API overview

Base URL: https://feedback.bootstrapware.co. Responses wrap payloads in { "data": ... }.

Publishable (browser / widget)

Use a publishable key (bsw_test_pub_ / bsw_live_pub_) as Authorization: Bearer. These routes are what the Hosted <Feedback> widget calls.

• GET /api/v1/config/:boardId: published board config
• GET /api/v1/posts?boardId=: Hosted list (optional q searches beyond the loaded page)
• POST /api/v1/posts: Hosted create
• POST /api/v1/posts/:id: Hosted vote / unvote ({ "action": "vote" | "unvote", "author": { ... } })

Live config fetch requires BYO ($9.99) or Hosted ($19.99). Live Hosted post storage requires Hosted ($19.99). Test keys stay free. There is no public widget session API on Feedback.

Secret (server management)

Use a secret key (bsw_test_sec_ / bsw_live_sec_) as Bearer. Never put secret keys in the browser. These routes configure boards without the dashboard UI.

• GET /api/v1/boards: list boards in the key's workspace
• POST /api/v1/boards: create; body { "name": "Product ideas" }
• GET /api/v1/boards/:id: board, revisions, draft, and published config
• PATCH /api/v1/boards/:id: save draft name + config → { revisionId }
• POST /api/v1/boards/:id: publish; body { "action": "publish" }
• GET /api/v1/usage: aggregate operational counts for the workspace
• POST /api/v1/author-tokens: mint a short-lived host assertion

PATCH config accepts submissionsEnabled, votingEnabled, showVoteCounts, allowAnonymous, requireAuthorToken, emptyState, and optional branding. Public board URLs are not part of the product.

Create, draft, publish

# Create
curl -s -X POST https://feedback.bootstrapware.co/api/v1/boards \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name":"Product ideas"}'

# Save draft (replace BOARD_ID)
curl -s -X PATCH https://feedback.bootstrapware.co/api/v1/boards/BOARD_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"Product ideas",
    "config":{
      "submissionsEnabled":true,
      "votingEnabled":true,
      "showVoteCounts":true,
      "allowAnonymous":false,
      "emptyState":"No requests yet. Suggest one."
    }
  }'

# Publish
curl -s -X POST https://feedback.bootstrapware.co/api/v1/boards/BOARD_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish"}'

# Usage
curl -s https://feedback.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Still dashboard-only

Minting or revoking API keys, webhook endpoints, board delete, branding, billing, and the Hosted inbox stay on the platform dashboard (cookie session). The secret management API and MCP do not cover those.

Hosted MCP

The same board-management capabilities are exposed as HTTP MCP at https://feedback.bootstrapware.co/mcp. Prefer OAuth Connect: install the URL-only config from the Keys page, click Connect in Cursor, and approve, no secret is stored in mcp.json. A test secret pasted as a Bearer header still works as a fallback. Tools: list_boards, get_board, create_board, update_draft, publish_board, get_published_config, list_capabilities. Never send post title/body through MCP. See Agents for setup details.

Related: Configuration · Boards · API keys · AGENTS.md