Quick Capture API

Create an idea via a capture token — no login required — plus the two JWT-authenticated routes that manage that token.

For the product-level behavior (what a token is, how it's managed, and known limitations), see Quick Capture. This page is the endpoint-by-endpoint wire contract; the authoritative spec is specs/api/quick-capture.md in the repo.

Route summary

Method	Path	Auth	Description
`POST`	`/api/quick-capture`	`X-Capture-Token` header	Create an idea via token
`POST`	`/api/quick-capture/token`	JWT	Generate a token
`DELETE`	`/api/quick-capture/token`	JWT	Revoke your active token

⚠️

POST /api/quick-capture is the only route in the entire API that bypasses the JWT authorizer. It's the intentional exception, not a bug — see API-wide conventions and Authorization.

Capture

POST /api/quick-capture
X-Capture-Token: <token>

⚠️

The title field is not stored as the title — same rule as POST /api/ideas. It's treated as free-form content; Bedrock generates the real title from it, and your original text is stored as description. A description field in the body is ignored entirely — only title and tags are read.

Body

{
  "title": "Just shipped dark mode — here's what broke and how we fixed it",
  "tags": ["engineering", "shipping"]
}

tags is optional (defaults to []).

Response 201

{ "idea_id": "3f9e...", "status": "created" }

Unlike POST /api/ideas, this response is intentionally minimal — it does not echo the full idea object.

Status	Meaning
`201`	Idea created
`400`	`title` missing/blank after trim (error message: "title is required")
`401`	`X-Capture-Token` header missing
`401`	Token doesn't exist, or is marked revoked
`403`	The token's own user is no longer a member of the token's workspace

Validation order: token header present → token exists & not revoked → token's user is still a workspace member → title non-empty.

No Slack notification is sent and no per-route rate limit applies to this endpoint — both were part of an earlier design that was never implemented. See Known limitations.

Create Token

POST /api/quick-capture/token

Requires a JWT; you must be a member of workspace_id.

Body

{ "workspace_id": "ws-1" }

Response 201

{
  "token": "b6f2c9de-1a2b-4c3d-9e8f-abcdef123456",
  "api_url": "https://api.lkwiz.dev/api/quick-capture"
}

Status	Meaning
`201`	Token generated
`400`	`workspace_id` missing/blank
`401`	No caller identity
`403`	Caller is not a member of `workspace_id`

⚠️

Generating a new token does not invalidate any previous one. The old QCTOKEN record is left in the table, still valid — only the "current token" pointers on your user profile and the workspace move to the new value. See Token lifecycle.

Delete Token

DELETE /api/quick-capture/token

Requires a JWT. No body. Revokes your own currently-active token only — there's no workspace or ownership parameter, because it always acts on your active_qc_token.

Response 204 — always, whether or not you had an active token.

Status	Meaning
`204`	No active token (no-op) or the active token was deleted
`401`	No caller identity

⚠️

This is a hard delete of the token record — not a "set revoked flag" soft-revoke. It also only ever removes the one token tracked as your active_qc_token; any older, orphaned token from a prior regeneration keeps working. See Known limitations.