Boards

Create a new board

Allocates a fresh UUID and returns a board immediately reachable at https://cnvs.app/#{id}. A bare POST creates a draw board. Optional {mode:"todo", template} creates a kanban board with kanban, sprint, or bugs starter columns.

Atomic board import: optional content, autolayout, lock, and author pre-fill and optionally PIN-lock the board in the same transaction; see BoardImportContent. The combined content arrays accept at most 2550 entries, lane titles at most 10, and the D1 batch at most 320 statements. Template columns do not count as input. In practice the 5 MB request-body cap (/quotas.json → perRequest.maxBodyBytes) is the binding limit for image-heavy imports, long before 2550 entries. Each lane index may be named at most once (a duplicate is 400 invalid_item on the second entry, not a last-write-wins collapse), and tasks[].done must be a real boolean. All content is validated first; any invalid item or quota error creates nothing. Draw items require draw mode; columns/tasks/lanes require todo mode. A response containing imported confirms support.

Autolayout fills missing draw-item coordinates deterministically. Lock at create returns the plaintext 8-char access_key once. Author is 1–80 chars and defaults to ai:import; every item may also carry its OWN author, which is preserved as the item's creator instead of being overwritten by the importer's tag. Item ids are always server-minted and returned in ids (per kind, in input order); declare a write-only sourceId on texts/images to have lines[].anchors endpoints remapped onto the minted ids. Embed readable boards at https://cnvs.app/?embed=1#{id}.

Rate tiers: standard callers get 5 creates/60s/IP. A valid server-to-server X-Import-Token selects 50 creates/60s/infrastructure token and 600 REST/MCP requests/10s/board. WebSockets remain 60/10s/board and lock/unlock/verify-key remain 5/60s/IP. The token never bypasses board access locks, import/field/operation/storage/body limits, validation, or Cloudflare platform limits. Invalid or unconfigured tokens return 403 invalid_import_token.

post/api/boards

Request

  • Base URL: https://cnvs.app
  • URL: https://cnvs.app/api/boards
  • Auth: none declared

Headers

X-Import-Tokenstring

Optional server-to-server credential. When it matches the operator-set IMPORT_TOKEN Worker secret it selects the infrastructure tiers: 600 REST/MCP requests/10s/board and 50 board creates/60s/infrastructure token (constant-time comparison; never logged). WebSockets stay at 60/10s/board and lock/unlock/verify-key stay at 5/60s/IP. It does not bypass board access locks, the 2550-item/320-statement import caps, validation, per-item/per-board quotas, request-body cap, or Cloudflare platform limits. Invalid or unconfigured token → 403 invalid_import_token. Omit for standard tiers.

Request body

mode'draw' | 'todo'

Initial board mode. Defaults to draw.

template'kanban' | 'sprint' | 'bugs'

Starter column set when mode is todo and content.columns is empty/absent. Defaults to kanban.

autolayoutboolean

Draw mode only: deterministically place texts/images that omit x/y (masonry grid; explicit coordinates are never touched). Without it, items missing coordinates are rejected 400 invalid_item. No-op in todo mode.

lock'write' | 'all'

PIN-lock the board atomically at create time. write = public reads, key-holders write; all = key required for everything. The plaintext key is returned ONCE as access_key — there is no recovery.

authorstring

Board-level author tag, inherited by every created item that does not carry its own author (e.g. ai:plai). 1-80 chars of [A-Za-z0-9:_\-.]. Defaults to ai:import. Per-item author wins where present — see BoardImportContent.

Response

New board created.

idstring required

Freshly allocated board UUID. Open at https://cnvs.app/#{id} — or https://cnvs.app/?embed=1#{id} for the minimal-chrome iframe embed view.

mode'draw' | 'todo' required

The created board's mode.

access_keystring

Only when lock was requested: the plaintext board key (8 chars a-z0-9), returned ONCE. There is no recovery.

Changes

No recorded changes to this operation across all 1 revision of this API.