---
title: "Draw a freehand stroke"
method: POST
path: "/api/boards/{boardId}/strokes"
tags: ["Items"]
---

# Draw a freehand stroke

`POST /api/boards/{boardId}/strokes`

## Request

- Base URL: `https://cnvs.app`
- URL: `https://cnvs.app/api/boards/{boardId}/strokes`
- Auth: none declared

Mirrors the MCP `draw_stroke` tool. Stroke width is fixed at 3 px; `color` is a NAME, not hex (case-insensitive): `auto`/`black`/omitted for theme-aware ink, or `red`, `blue`, `green`, `orange`, `yellow`, `pink`, `purple`, `maroon`, `brown`, `gray`, `lightgray`, `teal`, `sage`, `sky`, `lavender` — anything else (including a literal hex) silently clamps to `auto`. Accepts points as nested `[[x,y],...]`, flat `[x1,y1,x2,y2,...]`, or a JSON string of either — the server normalises.

## Request body

- AddStrokeRequest
  - `id` string
  - `points` union, required: Ordered points. Accepts `[[x,y],[x,y],...]`, flat `[x1,y1,x2,y2,...]`, or a JSON string of either.
    - array[]
      - number[]
    - number[]
    - string
  - `color` 'auto' | 'black' | 'red' | 'blue' | 'green' | 'orange' | 'yellow' | 'pink' | 'purple' | 'maroon' | 'brown' | 'gray' | 'lightgray' | 'teal' | 'sage' | 'sky' | 'lavender': Ink color NAME — same options as for text. Case-insensitive. Custom hex is rejected-with-clamp, not accepted literally.
  - `author` string: Author tag, charset `[A-Za-z0-9:_\-.]`, max 80 chars. Defaults to `ai:rest` for REST mutations. Use `ai:<your-label>` (e.g. `ai:claude`, `ai:mybot`) so humans can tell AI edits apart.

## Response `200`

Stroke drawn.

- object
  - `id` string
  - `pointCount` integer
  - `color` string
  - `bbox` object
    - `x` integer
    - `y` integer
    - `width` integer
    - `height` integer
  - `author` string

## Other responses

- `400`: Invalid input (missing or malformed board id).
- `401`: Board is access-locked and the request did not carry a valid key. `lockMode` tells the client whether to prompt for a code or just disable write UI.
- `404`: Board does not exist or was deleted within the 30-day tombstone window.
- `413`: Per-board quota exceeded (too many texts, images, strokes, or total image bytes). Response body names the specific limit that was hit.
- `429`: Rate limit exceeded. Standard REST/MCP: 60 requests/10s/board; valid X-Import-Token infrastructure tier: 600/10s/board; browser WebSocket always 60/10s/board. REST/MCP enforcement is soft per-isolate; WebSocket enforcement is strong per Durable Object.

---

[API](https://skmtc.dev/cnvs/apis/cnvs-app-http-api.md) · [All operations](https://skmtc.dev/cnvs/apis/cnvs-app-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cnvs/apis/cnvs-app-http-api/revisions/c8f2c3b7ff90?raw)