Synq Docs
Management APIBrands

Preview a brand's theme

The brand's sign-in page with these settings on top of its theme, saving nothing: what the dashboard's editor shows. It renders whatever the plan allows or not, and `needs` names what saving it would need. Render `html` only in a sandboxed iframe (`srcdoc`, with neither `allow-scripts` nor `allow-same-origin`) under the returned `content_security_policy`, never inline. Needs `org.brands.view`.

POST/v1/orgs/{org}/brands/{brand}/theme/preview

The brand's sign-in page with these settings on top of its theme, saving nothing: what the dashboard's editor shows. It renders whatever the plan allows or not, and needs names what saving it would need. Render html only in a sandboxed iframe (srcdoc, with neither allow-scripts nor allow-same-origin) under the returned content_security_policy, never inline. Needs org.brands.view.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string
brand*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/orgs/string/brands/string/theme/preview" \  -H "Content-Type: application/json" \  -d '{}'
{  "html": "string",  "content_security_policy": "string",  "needs": [    "string"  ]}

Try a brand's sign-in POST

A link that opens the brand's hosted sign-in page as Synq's own preview app, so you sign in as one of its users before writing any code. The page the sign-in comes back to, on the brand's issuer, says who signed in and links back to `return_path` on Synq's dashboard. The link works once, within 10 minutes; preview sign-ins count for no monthly active user. Needs `org.brands.view`.

Make a brand POST

A new user pool with its own issuer. The org's own apps at sign-in providers sign it in too, so each must register its callback: `warnings` says so (`org_provider_apps_need_redirect_uri`), naming each. Needs `org.brands.edit`, and room under the org's plan (403 `plan_quota_exceeded`, naming the plan that has room in `required_plan`). A brand deleted in the last 30 days still takes its place: its issuer slug is held until it's purged. Recorded as `brand.created`.