Skip to main content
POST
SubmitReport

Headers

Idempotency-Key
string

Optional client-generated idempotency key. Retrying a POST with the same key and an identical request body replays the original response (only the status, body, and Content-Type are reproduced) instead of re-executing; reusing the key with a different body is rejected with 422. For mutations this avoids duplicating the side effect, while for batch-read POSTs it replays a cached snapshot that can be up to 24 hours stale. Keys are scoped per authenticated caller (falling back to the source IP for unauthenticated endpoints) and retained for 24 hours.

Required string length: 1 - 255
Pattern: ^[\x21-\x7E]{1,255}$

Body

application/json

SubmitReportRequest is one structured report from an agent. Do not include credentials: they are redacted before storage. For a security report, do not include exploit details; use the private advisory form.

kind
string
required

bug | missing_capability | data_quality | security.

Maximum string length: 32
summary
string
required

One-line description of the problem.

Maximum string length: 300
surface
string

What the report is about: an MCP tool name (get_market_data), an API path (/api/market/v1/list-market-quotes), or a short label. A name that does not exist yet is fine.

Maximum string length: 200
expected
string

What you expected to happen.

Maximum string length: 2000
actual
string

What happened instead.

Maximum string length: 2000
requestId
string

Request id of the failing call (the x-vercel-id response header, or data.requestId in an MCP error), so the report joins to our logs.

Maximum string length: 128
clientName
string

Name of the calling client or agent, for display only.

Maximum string length: 80

Response

Successful response

SubmitReportResponse acknowledges a stored report.

reportId
string

Report id to quote in any follow-up.

status
string

received, or private for a security report.

advisoryUrl
string

Security reports only: the private advisory form, where exploit details belong.

notice
string

Security reports only: a reminder not to send exploit details through this channel.