Support API

Anonymous same-origin JSON intake for the website contact form. Requires the website Origin and an Idempotency-Key of 20-128 letters, digits, hyphens or underscores. Creates no account or session. Saves the message and reply email before acknowledging it; the support worker delivers them to the configured support Slack channel.

The visitor-supplied email is contact information, never identity proof. Exact retries return the same acknowledgement without another delivery; a changed body with the same key is idempotency_mismatch.

At most 10 new messages per client IP per hour (IPv6 grouped by /64), 3 per email per day and 200 globally per hour; all requests share a 120-per-IP-per-minute limit. Retry-After is authoritative. Messages remain queued during delivery failures; delivered records expire after 30 days.

Availability and hours for any active project. chat_allowed is true for every active project, including Standard. human_available is true when a person can join the chat on request (Education, Premium and Enterprise); Standard and Plus get documentation and AI support. staffed says whether staff are in their hours now. Luna answers right away on every plan.

Project conversations, newest first, at most 100. Staff unread counts are per authenticated person or agent.

Available on every plan; Luna answers first, right away. Where a person can join (human_available on the support status) a request for one pauses Luna for staff; on Standard and Plus it is ignored and Luna answers. Screened before storage or Slack.

An opening message under 8 characters or 3 words returns submission_too_short; one that is not a question or problem returns submission_unclear; spam, link-heavy text, prompt injection and unsafe text return submission_rejected. Rejected text is not retained or sent to Luna, and the problem detail never repeats it.

Credential-shaped text other than ScreenRig credentials (bearer tokens, cloud and API keys, private keys) is replaced with [redacted] before storage; ScreenRig credential material returns invalid_request. A new conversation starts one Slack thread; follow-ups stay in it. Requests with the same key replay for 24 hours, a refusal included.

Messages in project conversation, ascending sequence, at most 100. Continue after the last message sequence for older conversation pagination. Reading does not acknowledge staff unread state.

Adds a customer message to an open conversation. A follow-up has no minimum length and is never refused as unclear on its own ("thanks", "yes"); it is screened for safety, prompt injection and link spam, refused with submission_rejected, and credential-shaped text is handled as for a new conversation.

Rejected text is not retained, and a refusal replays under the same key for 24 hours.

Monotonically acknowledge messages through sequence for this reader. Cannot acknowledge beyond the conversation last_sequence.

End this project conversation and cancel pending AI replies. Repeatable; preserves history. Staff can reopen it in Slack.

Project support messages on every plan as resumable SSE. event is support.message; id is the project support sequence, data is SupportMessage. after takes precedence over Last-Event-ID. Cursor 0 replays history. Staff, customer and AI messages are distinguished by role. Streams revalidate credentials and active project access.

No screenshot or credential data is sent.