Spec is here. In a nutshell, it uses nip98 for auth, then allows regular HTTP verbs such as GET and PUT (read and write). There's basic access control policies that can be extended. I worked on a similar system called Solid for years, and I'm basically porting it to nostr.