Send a text document to your paired phone's Downloads folder (send_file)

curl --request POST \
  --url https://api.reflecto.dev/v1/documents \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "filename": "runbook.md",
  "content": "# Runbook\n\n1. Check the dashboard\n2. Page on-call if red\n"
}
'

import requests

url = "https://api.reflecto.dev/v1/documents"

payload = {
    "filename": "runbook.md",
    "content": "# Runbook

1. Check the dashboard
2. Page on-call if red
"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    filename: 'runbook.md',
    content: '# Runbook\n\n1. Check the dashboard\n2. Page on-call if red\n'
  })
};

fetch('https://api.reflecto.dev/v1/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.reflecto.dev/v1/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'filename' => 'runbook.md',
    'content' => '# Runbook

1. Check the dashboard
2. Page on-call if red
'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.reflecto.dev/v1/documents"

	payload := strings.NewReader("{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.reflecto.dev/v1/documents")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.reflecto.dev/v1/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}"

response = http.request(request)
puts response.read_body

{
  "document_id": "doc_3f6e2a7c9b1d4f8e8a5b6c1d2e3f4a5b",
  "byte_length": 128
}

Documents

Send a text document to your paired phone's Downloads folder (send_file)

Not yet enabled. This endpoint is rolling out alongside the Android release that can receive documents — until then, calls receive a plain 404 Not Found with no response body, indistinguishable from a route that doesn’t exist.

Sends a text document to the paired phone on the account behind the bearer token. The server holds content in plaintext RAM only for the duration of this call (disclosed server-as-sender tier, same as POST /v1/send) — it is encrypted once to the phone’s public key, parked as an opaque ciphertext blob for up to 1 hour, and the phone pulls it via an FCM-nudged GET /v1/documents/{documentId}, then writes it into Downloads. Nothing is retained server-side beyond that 1 hour window.

Filenames are restricted to plain-text/code extensions — never .html/.svg, which render and execute if tapped from Downloads (400 invalid_filename). content must be non-empty and at most 131072 bytes (400 invalid_content / 413 content_too_large).

Requires a paired phone device on the account behind the bearer token (409 no_phone_device).

Phone-capability gate — fail-closed, unlike the other agent-actuated tools. If the paired phone’s reported app build is too old to receive documents, the request is refused outright (426 phone_app_outdated). Unlike remind_me/request_approval/find_my_phone, a phone that has never reported its version is ALSO refused (428 phone_app_unknown, not a warning-and-proceed) — document support shipped strictly after version reporting did, so “unknown” is proof the installed build predates it, not genuine ambiguity.

POST

documents

Send a text document to your paired phone's Downloads folder (send_file)

curl --request POST \
  --url https://api.reflecto.dev/v1/documents \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "filename": "runbook.md",
  "content": "# Runbook\n\n1. Check the dashboard\n2. Page on-call if red\n"
}
'

import requests

url = "https://api.reflecto.dev/v1/documents"

payload = {
    "filename": "runbook.md",
    "content": "# Runbook

1. Check the dashboard
2. Page on-call if red
"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    filename: 'runbook.md',
    content: '# Runbook\n\n1. Check the dashboard\n2. Page on-call if red\n'
  })
};

fetch('https://api.reflecto.dev/v1/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.reflecto.dev/v1/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'filename' => 'runbook.md',
    'content' => '# Runbook

1. Check the dashboard
2. Page on-call if red
'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.reflecto.dev/v1/documents"

	payload := strings.NewReader("{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.reflecto.dev/v1/documents")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.reflecto.dev/v1/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"filename\": \"runbook.md\",\n  \"content\": \"# Runbook\\n\\n1. Check the dashboard\\n2. Page on-call if red\\n\"\n}"

response = http.request(request)
puts response.read_body

{
  "document_id": "doc_3f6e2a7c9b1d4f8e8a5b6c1d2e3f4a5b",
  "byte_length": 128
}

Authorizations

Authorization

string

header

required

Opaque bearer token created on your paired Android phone. The format is rfk_live_ followed by 32 URL-safe alphanumeric characters (≥160 bits of entropy). Test tokens use the rfk_test_ prefix.

Body

application/json

filename

string

required

Destination filename, written into the phone's Downloads folder. Must end in an allowed plain-text/code extension (never .html/.svg — those render and execute if tapped) and be at most 120 characters after sanitization (rejected outright above 4096 raw characters). Path separators, control characters, and leading dots are stripped server-side and again on the phone before writing.

Example:

"runbook.md"

content

string

required

UTF-8 text content of the file. Non-empty, at most 131072 bytes.

Example:

"# Runbook\n\n1. Check the dashboard\n2. Page on-call if red\n"

Response

Created — the document was encrypted and dispatched to the phone.

document_id

string

required

Document id (doc_ prefix). The paired phone pulls the encrypted content with it via the FCM-nudged GET /v1/documents/{documentId} pull, never carried inline.

Example:

"doc_3f6e2a7c9b1d4f8e8a5b6c1d2e3f4a5b"

byte_length

integer

required

UTF-8 byte length of the content that was sent.

Example:

128