FLAM
API reference

Models

5 Models routes on the FLAM API: The casting board; One face; Add to your own model's dossier — her range, her build, her marks.

Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.

GET /api/toolkit/models

The casting board

House models plus this director's own. An exclusive face under a LIVE claim by SOMEONE ELSE is absent entirely — it can be neither bought nor cast, so showing it would be noise. Order: yours, then free, sale, exclusive; newest first inside each band.

Responses

StatusMeaning
200The board
401No valid session

200 returns:

{
  "models": [
    {
      "id": "string",
      "name": "string",
      "tier": "free",
      "priceCents": 0,
      "currency": "string",
      "coverUrl": "string",
      "previewUrls": [
        "string"
      ],
      "owned": true,
      "mine": true,
      "usable": true,
      "exclusiveYours": true,
      "createdAt": "2026-07-27T09:00:00.000Z"
    }
  ]
}

Call it

curl -X GET "https://api.flam.fashion/api/toolkit/models" \
  -H "Authorization: Bearer $FLAM_API_KEY"

GET /api/toolkit/models/{id}

One face

Same visibility rule as the board — out of scope is 404, never a 403 that leaks.

Parameters

InNameTypeRequiredNotes
pathidstringyes—

Responses

StatusMeaning
200The model
401No valid session
404Unknown, foreign, or claimed by another director

200 returns:

{
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X GET "https://api.flam.fashion/api/toolkit/models/{id}" \
  -H "Authorization: Bearer $FLAM_API_KEY"

PATCH /api/toolkit/models/{id}

Add to your own model's dossier — her range, her build, her marks

The optional step after a model's sheet holds. sheetAssetIds are the dossier sheets she just developed (the expressions sheet, the full-length build sheet); they are inserted AFTER the collage and BEFORE her original photographs, so identity_asset_ids always reads [collage, ...sheets, ...originals]. traits is MERGED, never replaced — a PATCH carrying only the five build fields cannot erase the face the casting wizard read an hour earlier, and a field she blanks to "" is a real correction that is honoured. HER OWN MODELS ONLY. A house model is the house's and a bought face is a licence to cast it, never to edit the row every other director reads, so a model this organization does not OWN is 403. Both keys are optional: a body with neither is a no-op that returns the row unchanged. Free — no tokens, no money. The sheets were paid for when they were developed.

Parameters

InNameTypeRequiredNotes
pathidstringyes—

Request body — application/json (required)

FieldTypeRequiredNotes
sheetAssetIdsstring[]noDossier sheets — must be the caller's own live assets
traitsobjectnoMerged into models.traits. height / build / presence / posture / hands / marks[]
{
  "sheetAssetIds": [
    "string"
  ],
  "traits": {}
}

Responses

StatusMeaning
200The updated model
400BAD_BODY / BAD_ASSET_IDS
401No valid session
403FORBIDDEN — not your model
404Unknown model, or a sheet asset is unknown, deleted or foreign — nothing was written

200 returns:

{
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X PATCH "https://api.flam.fashion/api/toolkit/models/{id}" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sheetAssetIds":["string"],"traits":{}}'

POST /api/toolkit/models/{id}/checkout

Open the hosted checkout for a face

REAL MONEY — owner only. This route NEVER grants; the payment webhook does. Order is claim (the cross-director gate) → reserve (the per-director gate) → create the checkout, and every failure after the claim releases what it took. A double-click gets the SAME url back (pending: true); an already-owned face answers already: true.

Parameters

InNameTypeRequiredNotes
pathidstringyes—

Responses

StatusMeaning
200The hosted page, the same live one, or "you already own this"
400ALREADY_YOURS / FREE_MODEL / NOT_FOR_SALE
401No valid session
403Only an owner may spend the house's money
404Unknown or another director's personal model
409TAKEN (the exclusive went to someone else) / CHECKOUT_PENDING
502CHECKOUT_FAILED
503BILLING_NOT_CONFIGURED

200 returns:

{
  "url": "string",
  "pending": true,
  "ok": true,
  "already": true,
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/models/{id}/checkout" \
  -H "Authorization: Bearer $FLAM_API_KEY"

POST /api/toolkit/models/own

Bring your own — register held assets as a personal model

Free by definition: the imagery is already the house's, so nothing is billed and the entitlement records source own. All-or-nothing — every assetId must be one of the caller's live assets.

Request body — application/json (required)

FieldTypeRequiredNotes
namestringyes—
assetIdsstring[]yesUnique
{
  "name": "string",
  "assetIds": [
    "string"
  ]
}

Responses

StatusMeaning
201The registered model
400BAD_BODY / NAME_REQUIRED / BAD_ASSET_IDS
401No valid session
404An assetId is unknown, deleted or foreign — nothing was written

201 returns:

{
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/models/own" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"string","assetIds":["string"]}'

Pipelines

9 Pipelines routes on the FLAM API: Saved plans — a line with no items bound; Save a plan as a preset; Delete a saved plan.

Brand

7 Brand routes on the FLAM API: The house's extracted visual DNA; Correct the extracted DNA, or switch the injection off; Read the house's visual DNA off.

On this page

GET /api/toolkit/modelsGET /api/toolkit/models/{id}PATCH /api/toolkit/models/{id}POST /api/toolkit/models/{id}/checkoutPOST /api/toolkit/models/own