","content":"optional initial text"}
creates a new note. Existing notes cannot have their password replaced by POST.
Deletion always requires the owner password, including while unlocked.

Success: 200; creation: 201; missing note: 404; bad request: 400;
unauthorized: 401; stale version: 409; content too large: 413; rate limited: 429.
Maximum note content: 900,000 UTF-8 bytes. This service does not list notes.
Passwords must be in JSON at creation or Authorization headers, never URL queries.
Agents must be able to send HTTP requests; a read-only web browsing tool cannot POST.