/api/v1/feedback/tokenCreate one-time feedback token
Mints a single-use, opaque presigned feedback token (`efb_` + 32 random bytes) for embedding in customer-facing UIs. Body requires `projectId`; `traceId`, `expiresInHours` (default 72, clamped to 1..720) and `metadata` are optional. Only the SHA-256 hash is persisted in `feedback_tokens` — the raw token is returned once and never stored, and redemption at GET /api/v1/feedback/token verifies it by hashing the presented value and matching `token_hash`. There is no signature and no claims embedded in the token itself. Caller must be a member of the project's org AND hold `api_keys:create`, which the permission matrix starts at the editor role. Returns 201 with { id, token, url, expiresAt }.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Request body required
Example
{
"projectId": "00000000-0000-0000-0000-000000000000",
"traceId": "00000000-0000-0000-0000-000000000000",
"expiresInHours": 0,
"metadata": {}
}Schema
{
"application/json": {
"schema": {
"type": "object",
"properties": {
"projectId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"traceId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"expiresInHours": {
"type": "number"
},
"metadata": {
"type": "object",
"additionalProperties": {}
}
},
"required": [
"projectId"
],
"additionalProperties": {}
}
}
}Response
200 example
{
"token": "string",
"expires_at": "2026-01-01T00:00:00.000Z"
}All status codes
Code samples
cURL
curl -X POST \
https://evalguard.ai/api/v1/feedback/token \
-H "Authorization: Bearer $EVALGUARD_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "projectId": "00000000-0000-0000-0000-000000000000", "traceId": "00000000-0000-0000-0000-000000000000", "expiresInHours": 0, "metadata": {} }'TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/feedback/token", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"projectId": "00000000-0000-0000-0000-000000000000",
"traceId": "00000000-0000-0000-0000-000000000000",
"expiresInHours": 0,
"metadata": {}
}),
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
headers["Content-Type"] = "application/json"
response = requests.request(
"POST",
"https://evalguard.ai/api/v1/feedback/token",
headers=headers,
json={
"projectId": "00000000-0000-0000-0000-000000000000",
"traceId": "00000000-0000-0000-0000-000000000000",
"expiresInHours": 0,
"metadata": {}
},
)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
"strings"
)
func main() {
body := strings.NewReader(`{"projectId":"00000000-0000-0000-0000-000000000000","traceId":"00000000-0000-0000-0000-000000000000","expiresInHours":0,"metadata":{}}`)
req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/feedback/token", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}