---
title: "Assemble Mindset"
method: POST
path: "/api/mindsets/assemble"
tags: ["mindsets"]
---

# Assemble Mindset

`POST /api/mindsets/assemble`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/mindsets/assemble`
- Auth: none declared

Draft only - never persisted. Confirm with POST /assemble/confirm.

## Headers

- `x-impersonate-identity-id` string, nullable

## Request body

- AssembleRequest: No ``identity_id`` field (TOS-1912 Unit B gate fix): the resolving/paying identity for the ``mindset_assemble`` AI pass is always the CALLER (``identity.id``), never caller-supplied. Previously this took a caller- supplied ``identity_id`` and passed it straight to ``assemble_mindset_draft`` as the identity that resolves and PAYS for the call - any authenticated identity could name a victim identity_id and, under agent_required/agent_first/keyless-caller_first credential policy, spend the victim's BYOK key running an arbitrary 800-char prompt. The UI only ever sent the caller's own id, so removing the field changes no legitimate behavior.
  - `intent` string, required

## Response `200`

Successful Response

- AssembleDraftResponse
  - `base_template_id` string, uuid, required
  - `base_template_name` string, required
  - `operations` object, required
  - `rules` object[], required
  - `summary` string, required
  - `changed_tiers` object, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/5387b4ded614?raw)