---
title: "Get Feedback"
method: GET
path: "/api/feedback/list"
tags: ["Feedback"]
---

# Get Feedback

`GET /api/feedback/list`

## Request

- Base URL: `https://api.xfinlab.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xfinlab.com/api/feedback/list`
- Auth: none declared

2026-07-30 addition: optional `type` filter, backward compatible --
omitting it returns every row exactly as before. Added so the
Intelligence API "Request Early Access" form (which inserts rows here
with type="intelligence_early_access", see api/intelligence.py) can be
listed separately from general bug-report/feature-request feedback in
admin.html, without needing its own dedicated table.

2026-08-18 fix (AJ saw inconsistent errors on admin.html -- Feature
Flags panel said "401: Invalid token" while this panel said "403:
Admin only" for what turned out to be the exact same expired
adminToken): this endpoint used to do its own ad-hoc
verify_token()+sub-email check, collapsing "token doesn't decode at
all" and "token decodes but isn't the admin" into a single 403 --
unlike every other admin endpoint in api/admin.py, which uses the
shared verify_admin() helper and reports those as 401 vs 403
respectively. Switched to verify_admin() so the error code/message is
consistent with the rest of the admin panel, and so this endpoint
also gets the IP-allowlist check and audit-log entry every other
admin action already gets (it was silently skipping both before).
The actual root cause of AJ's specific 401/403s is unrelated to this
inconsistency -- see backend/auth/jwt_handler.py: JWT_SECRET isn't
set in the deployment env, so a fresh random signing secret is
generated on every backend restart, invalidating every existing
token (including the admin session) until it's set permanently.

## Query parameters

- `token` string, required
- `type` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xfinlab/apis/xfinlab-api.md) · [All operations](https://skmtc.dev/xfinlab/apis/xfinlab-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfinlab/apis/xfinlab-api/revisions/205f85614bc6?raw)