---
title: "Commit a quoted gift"
method: POST
path: "/sends"
tags: ["Gifts", "Human only"]
---

# Commit a quoted gift

`POST /sends`

## Request

- Base URL: `https://gtmswag.com/api/v1`
- URL: `https://gtmswag.com/api/v1/sends`
- Auth: API key in cookie `gtm_session`

Human only: A signed-in teammate does this in the browser at gtmswag.com. API keys and OAuth connections receive 403 HUMAN_APPROVAL_REQUIRED with a `url` to hand to that person. Commits a quote with an `idempotencyKey` within the approved campaign. Paid campaigns prepare gifts on their own after payment; playbook gifts go through approval (409 APPROVAL_REQUIRED). The body is validated first, so a key with an invalid body gets 400 before 403.

## Request body

- object
  - `attribution` Attribution: Reporting references; no secrets/PII.
    - `externalId` string: External record ID (recipient contact ID).
    - `source` string: Source system or list name.
    - `contactId` string: External CRM contact ID.
    - `accountId` string: External CRM account ID.
    - `opportunityId` string: External CRM opportunity ID.
    - `metadata` object: Source labels; no secrets/PII.
  - `productId` string, required: Current catalog gift ID; never invented.
  - `recipient` RecipientInput, required
    - `name` string: Recipient's full name.
    - `recipientId` string: Stable workspace recipient ID; never infer from a name.
    - `sourceSystem` string: Original source system name; pair with externalId for stable matching.
    - `profileUrl` string, uri: Supplied personal profile URL; photo sourcing requires separate permission.
    - `importId` string: Stable customer import ID; reuse with identical retry data.
    - `importRowId` string: Stable source row ID within an import.
    - `photo` union: Portrait upload or LinkedIn sourcing.
      - RecipientPhotoUpload
        - `source` 'upload', required: upload: owned asset; linkedin: staff sourcing.
        - `assetId` string, required: Owned portrait asset_ ID from upload/import.
        - `rightsConfirmed` true: True only with explicit photo-use permission.
      - RecipientPhotoLinkedIn
        - `source` 'linkedin', required: upload: owned asset; linkedin: staff sourcing.
        - `profileUrl` string, uri, required: Supplied personal profile URL; photo sourcing requires separate permission.
    - `adultRecipientConfirmed` boolean: Explicit 21+ and adult-signature confirmation.
    - `assetIds` string[]: Owned artwork asset IDs uploaded to this workspace.
    - `externalId` string: External record ID (recipient contact ID).
    - `email` union: An email address, or an empty string for none. Both variants are strings, so the union has no discriminator.
      - ''
      - string, email
    - `company` string: Recipient company; used for {{company}}.
    - `title` string: Recipient's job title.
    - `context` string: Recipient background from customer.
    - `customTag` string: Value for {{custom}} in this note.
    - `address` string: Street and unit; required when known.
    - `city` string: US city; required when known.
    - `state` string: US state/DC code; required when known.
    - `zip` string: US ZIP/ZIP+4; required when known.
    - `country` 'US': Delivery country; US only.
    - `addressMode` 'known' | 'confirm': known: complete sender-supplied US shipping address. confirm: address unknown; the recipient confirms it through a private gift link where the workspace allows it, including a qualified prepaid offer shown on the campaign preview. Otherwise live address-free gifts are refused with LIVE_ADDRESSLESS_UNAVAILABLE.
    - `message` string: Printed note; blank uses campaign fallback.
    - `details` object: Per-recipient gift details keyed by the gift's recipientDetails keys, such as companyLogo or team. Required ones must be filled before approval.
  - `message` string, required: Printed note and recipient fallback.
  - `senderName` string, required: Gift sender's name.
  - `senderCompany` string, required: Gift sender's company.
  - `meetingUrl` union: An absolute URL, or an empty string for none. Both variants are strings, so the union has no discriminator.
    - ''
    - string, uri
  - `campaignId` string: Campaign ID (cmp_): a saved campaign or playbook.
  - `idempotencyKey` string, required: Same key for identical retries only.
  - `customization` Customization: displayText: lettering; logoAssetId: artwork; giftLinkContactEmail: public sender contact; giftLinkWelcome: private-link welcome (400 chars, {{firstName}}/{{company}}), separate from the printed note.
  - `quoteId` string, required: Quote ID (quo_): a saved send quote.

## Response `201`

Success: `{"data": Send}`.

- SendResponse: The success body: `{"data": Send}`.
  - `data` Send, required: One gift (send) with its immutable mode, status, outcome and timeline.
    - `id` string, required
    - `recipient` Recipient, required
      - `recipientId` string, required
      - `name` string, required
      - `email` string, required
      - `company` string, required
      - `sourceSystem` string
      - `externalId` string
      - `profileUrl` string
      - `importId` string
      - `importRowId` string
      - `addressMode` 'known' | 'confirm'
    - `campaignId` string, nullable, required
    - `status` 'awaiting_address' | 'queued' | 'in_production' | 'shipped' | 'delivered' | 'cancelled', required
    - `totalCents` integer, required
    - `testMode` boolean, required
    - `fundedBy` 'balance': balance: the gift was paid from the workspace balance when it was approved; it never needs a checkout.
    - `autoApproved` boolean: true when the playbook's auto-approve rule approved the gift rather than a person.

## Other responses

- `400`: Bad request: `VALIDATION_ERROR`, `INVALID_JSON`. Each example says when.
- `401`: Not authenticated: `AUTH_REQUIRED`. no credentials, or an OAuth token on a route that only takes workspace keys; the key is malformed, unknown or revoked.
- `403`: Forbidden: `HUMAN_APPROVAL_REQUIRED`, `CAMPAIGN_REQUIRED`. Each example says when.
- `404`: Not found: `NOT_FOUND`. Each example says when.
- `409`: Conflict: `IDEMPOTENCY_CONFLICT`, `QUOTE_EXPIRED`, `QUOTE_CHANGED`, `MODE_CHANGED`, `APPROVAL_REQUIRED`, `POLICY_CHANGED`, `CAMPAIGN_PAYMENT_REQUIRED`, `DUPLICATE_SEND`. Each example says when.
- `413`: Request too large: `INVALID_REQUEST`. the body exceeds 1 MiB.
- `415`: Unsupported media type: `INVALID_REQUEST`. a write with a body that is not `Content-Type: application/json` (a key request with no body needs no Content-Type).
- `429`: Too many requests: `RATE_LIMIT`. more than 240 requests in the current minute for this workspace (REST and MCP share the limit); wait `retryAfterMs`.
- `default`: Any other refusal or failure, such as 403 CSRF (a cross-origin `Origin` header), 403 HTTPS_REQUIRED or 500 INTERNAL_ERROR, with what to do next.

---

[API](https://skmtc.dev/gtmswag/apis/gtm-swag-api.md) · [All operations](https://skmtc.dev/gtmswag/apis/gtm-swag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gtmswag/apis/gtm-swag-api/revisions/9ff86fa99afe?raw)