Developer docs

Pagination

List routes take limit (1 to 100, default 50) and an opaque cursor. Pass next_cursor back verbatim; null means the end. A cursor you made yourself is refused with invalid_query.

The money path

These 3 routes spend credits: POST /api/v1/shots/:id/export, POST /api/v1/shots/:id/ai, POST /api/v1/projects/:id/exports. It runs the same code as the app’s download button: credits are held, the photo is made, and only then are they taken. Any failure releases the hold. A second export of the same photo is free.

• The Idempotency-Key header is required. Replaying the same key answers the original result with replayed: true and credits_charged: 0 — no second charge, job or file.
• The finished file is stored and a signed download link is handed out for 15 minutes at a time; fetch a fresh one from the export route.
• Object storage must be configured on the deployment; otherwise the request is refused with not_configured before any credit moves.

curl examples

From the API specification, verbatim. The base address is wherever your workspace runs. We are live.

BASE=https://app.pinthelot.com   # or http://localhost:3111 on the local stage
KEY=pf_live_…

# who am I + remaining read tokens
curl -s $BASE/api/v1/me -H "Authorization: Bearer $KEY" -H "Accept-Version: 2026-09-01"

# create a project with a known anchor (lat/lng travel together)
curl -s -X POST $BASE/api/v1/projects -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"name":"12 Pier Street","address":"12 Pier Street, Altona VIC 3018","lat":-37.8637,"lng":144.8302}'

# list, then page
curl -s "$BASE/api/v1/projects?limit=20" -H "Authorization: Bearer $KEY"
curl -s "$BASE/api/v1/projects?limit=20&cursor=<next_cursor>" -H "Authorization: Bearer $KEY"

# register a shot (C-04 metadata → presigned PUT for the original), then upload the file to `upload.url`
curl -s -X POST $BASE/api/v1/projects/<project_id>/shots -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"original_filename":"DJI_0781.JPG","mime":"image/jpeg","bytes":18344201,"pose":{"gps_lat":-37.8637,"gps_lng":144.8302,"rel_altitude_m":82.4,"flight_yaw_deg":58.9,"gimbal_yaw_deg":58.3,"gimbal_pitch_deg":-20.1,"image_w":8064,"image_h":4536}}'
curl -s -X PUT "<upload.url>" -H "content-type: image/jpeg" --data-binary @DJI_0781.JPG
# then mark it ready through the app (PATCH /api/shots/:id is session-only today)

# export — the money path; the Idempotency-Key makes a retry free
curl -s -X POST $BASE/api/v1/shots/<shot_id>/export -H "Authorization: Bearer $KEY" \
  -H "Idempotency-Key: order-4711" -H "Content-Type: application/json" -d '{"include_distances":true}'

# fetch the signed download later (15 min)
curl -s $BASE/api/v1/exports/<export_id> -H "Authorization: Bearer $KEY"
curl -s $BASE/api/v1/jobs/<job_id> -H "Authorization: Bearer $KEY"

Not in v1 yet

An honest list. Scopes a key may carry that no route uses yet:

• PATCH /shots/:id (status → ready after the PUT) — session-only; a key cannot finish an upload it started. Next slice.
• Batch export; brand-kit reads. (ai:write, delivery:write, webhooks:manage shipped in slice 2 — see below.)
• pf_test_ keys parse but mint only as pf_live_ today (no sandbox ledger).