REST API

The REST API lets scripts and other tools list projects, read feedback, change its status and tags, and comment. It's a small, stable part of what the dashboard does.

Base URL: https://feedback-api.cec.dev/v1
OpenAPI document: https://feedback-api.cec.dev/v1/openapi.json, with every request and response shape. Load it into Postman, Insomnia or a client generator.

Authentication

Create an access token under Account › Access Tokens (see Your account) and send it with every request:

curl https://feedback-api.cec.dev/v1/projects \
  -H "Authorization: Bearer fbk_…"

The token acts as you. It sees exactly what you can see in the dashboard, and comments and status changes are recorded under your name. Keep it out of code repositories, and revoke it if it leaks.

Endpoints

Method and path	What it does
`GET /v1/projects`	Lists the team's projects.
`GET /v1/feedback?projectId=prj_…`	Lists a project's feedback, newest first. `projectId` is required.
`GET /v1/feedback/:id`	Gets one feedback item with its details.
`PATCH /v1/feedback/:id`	Changes `title`, `description`, `status`, `visibility` or `tagIds`.
`GET /v1/feedback/:id/comments`	Lists a feedback item's comments.
`POST /v1/feedback/:id/comments`	Adds a comment: `body` (markdown), and optionally `visibility`.
`GET /v1/attachments/:id`	Redirects to a short-lived link for a screenshot, recording or other file.

GET /v1/feedback takes the same filters as the dashboard's Feedback tab, as query parameters: status (open or resolved), tags, page, device and q for text search, plus from and to dates.

Examples

Resolve a feedback item:

curl -X PATCH https://feedback-api.cec.dev/v1/feedback/fb_01JC8Z6P9A1B2C3D4E5F6G7H8J \
  -H "Authorization: Bearer fbk_…" \
  -H "Content-Type: application/json" \
  -d '{ "status": "resolved" }'

Reply to it, for the CEC team only:

curl -X POST https://feedback-api.cec.dev/v1/feedback/fb_01JC8Z6P9A1B2C3D4E5F6G7H8J/comments \
  -H "Authorization: Bearer fbk_…" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Fixed in release 1.4.", "visibility": "members" }'

Conventions

IDs have a prefix that says what they are: prj_ projects, fb_ feedback, cmt_ comments, tag_ tags, att_ attachments.
Times are ISO 8601 strings in UTC, such as 2026-11-05T09:30:00.000Z.
Pages: lists return { items, nextCursor }. Pass nextCursor back as ?cursor= to get the next page, until it's null. limit is 50 by default and at most 100.
Rate limit: 300 requests a minute per token. Over that, the API answers 429; wait a minute and try again.

Errors

Errors share one shape:

{
  "error": { "code": "not_found", "message": "Feedback not found" },
  "requestId": "req_…"
}

Status	`code`	Meaning
400	`bad_request`, `validation_failed`	The request is malformed, or a field is invalid. `details` says which.
401	`unauthorized`	The token is missing, wrong, expired or revoked.
403	`forbidden`	The token can't do this.
404	`not_found`	The item doesn't exist, or you can't see it.
429	`rate_limited`	Too many requests; slow down.
500	`internal`	Something went wrong on our side. Send the CEC team the `requestId`.

Every response also carries the request ID in the x-request-id header.

Events instead of polling

To react to new feedback or comments as they happen, set up a webhook rather than polling the API.

AuthenticationCopy Anchor Link

EndpointsCopy Anchor Link

ExamplesCopy Anchor Link

ConventionsCopy Anchor Link

ErrorsCopy Anchor Link