Feedback

Filing a bug report or an idea from inside the app. Authenticated, and deliberately outside /workspaces/{workspaceId}: the report is addressed to the people who run the instance rather than to a workspace, which is also why it is session-only and why the workspace it names carries no authority. It travels with the screen it was written on, the build, the window, the pointer and a structural recording of what the app did — never with anything anybody wrote. Operators read them through the back office.

1 operation. Every path is relative to the instance origin; every response body is JSON unless stated. The endpoint descriptions below come straight from the server’s own route table. See API for authentication, errors and pagination.

POST /api/v1/feedback

File a bug report or an idea from inside the product (ADR-0039). Authenticated — the session hook covers it — but outside /workspaces/{workspaceId}, because the report is addressed to the instance OPERATOR rather than to a workspace, which also makes it session-only for tokens. Carries the machine's half of the report: the route pattern, the build, the viewport, the pointer and the flight recorder's markdown, which is structure-only by construction and holds no row text, title or meeting summary. workspaceId is where the sender was standing and is never used as an authorisation. Rate-limited per account. Answers an id and a receipt time, and promises no reply.

createFeedbackReport · token scope: session only

Request body — application/json, required

• kind · "bug" | "idea" — required
• message · string — required, length 1–4000
• workspaceId · string (uuid) | null — required
• context · object — required
  • route · string | null — required
  • appVersion · string | null — required
  • viewport · object | null — required
    • width · integer — required, 0–100000
    • height · integer — required, 0–100000
  • pointer · "coarse" | "fine" | null — required
  • trace · string | null — required

Response 200 — application/json

• id · string (uuid) — required
• receivedAt · string (date-time) — required

Response default — application/json

• error · object — required
  • code · "bad_request" | "validation_failed" | "unauthorized" | "forbidden" | "not_found" | "conflict" | "rate_limited" | "internal" — required
  • message · string — required
  • reason · string — length 1–64