Skip to main content

Public API

Unauthenticated endpoints for public pages (forms, events, business cards, workspace resolution).

No Authorization header required unless noted.

Public events​

GET /api/public/events/{event_id}/

Returns public event details for share/embed pages.

Public forms​

GET  /api/public/forms/{form_id}/
POST /api/public/forms/{form_id}/submit/

Submit example​

POST /api/public/forms/{form_id}/submit/
Content-Type: application/json
{
  "data": {
    "email": "visitor@example.com",
    "name": "Visitor Name"
  }
}

Public business cards​

GET  /api/public/business-cards/{identifier}/
POST /api/public/business-cards/{identifier}/scan/
POST /api/public/business-cards/{identifier}/view/
POST /api/public/business-cards/{identifier}/contact-download/
POST /api/public/business-cards/{identifier}/link-tap/
GET  /api/public/business-cards/{identifier}/lead-capture/
POST /api/public/business-cards/{identifier}/leads/
GET  /api/public/business-cards/{identifier}/media/{asset}/

{identifier} is the public slug or card ID.

Lead capture from card​

POST /api/public/business-cards/{identifier}/leads/
Content-Type: application/json
{
  "email": "prospect@example.com",
  "name": "Prospect Name",
  "company": "Acme"
}

Public workspace resolution​

Used by the share app and custom domains:

GET /api/public/workspaces/resolve/{slug}/
GET /api/public/workspaces/resolve-host/
GET /api/public/workspaces/embed-origins/
EndpointPurpose
resolve/{slug}/Resolve workspace by public slug
resolve-host/Resolve workspace from Host header (custom domain)
embed-origins/Allowed iframe embed origins

CORS​

Public endpoints allow configured origins for browser form submits and embeds. See CORS_ALLOWED_ORIGINS in backend settings.

Rate limiting​

Public submit endpoints may be rate-limited per IP when Redis is available.