Feedback4.dev REST API v1

OpenAPI 3.1 is published at https://feedback4.dev/openapi.json. The original versioned URL, https://feedback4.dev/api/v1/openapi.json, remains available for compatibility.

Every business operation uses Authorization: Bearer f4_live_…. API keys expire after 1–365 days, carry explicit scopes, and may be restricted to one project. The secret is returned once and only its hash is stored.

• Inspect the current key boundary with GET /me.
• Create and list projects; read widget installation data; configure the project agent mode.
• List tickets, fetch exact selected-element context, update status/priority/assignee, read the proposed prompt, and request client approval.
• Authorize or revoke project reviewers and invalidate their active sessions.
• Manage workspace members and invitations with workspace-scoped keys.
• Issue or revoke project-scoped MCP credentials and configure durable signed webhook endpoints.

curl -fsS https://feedback4.dev/api/v1/me \
  -H "Authorization: Bearer $FEEDBACK4_API_KEY" \
  -H "X-Request-Id: integration-check-001"

• Authenticated responses use Cache-Control: no-store and carry X-Request-Id.
• JSON write bodies are limited to 64 KiB and reject unknown fields.
• Collection cursors are opaque. Read limits are 300/minute and write limits are 120/minute per key; 429 responses include Retry-After.
• A project-scoped key cannot create projects or manage workspace members, even if those scopes were requested.