Boardeva Inbox

Capture APIs that keep you in control.

Cloud and Desktop Local use the same reviewed card contract. Send a capture, review it in Inbox, and route it when you are ready.

Cloud API

Use Cloud when captures should arrive while Boardeva is closed. It requires a signed-in account and a named Inbox token. Friendly routes are available at https://boardeva.com/api/v1/directory and https://boardeva.com/api/v1/inbox/items.

curl https://boardeva.com/api/v1/directory \
  -H "Authorization: Bearer YOUR_TOKEN"

Desktop Local API

Use Desktop Local without a cloud account while Boardeva Desktop is open. The service binds only to 127.0.0.1:37281. Start it from Inbox → Sources, create a one-time token, and send to the loopback equivalents:

GET  http://127.0.0.1:37281/v1/health
GET  http://127.0.0.1:37281/v1/directory
POST http://127.0.0.1:37281/v1/inbox/items

Authentication and token rotation

Send Authorization: Bearer TOKEN. Tokens are named, independently revocable, and displayed only once when generated. Rotate a token if a source is moved or exposed; revoke it immediately when no longer needed.

Directory

The directory lists boards and columns that are published for capture suggestions. It never exposes private workspace content or sync data.

{"ok":true,"boards":[{"boardId":"research","boardName":"Research","columns":[{"columnId":"sources","columnName":"Sources"}]}]}

Shared card payload

Both transports accept snapboard.automation.card.v1. Keep captures bounded and include a stable origin when possible.

{
  "schema": "snapboard.automation.card.v1",
  "type": "card.create",
  "card": {"title":"Useful research","description":"Captured note","tags":["research"]},
  "target": {"boardId":"research","columnId":"sources"},
  "origin": {"kind":"my-tool","url":"https://example.com","pageTitle":"Source"}
}

Sending an Inbox item

curl -X POST https://boardeva.com/api/v1/inbox/items \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: capture-123" \
  -d '{"schema":"snapboard.automation.card.v1","type":"card.create","card":{"title":"Captured note"}}'

A successful response means the item was accepted into Inbox for review; it does not mean a board card was created.

Idempotency

Provide a unique Idempotency-Key per source event. Repeating the same key returns the original item instead of creating a duplicate. Keys should be retained by the sender for safe retries.

Errors and limits

401 / 403

Missing, expired, or revoked token.

400

Malformed JSON or invalid card schema.

409

Idempotency key conflicts with a different payload.

413 / 429

Payload too large or rate limit exceeded. Retry with backoff.

Security

Use HTTPS for Cloud, never put tokens in URLs or logs, and use least-privilege named tokens. Desktop Local is loopback-only and rejects remote origins, invalid tokens, oversized payloads, and requests while the service is stopped. Inbox APIs are separate from private workspace synchronization; there is no /api/sync route.