Capability Reference
Event Feedback Routes
Published feedback configuration, anonymous submission, dashboard review, triage, notes, and export contracts.
First created Last updated
Routes
| Actor | Method and route | Purpose |
|---|---|---|
| Public/optional attendee session | GET /api/rego/events/:slug/feedback | Read only the current published configuration and availability. |
| Public/optional attendee session | POST /api/rego/events/:slug/feedback/submissions | Submit one category with version, answers, idempotency key, honeypot, and consented contact. |
| Partner event operator | GET /api/events/:eventId/feedback-form | Read draft and current published metadata. |
| Partner event operator | PUT /api/events/:eventId/feedback-form/draft | Save a normalized draft with optimistic conflict detection. |
| Partner event operator | POST /api/events/:eventId/feedback-form/standard-template | Replace the draft with canonical defaults. |
| Partner event operator | POST /api/events/:eventId/feedback-form/publish | Atomically append a version and make it current. |
| Partner event operator | GET /api/events/:eventId/feedback-submissions | Bounded search/filter list without contact values. |
| Partner event operator | GET/PATCH /api/events/:eventId/feedback-submissions/:submissionId | Read detail or update triage state. |
| Partner event operator | POST /api/events/:eventId/feedback-submissions/:submissionId/notes | Append an actor-stamped internal note. |
| Partner event operator | GET /api/events/:eventId/feedback-submissions/export.csv | Download a bounded filtered tall-format CSV. |
Dashboard routes verify event ownership and Event Management access. Browser database roles have no direct table grants. Public callers cannot enumerate submissions, notes, contact details, or triage state.
Submission rules
The submission body uses formVersion, categoryId, answers, idempotencyKey, optional contactEmail, contactConsent, and hidden website. The server rejects disabled/closed forms, stale versions, invalid or hidden answers, invalid choices, oversized bodies, missing consent, and verified-attendee submissions without a session. Success returns a non-sequential receiptCode.
High/critical concern urgency and high/critical issue severity can emit the event’s configured feedback_received notification after the database insert. Notification failure does not discard a valid response and never creates a safety report.