---
title: "Open Handoff"
method: POST
path: "/api/comms/{team_key}/handoff/{handoff_key}/open"
tags: ["comms"]
---

# Open Handoff

`POST /api/comms/{team_key}/handoff/{handoff_key}/open`

## Request

- Base URL: `https://api.superit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.superit.ai/api/comms/{team_key}/handoff/{handoff_key}/open`
- Auth: HTTP bearer

Open an AgentHandoff, materialising a seeded engineer chat.

Engineers and admins only. Idempotent: a second open by the same
engineer returns the same chat without appending a duplicate seeded
turn. The handoff is marked ``opened`` on the first successful call.

The handoff detail/summary/question is agent-authored from
attacker-controllable ticket text, so it is seeded as a VISIBLE,
fenced ``sparky`` turn — never a SYSTEM turn — so prompt injection in
the ticket cannot be elevated to system-prompt level in the
engineer's Sparky (SECURITY: prompt-injection amplification).

## Path parameters

- `handoff_key` string, required
- `team_key` string, required

## Response `200`

Successful Response

- OpenHandoffResponse
  - `chat_key` string, required

## Other responses

- `400`: Invalid input
- `401`: Not authenticated
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: Conflict
- `422`: Validation Error

---

[API](https://skmtc.dev/superit/apis/super-it-api.md) - [All operations](https://skmtc.dev/superit/apis/super-it-api/llms.txt) - [OpenAPI document](https://skmtc.dev/superit/apis/super-it-api/revisions/4944d556c2bb?raw)