API

Version 1

The CMNT CARD API is read-only in v1 — fetch your boxes and comments as JSON. Every request is authenticated with a bearer token and scoped to your account. The base URL is https://cmntcard.com.

Authentication

Create a token from Account settings → API access. Tokens are shown once at creation — copy it then. Send it on every request in the Authorization header:

Authorization: Bearer cmnt_your_token_here

A missing, malformed, or revoked token returns 401 Unauthorized:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API token."
  }
}

List boxes

GET /api/v1/boxes returns the boxes on your account. Confidential boxes never appear in the API.

curl -H "Authorization: Bearer cmnt_your_token_here" \
  https://cmntcard.com/api/v1/boxes

{
  "data": [
    {
      "id": 7,
      "name": "Front desk",
      "archived": false,
      "created_at": "2026-08-21T01:51:39Z",
      "comments_count": 12
    }
  ],
  "has_more": false,
  "next_cursor": null
}

List comments

GET /api/v1/boxes/:id/comments returns the comments in a box, oldest first (ascending id).

curl -H "Authorization: Bearer cmnt_your_token_here" \
  https://cmntcard.com/api/v1/boxes/7/comments

{
  "data": [
    {
      "id": 31,
      "body": "…",
      "rating": 4.5,
      "anonymous": true,
      "created_at": "2026-08-22T14:03:11Z"
    }
  ],
  "has_more": true,
  "next_cursor": "31"
}

• No commenter contact data. Names, emails, and phone numbers are never included — even when a commenter shared them to receive a reply.
• anonymous is derived — it answers "could the operator follow up?", not who the commenter is.
• Confidential boxes never appear through the API, and neither do their comments.

Pagination

Both list endpoints are cursor-paginated. Pass ?after=<id>&limit=<n> — limit defaults to 25 and maxes at 100. Every response carries the same envelope: a data array plus has_more and next_cursor. To fetch the next page, resend the request with after set to the returned next_cursor. When has_more is false, next_cursor is null.

curl -H "Authorization: Bearer cmnt_your_token_here" \
  "https://cmntcard.com/api/v1/boxes/7/comments?after=31&limit=50"

Rate limits

The API allows up to 300 requests per minute per token. Exceed it and you'll get 429 Too Many Requests — slow down and retry.

What's not here yet

v1 is read-only: there are no write endpoints and no webhooks. If you need to create or update data, or want to be notified of new comments as they arrive, tell us at [email protected] — we're building the API around what people actually need.