# URL shortener service brief

The service needs public operations to create a short URL, resolve a slug, and
read aggregate click statistics. Clients include a browser extension and a
mobile app, so contracts must remain backward compatible.

Known constraints:

- Destination URLs are supplied by untrusted users.
- Slugs are six to twelve URL-safe characters.
- A missing slug and an expired slug must be distinguishable to operators, but
  the public API must not expose internal storage details.
- Statistics may be delayed by up to one minute.

Still undecided:

- Whether callers may request custom slugs.
- Whether links expire by default.
- Whether statistics require authentication.