Feature requests (REST)

Three surfaces:

Dashboard — /v1/apps/:appId/requests/* — WorkOS-authenticated list, triage, moderation, and developer responses.
SDK — /v1/sdk/requests/* — write key plus subject token; every identity is checked against the authenticated anonymous or identified subject.
Public — /v1/public/roadmap/* — read-only public roadmap routes.

List requests (admin)

GET /v1/apps/:appId/requests?status=planned&q=dark+mode&sort=top

The response is an array of request summaries in the standard data envelope. Dashboard list filters include status, q, sort, filter, hidden, and limit.

Create (SDK)

POST /v1/sdk/requests
Authorization: Bearer rk_live_…
X-UserGist-Subject-Token: st_…
Content-Type: application/json
 
{
  "anonymousId": "device_a1b2c3",
  "externalId": "user_42",
  "idempotencyKey": "d0948d6e-65d2-4db1-9dba-e46670a4d8ef",
  "title": "Dark mode for the dashboard",
  "description": "Eye-strain on long sessions — would love a system-aware toggle."
}

externalId is optional for anonymous users. If supplied, it must match the identified subject token. Feedback consent is required.

Update status

PATCH /v1/apps/:appId/requests/:requestId/status
 
{ "status": "in_progress" }

Valid statuses: under_review, planned, in_progress, shipped, declined.

Changing status notifies all followers (in-app + push if subscribed).

Vote / un-vote (SDK)

POST /v1/sdk/requests/:requestId/vote
 
{ "anonymousId": "device_a1b2c3", "externalId": "user_42", "vote": true }

Send vote: false to remove the vote. Voting auto-follows; un-voting does not unfollow.

Follow / unfollow (SDK)

POST /v1/sdk/requests/:requestId/follow
 
{ "anonymousId": "device_a1b2c3", "externalId": "user_42", "follow": true }

Send follow: false to unfollow.

Comments

GET    /v1/sdk/requests/:requestId/comments
POST   /v1/sdk/requests/:requestId/comments
PATCH  /v1/sdk/requests/:requestId/comments/:commentId
DELETE /v1/sdk/requests/:requestId/comments/:commentId?anonymousId=device_a1b2c3

SDK comment calls require the write key, subject token, and matching identity. Create also requires an idempotencyKey. The original anonymous identity can edit or delete its comment. Dashboard viewers can read comments at GET /v1/apps/:appId/requests/:requestId/comments; editors can remove a comment at DELETE /v1/apps/:appId/requests/:requestId/comments/:commentId.

Public roadmap

GET /v1/public/roadmap/:slug
GET /v1/public/roadmap/:slug/r/:requestId
GET /v1/public/roadmap/:slug/branding

No auth. Honours the per-status visibility toggles from Requests → Settings.