Intake

Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.

POST /api/toolkit/intake

Record the answers given at the door

Public, unauthenticated, rate-limited per IP. ASKED ONCE, FIRST ANSWER WINS — the staging table's primary key is the normalised email and the write is ON CONFLICT DO NOTHING, so a second call for the same identity answers 200 with recorded: false and changes nothing. Run it twice with different answers to see it. A code write is only stored when that address already holds an invitation; when it does not, the answer is the same 200 recorded: false, so this door cannot be used to find out who was invited. The answers are adopted onto the house at signup — nothing here creates an account, an organisation or a session.

Request body — application/json

{
  "email": "[email protected]",
  "source": "code",
  "answers": {
    "audience": [
      "label"
    ],
    "volume": [
      "under-20"
    ],
    "draws": [
      "packshots"
    ],
    "aiToday": [
      "packshots"
    ],
    "pain": [
      "details"
    ],
    "painText": "string",
    "cost": [
      "reshoots"
    ]
  },
  "link": "string",
  "code": "string"
}

Responses

200 returns:

{
  "recorded": true
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/intake" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","source":"code","answers":{"audience":["label"],"volume":["under-20"],"draws":["packshots"],"aiToday":["packshots"],"pain":["details"],"painText":"string","cost":["reshoots"]},"link":"string","code":"string"}'