> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sitevisit.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue a capture-link token

> Issue a short-lived URL/QR token granting media-upload access to a single resource (today: an action item's evidence or completion photo). The capture URL renders a phone-friendly camera view at /c/<token> with no sign-in required. 24h TTL by default, capped at 7 days. Pass an Idempotency-Key for safe retries.



## OpenAPI

````yaml /api-reference/openapi.json post /capture-tokens
openapi: 3.1.0
info:
  title: SiteVisit AI API
  version: 1.0.0
  description: >-
    Public REST API for SiteVisit AI. Read and write properties, site visits,
    and action items from your account. 


    ## Authentication


    Authenticate with a `Bearer sv_live_...` token issued in Settings →
    Developers. Two key modes are supported:


    - **Live keys (`sv_live_*`)** — operate on your real customer data. Counts
    against plan limits, fires real webhooks + PostHog activation events.

    - **Test keys (`sv_test_*`)** — operate on a parallel sandbox dataset (every
    resource is tagged `isTest=true`). Test data is free + unmetered, never
    counts against plan limits, and never crosses into live data. Use for
    development + integration testing without touching production.


    Test-mode webhook endpoints (configured with `mode=test` in the Settings UI)
    only receive events triggered by test keys; live endpoints only receive live
    events. Webhook payloads include a `livemode: bool` flag so receivers can
    branch without parsing the resource.
  contact:
    name: SiteVisit AI Support
    email: support@sitevisit.app
servers:
  - url: https://sitevisit.app/api/v1
    description: Production
security:
  - bearerAuth: []
paths:
  /capture-tokens:
    post:
      summary: Issue a capture-link token
      description: >-
        Issue a short-lived URL/QR token granting media-upload access to a
        single resource (today: an action item's evidence or completion photo).
        The capture URL renders a phone-friendly camera view at /c/<token> with
        no sign-in required. 24h TTL by default, capped at 7 days. Pass an
        Idempotency-Key for safe retries.
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                target_type:
                  type: string
                  enum:
                    - action_item
                    - action_item_completion
                target_id:
                  type: string
                ttl_hours:
                  type: integer
                  minimum: 1
                  maximum: 168
                  default: 24
                upload_limit:
                  type: integer
                  minimum: 1
                  maximum: 100
                  default: 20
              required:
                - target_type
                - target_id
              additionalProperties: false
      responses:
        '201':
          description: Capture token issued.
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  capture_url:
                    type: string
                    format: uri
                  expires_at:
                    type: string
                    format: date-time
                  upload_limit:
                    type: integer
                required:
                  - token
                  - capture_url
                  - expires_at
                  - upload_limit
        '400':
          description: Validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Target resource not found or not owned by this account.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: >-
        Optional idempotency key, scoped to the authenticated account. Repeating
        a write with the same key + same body returns the original response;
        same key + different body returns 422 idempotency_key_in_use.
      schema:
        type: string
        maxLength: 255
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: invalid_api_key
            message:
              type: string
              example: The API key provided is invalid, revoked, or doesn't exist.
            docs_url:
              type: string
              format: uri
            request_id:
              type: string
              example: req_abc123
          required:
            - code
            - message
            - docs_url
            - request_id
      required:
        - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sv_live_xxx (or sv_test_xxx for sandbox mode)
      description: >-
        Bearer API key. Two modes: `sv_live_*` for production data, `sv_test_*`
        for a parallel sandbox dataset that doesn't count against plan limits.
        Issued from Settings → Developers in the SiteVisit app.

````