ver 1.0

echo-memory.plugin.src/skills/echo-memory/references/api-reference.md

@@ -1,7 +1,7 @@
 # ECHO — Obsidian Local REST API Reference
 
 Server: `https://echoapi.alwisp.com` (reverse proxy → backend Obsidian Local REST API)
-Auth header: `Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab`
+Auth header: `Authorization: Bearer $ECHO_KEY` — `export ECHO_KEY=<token>` before running these recipes (`echo.py` resolves it automatically: `ECHO_KEY` → `~/.echo-memory/credentials` → deprecated baked-in fallback). The literal key is never stored in docs.
 The endpoint has a **valid TLS certificate** — `-k` is not required. Paths address the vault at its **root**.
 
 > **Prefer `scripts/echo.py` over the raw recipes below.** It wraps every verb with auth, status checking, retry, idempotent append, and frontmatter patches, and runs on any platform with a Python interpreter. The `curl` recipes here are the underlying mechanics and a **\*nix/bash fallback** (they use heredocs and `--data-binary`); on Windows, prefer `echo.py` or an equivalent. **If you call `curl` directly, check the HTTP status** — add `-o /dev/null -w "%{http_code}"` and branch on it. A `PATCH` to a non-existent heading returns `400 invalid-target` (errorCode 40080) and the write is *silently lost*; a bare `curl` that ignores status will report success anyway. `GET` returns `404` for a missing file. Treat any `>= 400` as a failed operation, surface it, and do not continue as if it succeeded.
@@ -13,7 +13,7 @@ The endpoint has a **valid TLS certificate** — `-k` is not required. Paths add
 ```bash
 # Read any file by vault path
 curl -s \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   "https://echoapi.alwisp.com/vault/_agent/context/current-context.md"
 ```
 
@@ -22,7 +22,7 @@ Returns raw file content (text/markdown). On 404, the file does not exist.
 ```bash
 # Read a specific heading's content only
 curl -s \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   "https://echoapi.alwisp.com/vault/_agent/memory/semantic/operator-preferences.md/heading/Operator"
 ```
 
@@ -38,7 +38,7 @@ Nested headings: separate levels with `::` (URL-encode spaces as `%20`):
 ```bash
 # List contents of a directory (trailing slash required)
 curl -s \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   "https://echoapi.alwisp.com/vault/_agent/sessions/"
 ```
 
@@ -56,7 +56,7 @@ cat > /tmp/obs_entry.md << 'OBSEOF'
 OBSEOF
 
 curl -s -X POST \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   -H "Content-Type: text/markdown" \
   --data-binary @/tmp/obs_entry.md \
   "https://echoapi.alwisp.com/vault/inbox/captures/inbox.md"
@@ -87,7 +87,7 @@ source_notes: []
 OBSEOF
 
 curl -s -X PUT \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   -H "Content-Type: text/markdown" \
   --data-binary @/tmp/obs_file.md \
   "https://echoapi.alwisp.com/vault/_agent/sessions/2026-06-05-1430-my-session.md"
@@ -109,7 +109,7 @@ Jason prefers concise status updates — lead with the decision.
 OBSEOF
 
 curl -s -X PATCH \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   -H "Operation: append" \
   -H "Target-Type: heading" \
   -H "Target: Operator Preferences::Fact / Pattern" \
@@ -124,7 +124,7 @@ When unsure of the exact heading path, GET the note with the document-map Accept
 
 ```bash
 curl -s \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   -H "Accept: application/vnd.olrapi.document-map+json" \
   "https://echoapi.alwisp.com/vault/_agent/memory/semantic/operator-preferences.md"
 ```
@@ -143,7 +143,7 @@ Same call with `Operation: prepend`.
 
 ```bash
 curl -s -X PATCH \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   -H "Operation: replace" \
   -H "Target-Type: frontmatter" \
   -H "Target: updated" \
@@ -158,7 +158,7 @@ curl -s -X PATCH \
 
 ```bash
 curl -s -X POST \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   "https://echoapi.alwisp.com/search/simple/?query=weekly+review"
 ```
 
@@ -170,7 +170,7 @@ Returns an array of `{ filename, score, matches: [{ context, match }] }`.
 
 ```bash
 curl -s -X DELETE \
-  -H "Authorization: Bearer 241265fbe6830934a9a4ad3e69335f64a42153b663aa5b0017cb1ea1217b2bab" \
+  -H "Authorization: Bearer $ECHO_KEY" \
   "https://echoapi.alwisp.com/vault/inbox/imports/old-note.md"
 ```