Backend contract

Service ownership

Area	Owner
Widget config, changelog visibility, contact inbox, feature requests, roadmap, integrations	API service
SDK identity handoff	Runtime service
Access tokens and user authentication	Auth service

Public SDK endpoints

The SDK and widget use project key based public routes.

GET  /sdk/config
POST /sdk/identify
POST /sdk/contact-submissions
GET  /sdk/feature-requests/categories
GET  /sdk/feature-requests
POST /sdk/feature-requests
GET  /sdk/feature-requests/:id/comments
POST /sdk/feature-requests/:id/comments
POST /sdk/feature-requests/:id/vote
GET  /sdk/roadmap/snapshot
GET  /sdk/roadmap/:id
POST /sdk/roadmap/:id/follow

Dashboard-owned APIs

Dashboard moderation and setup APIs are JWT protected and project scoped.

Feature request moderation:

GET    /projects/:projectId/feature-requests
GET    /projects/:projectId/feature-requests/:id
PATCH  /projects/:projectId/feature-requests/:id
DELETE /projects/:projectId/feature-requests/:id
GET    /projects/:projectId/feature-requests/:id/comments
DELETE /projects/:projectId/feature-requests/:id/comments/:commentId

Contact Inbox:

GET    /projects/:projectId/contact-submissions
GET    /projects/:projectId/contact-submissions/:submissionId
PATCH  /projects/:projectId/contact-submissions/:submissionId/status
DELETE /projects/:projectId/contact-submissions/:submissionId
POST   /projects/:projectId/contact-submissions/:submissionId/export

Integrations:

GET    /integrations/catalog
GET    /projects/:projectId/integrations
PATCH  /projects/:projectId/integrations/posthog
GET    /projects/:projectId/integrations/webhook_out/destinations
POST   /projects/:projectId/integrations/webhook_out/destinations
PATCH  /projects/:projectId/integrations/webhook_out/destinations/:connectionId
POST   /projects/:projectId/integrations/webhook_out/destinations/:connectionId/test
GET    /projects/:projectId/integrations/webhook_out/destinations/:connectionId/logs

Visibility rules

• Feature request public routes expose only kind = feature_request and reviewStatus = approved.
• New public feature request submissions start as pending and are hidden until dashboard review.
• Roadmap internal_only items are not public.
• Published changelog posts and roadmap items use dashboard-owned visibility settings before they render in the widget.
• Contact submissions are private dashboard records. They do not become public feature requests and they do not render in public widget lists.
• Integration destinations are delivery targets only. Postgres remains the source of truth for contact submissions and dashboard-owned records.

Widget config cache

Widget settings are the source of truth for /sdk/config. After widget create, update, or removal, the backend invalidates SDK config cache keys for the project and project key so newly loaded widgets receive fresh settings.

Integration rule

The SDK docs and public landing-page docs should stay aligned with the SDK source, npm packages, and backend contracts before a public release.