Skip to main content

​
Current API Recipes

These examples describe the API surface that is safe to build against today.
Canonical REST base URL: https://api.tattooapi.com/api/v1
Public writes, public legal advice, public GraphQL, and public SDK launch are not active yet.

​
Public No-Auth Reads

Liveness is the simplest availability check:
Studio discovery is the current promoted public data surface:
Use this for public discovery experiments. Do not assume artist, portfolio, design, booking, payment, or law endpoints are public just because route files exist in the repo.

​
Internal Beta Reads

Internal beta routes require approved authentication and a mapped TattooAPI actor.
Missing or invalid credentials return 401. Valid credentials without a mapped TattooAPI actor return 403.

​
Governed Portfolio Intake

Approved service integrations such as Permanent use the private portfolio-intake contract to resolve an artist, stage media, verify upload completion, and poll review status. A separate mapped human operator performs approval. Start with Resolve Artist Identity and Create Portfolio Submission. Approval creates a private Sanity draft and marks the intake promoted_to_sanity; it does not make the asset public. GET /portfolios returns only separately promoted published_public Convex projections.

​
Owner Beta Reads

Owner routes are scoped to the authenticated owner actor.
Owner routes can return draft, owner_private, and published_public creative records, but only for records mapped to the authenticated studio or artist.

​
Blocked Public Writes

Public mutation attempts must remain blocked:
Expected posture: public_write_blocked.

​
Gated Owner Writes

Owner mutation attempts must remain gated until the approved write contract is live:
Expected posture: owner_write_gated.

​
Internal Infrastructure Boundaries

These surfaces are not public product APIs:
  • /api/internal/mcp/*
  • /api/internal/source-packs/staging
  • /api/internal/runtime/*
  • private operator dashboards
  • local private-network URLs
Use the public docs for builder-facing examples. Use internal PRDs and project-context docs for governed source-pack, private worker, and promotion work.