---
title: "Mint a publish/unpublish request token"
method: POST
path: "/experiences/request-token"
---

# Mint a publish/unpublish request token

`POST /experiences/request-token`

Mints a short-lived, opaque "request token" the app's creator surface forwards to Fanvue to ask the creator to confirm a publish or unpublish.

    The token is bound to the calling app (a token can only be minted for the app whose credentials make the call — otherwise 403) and to the acting creator, so it can only drive that creator's native confirmation modal.

    A publish request may narrow the access modes the creator is offered with `allowedAccessModes`; an incoherent constraint (empty, duplicated, or not containing `proposedAccessMode`) is rejected with 400 and a message naming the rule it broke.

## Headers

- `X-Fanvue-API-Version` string, required

## Request body

- union
  - object
    - `action` 'publish', required
    - `externalExperienceId` string, required
    - `title` string, required
    - `description` string, required
    - `imageUrl` string, uri, nullable — Public https URL of the experience cover image. Fanvue downloads and re-hosts it when the creator confirms the publish.
    - `proposedAccessMode` 'FREE' | 'SUBSCRIPTION' | 'PAID' | 'HIDDEN', required
    - `allowedAccessModes` string[] — Restricts which access modes the creator may choose in the Fanvue confirmation modal. Must contain `proposedAccessMode` and hold no duplicates. Omit to offer all four modes.
    - `proposedActions` object[] — Paid actions to offer inside this experience, for the creator to price when they confirm the publish. At most 10. `suggestedPriceCents` is a prefill only — the creator sets the amount that is charged, and may decline any action. Omit the field (or send an empty array) to propose none; an app cannot withdraw actions a creator has already priced.
      - `externalActionId` string, required
      - `title` string, required
      - `description` string, nullable
      - `suggestedPriceCents` integer
    - `deliveryMode` 'EMBEDDED' | 'EXTERNAL', required
    - `externalUrl` string, nullable
    - `appUuid` string, uuid, required
  - object
    - `action` 'unpublish', required
    - `experienceUuid` string, uuid, required
    - `title` string, required
    - `appUuid` string, uuid, required

## Response `200`

The minted request token

- object
  - `token` string, required — The opaque request token to forward to the creator surface for confirmation.

## Other responses

- `400` — Bad Request - API version not supported OR validation failed OR the requested allowedAccessModes constraint was rejected
- `401` — Unauthorized Response
- `403` — Unauthorized Response
- `410` — API version no longer supported (sunset)
- `429` — Too many requests - rate limit exceeded
- `502` — Failed to mint the request token with the upstream
- `503` — Developer API upstream is not configured

## Changes

- **2026-09-10** `4d08f36ad6c8` — 1 breaking, 3 warning, 2 info
  - added `subschema #3` to the response body `oneOf` list for the response status `400`
  - the `oneOf[subschema #1]/description` request property's maxLength was set to `500`
  - the `oneOf[subschema #1]/externalExperienceId` request property's maxLength was set to `255`
  - the `oneOf[subschema #1]/title` request property's maxLength was set to `100`
  - …2 more

[Change history](https://skmtc.dev/fanvue/apis/fanvue-api/changes/experiences/request-token/post.md)

---

[API](https://skmtc.dev/fanvue/apis/fanvue-api.md) · [All operations](https://skmtc.dev/fanvue/apis/fanvue-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fanvue/apis/fanvue-api/revisions/431868e8a264?raw)