# Feedback API

Submit user feedback or bug reports with a redacted diagnostic bundle.

## Submit Feedback

```http
POST /api/feedback
Content-Type: application/json
X-CSRF-Token: <token>
```

```json
{
  "description": "The upload failed after selecting a PDF",
  "include_history": false,
  "conversation_id": "optional-conversation-id",
  "space_id": "optional-space-id"
}
```

| Field | Type | Required | Notes |
|---|---|---|---|
| `description` | string | yes | 1-4096 characters after trimming |
| `include_history` | boolean | no | Defaults to `false`; requires a valid `conversation_id` when `true` |
| `conversation_id` | string | no | Used to verify and fetch bounded recent history when opted in |
| `space_id` | string | no | Overrides active-space context when present |

The endpoint uses the same auth, CSRF, database query propagation, body-size limit, and rate-limit middleware as other `/api/*` routes.

## Responses

Configured reporters return:

```json
{ "status": "sent", "reporter": "jira" }
```

Zero-config fallback returns:

```json
{
  "status": "saved_locally",
  "reporter": "local",
  "message": "Feedback bundle saved locally on the server."
}
```

Failed submissions return a generic error to the client. Detailed reporter errors stay in server logs and the `feedback_reports` table.

## Bundle Contents

The feedback service collects Anteroom package metadata, Python and OS details, runtime model/provider context, safety/config state with secrets redacted, active space context, installed/active pack manifests, artifact manifests, attachment counts/types, available tools, a bundle manifest, and optional recent conversation history. When web debug diagnostics were enabled for the last turn, the bundle also includes the latest redacted turn summary.

Bundles intentionally omit raw prompts, raw tool arguments and outputs, artifact content, artifact metadata values, config overlay values, attachment filenames, attachment storage paths, attachment bytes, extracted attachment text, and pack source paths. History is never included by default.

Webhook reporters receive:

```json
{
  "event": "feedback_submitted",
  "bundle": { "...": "..." }
}
```

Command reporters receive the same bundle JSON on stdin.
