---
title: "Create a saved reply"
method: POST
path: "/v1/projects/{project}/support/canned-replies"
tags: ["Support Inbox"]
---

# Create a saved reply

`POST /v1/projects/{project}/support/canned-replies`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/support/canned-replies`
- Auth: HTTP bearer

```bash
curl -X POST https://api.subscriby.net/v1/projects/$PROJECT_ID/support/canned-replies \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Opening hours",
    "body": "We answer between 9 and 5, Monday to Friday.",
    "shortcut": "hours"
  }'
```

Answers `201` with the snippet and emits `support.canned_reply.created`.

> **A duplicate shortcut is a 422, not a second snippet.** Shortcuts are unique per project. Sending a shortcut another saved reply on the same project already uses is refused on `shortcut`. Two different projects may both have `hours`.

## Path parameters

- `project` string, uuid, required

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- StoreSupportCannedReplyRequest: A new saved reply: the words, the label the picker shows and, optionally, the shortcut and position.
  - `title` string, required: The label shown in the picker, 2 to 80 characters; never sent to the member.
  - `body` string, required: The text sent to the member, 2 to 4,000 characters, the message ceiling the reply has to fit once it is sent.
  - `shortcut` string, nullable: Up to 30 letters, numbers, dashes and underscores, unique within the project (two projects may both have `hours`). Omit it, or send null or an empty string, for none. The character set means a shortcut can never be confused with a bot command or need escaping when echoed back.
  - `sort_order` integer: The position in the picker, 0 to 999. Defaults to 0.

## Response `201`

The snippet.

- object
  - `data` SupportCannedReplyResource, required: A saved reply: a reusable snippet the support inbox composer expands from a shortcut or picks from a list.
    - `id` string, required: The snippet's id.
    - `project_id` string, required: The project the snippet belongs to.
    - `title` string, required: The label shown in the picker, 2 to 80 characters; never sent to the member.
    - `body` string, required: The text sent to the member when the snippet is used, 2 to 4,000 characters.
    - `shortcut` string, nullable, required: What the creator types in the composer to pull the snippet in, up to 30 letters, numbers, dashes and underscores, unique within the project; null when the snippet is picked from the list instead.
    - `sort_order` integer, required: The snippet's position in the picker, 0 to 999.
    - `created_at` string, nullable, required: When the snippet was created, ISO 8601.
    - `updated_at` string, nullable, required: When the snippet last changed, ISO 8601.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when `title` or `body` is missing or out of range, `shortcut` is malformed or already used on the project, or `sort_order` is outside 0 to 999.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)