Models

4 Models routes on the FLAM API: The casting board; One face; Open the hosted checkout for a face.

Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.

`GET /api/toolkit/models`

The casting board

House models plus this director's own. An exclusive face under a LIVE claim by SOMEONE ELSE is absent entirely — it can be neither bought nor cast, so showing it would be noise. Order: yours, then free, sale, exclusive; newest first inside each band.

Responses

Status	Meaning
`200`	The board
`401`	No valid session

200 returns:

{
  "models": [
    {
      "id": "string",
      "name": "string",
      "tier": "free",
      "priceCents": 0,
      "currency": "string",
      "coverUrl": "string",
      "previewUrls": [
        "string"
      ],
      "owned": true,
      "mine": true,
      "usable": true,
      "exclusiveYours": true,
      "createdAt": "2026-07-27T09:00:00.000Z"
    }
  ]
}

Call it

curl -X GET "https://api.flam.fashion/api/toolkit/models" \
  -H "Authorization: Bearer $FLAM_API_KEY"

`GET /api/toolkit/models/{id}`

One face

Same visibility rule as the board — out of scope is 404, never a 403 that leaks.

Parameters

In	Name	Type	Required	Notes
path	`id`	`string`	yes	—

Responses

Status	Meaning
`200`	The model
`401`	No valid session
`404`	Unknown

200 returns:

{
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X GET "https://api.flam.fashion/api/toolkit/models/{id}" \
  -H "Authorization: Bearer $FLAM_API_KEY"

`POST /api/toolkit/models/{id}/checkout`

Open the hosted checkout for a face

REAL MONEY — owner only. This route NEVER grants; the payment webhook does. Order is claim (the cross-director gate) → reserve (the per-director gate) → create the checkout, and every failure after the claim releases what it took. A double-click gets the SAME url back (pending: true); an already-owned face answers already: true.

Parameters

In	Name	Type	Required	Notes
path	`id`	`string`	yes	—

Responses

Status	Meaning
`200`	The hosted page, the same live one, or "you already own this"
`400`	ALREADY_YOURS / FREE_MODEL / NOT_FOR_SALE
`401`	No valid session
`403`	Only an owner may spend the house's money
`404`	Unknown or another director's personal model
`409`	TAKEN (the exclusive went to someone else) / CHECKOUT_PENDING
`502`	CHECKOUT_FAILED
`503`	BILLING_NOT_CONFIGURED

200 returns:

{
  "url": "string",
  "pending": true,
  "ok": true,
  "already": true,
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/models/{id}/checkout" \
  -H "Authorization: Bearer $FLAM_API_KEY"

`POST /api/toolkit/models/own`

Bring your own — register held assets as a personal model

Free by definition: the imagery is already the house's, so nothing is billed and the entitlement records source own. All-or-nothing — every assetId must be one of the caller's live assets.

Request body — application/json (required)

Field	Type	Required	Notes
`name`	`string`	yes	—
`assetIds`	`string[]`	yes	Unique

{
  "name": "string",
  "assetIds": [
    "string"
  ]
}

Responses

Status	Meaning
`201`	The registered model
`400`	BAD_BODY / NAME_REQUIRED / BAD_ASSET_IDS
`401`	No valid session
`404`	An assetId is unknown

201 returns:

{
  "model": {
    "id": "string",
    "name": "string",
    "tier": "free",
    "priceCents": 0,
    "currency": "string",
    "coverUrl": "string",
    "previewUrls": [
      "string"
    ],
    "owned": true,
    "mine": true,
    "usable": true,
    "exclusiveYours": true,
    "createdAt": "2026-07-27T09:00:00.000Z"
  }
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/models/own" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"string","assetIds":["string"]}'

Models

GET /api/toolkit/models

GET /api/toolkit/models/{id}

POST /api/toolkit/models/{id}/checkout

POST /api/toolkit/models/own

On this page

`GET /api/toolkit/models`

`GET /api/toolkit/models/{id}`

`POST /api/toolkit/models/{id}/checkout`

`POST /api/toolkit/models/own`