---
title: "Quote one gift on an approved campaign"
method: POST
path: "/quotes"
tags: ["Gifts"]
---

# Quote one gift on an approved campaign

`POST /quotes`

## Request

- Base URL: `https://gtmswag.com/api/v1`
- URL: `https://gtmswag.com/api/v1/quotes`
- Auth: HTTP bearer

Validates one roster person of an active batch or single campaign against its approved policy and saves a 15-minute quote. A quote never sends or pays; committing it needs a signed-in person. Playbook gifts go through `POST /playbooks/{id}/people` instead. In a live workspace an unknown address (`addressMode:"confirm"`) refuses with 409 LIVE_ADDRESSLESS_UNAVAILABLE.

## Request body

- object
  - `attribution` Attribution: Reporting references; no secrets/PII.
    - `externalId` string: External record ID (recipient contact ID).
    - `source` string: Source system or list name.
    - `contactId` string: External CRM contact ID.
    - `accountId` string: External CRM account ID.
    - `opportunityId` string: External CRM opportunity ID.
    - `metadata` object: Source labels; no secrets/PII.
  - `productId` string, required: Current catalog gift ID; never invented.
  - `recipient` RecipientInput, required
    - `name` string: Recipient's full name.
    - `recipientId` string: Stable workspace recipient ID; never infer from a name.
    - `sourceSystem` string: Original source system name; pair with externalId for stable matching.
    - `profileUrl` string, uri: Supplied personal profile URL; photo sourcing requires separate permission.
    - `importId` string: Stable customer import ID; reuse with identical retry data.
    - `importRowId` string: Stable source row ID within an import.
    - `photo` union: Portrait upload or LinkedIn sourcing.
      - RecipientPhotoUpload
        - `source` 'upload', required: upload: owned asset; linkedin: staff sourcing.
        - `assetId` string, required: Owned portrait asset_ ID from upload/import.
        - `rightsConfirmed` true: True only with explicit photo-use permission.
      - RecipientPhotoLinkedIn
        - `source` 'linkedin', required: upload: owned asset; linkedin: staff sourcing.
        - `profileUrl` string, uri, required: Supplied personal profile URL; photo sourcing requires separate permission.
    - `adultRecipientConfirmed` boolean: Explicit 21+ and adult-signature confirmation.
    - `assetIds` string[]: Owned artwork asset IDs uploaded to this workspace.
    - `externalId` string: External record ID (recipient contact ID).
    - `email` union: An email address, or an empty string for none. Both variants are strings, so the union has no discriminator.
      - ''
      - string, email
    - `company` string: Recipient company; used for {{company}}.
    - `title` string: Recipient's job title.
    - `context` string: Recipient background from customer.
    - `customTag` string: Value for {{custom}} in this note.
    - `address` string: Street and unit; required when known.
    - `city` string: US city; required when known.
    - `state` string: US state/DC code; required when known.
    - `zip` string: US ZIP/ZIP+4; required when known.
    - `country` 'US': Delivery country; US only.
    - `addressMode` 'known' | 'confirm': known: complete sender-supplied US shipping address. confirm: address unknown; the recipient confirms it through a private gift link where the workspace allows it, including a qualified prepaid offer shown on the campaign preview. Otherwise live address-free gifts are refused with LIVE_ADDRESSLESS_UNAVAILABLE.
    - `message` string: Printed note; blank uses campaign fallback.
    - `details` object: Per-recipient gift details keyed by the gift's recipientDetails keys, such as companyLogo or team. Required ones must be filled before approval.
  - `message` string, required: Printed note and recipient fallback.
  - `senderName` string, required: Gift sender's name.
  - `senderCompany` string, required: Gift sender's company.
  - `meetingUrl` union: An absolute URL, or an empty string for none. Both variants are strings, so the union has no discriminator.
    - ''
    - string, uri
  - `campaignId` string: Campaign ID (cmp_): a saved campaign or playbook.
  - `idempotencyKey` string: Same key for identical retries only.
  - `customization` Customization: displayText: lettering; logoAssetId: artwork; giftLinkContactEmail: public sender contact; giftLinkWelcome: private-link welcome (400 chars, {{firstName}}/{{company}}), separate from the printed note.

## Response `201`

Success: `{"data": Quote}`.

- QuoteResponse: The success body: `{"data": Quote}`.
  - `data` Quote, required: A 15-minute quote for one roster person. It never sends or pays.
    - `id` string, required
    - `totalCents` integer, required
    - `expiresAt` string, required
    - `testMode` boolean, required
    - `subtotalCents` integer
    - `shippingCents` integer
    - `taxCents` integer
    - `taxPending` boolean
    - `attribution` object

## Other responses

- `400`: Bad request: `VALIDATION_ERROR`, `PORTRAIT_REQUIRED`, `ADULT_RECIPIENT_REQUIRED`, `PERSONALIZATION_REQUIRED`, `INVALID_JSON`. Each example says when.
- `401`: Not authenticated: `AUTH_REQUIRED`. no credentials, or an OAuth token on a route that only takes workspace keys; the key is malformed, unknown or revoked.
- `403`: Forbidden: `CAMPAIGN_REQUIRED`, `LIVE_NOT_READY`, `ARTWORK_UNAVAILABLE`, `POLICY_VIOLATION`, `RECIPIENT_SCOPE`, `MESSAGE_POLICY`, `CUSTOMIZATION_POLICY`. Each example says when.
- `404`: Not found: `NOT_FOUND`. Each example says when.
- `409`: Conflict: `LIVE_ADDRESSLESS_UNAVAILABLE`, `CAMPAIGN_INACTIVE`, `BUDGET_EXCEEDED`, `COUNT_EXCEEDED`, `QUOTE_CHANGED`, `GIFT_RETIRED`, `GIFT_UNAVAILABLE`, `PRICE_QUOTE_REQUIRED`. Each example says when.
- `413`: Request too large: `INVALID_REQUEST`. the body exceeds 1 MiB.
- `415`: Unsupported media type: `INVALID_REQUEST`. a write with a body that is not `Content-Type: application/json` (a key request with no body needs no Content-Type).
- `429`: Too many requests: `RATE_LIMIT`. more than 240 requests in the current minute for this workspace (REST and MCP share the limit); wait `retryAfterMs`.
- `default`: Any other refusal or failure, such as 403 CSRF (a cross-origin `Origin` header), 403 HTTPS_REQUIRED or 500 INTERNAL_ERROR, with what to do next.

---

[API](https://skmtc.dev/gtmswag/apis/gtm-swag-api.md) · [All operations](https://skmtc.dev/gtmswag/apis/gtm-swag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gtmswag/apis/gtm-swag-api/revisions/9ff86fa99afe?raw)