A valid request URL is required to generate request examples{
"logo_url": "<string>",
"tokens": {
"light": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
},
"dark": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
}
},
"custom_css": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Read this environment's branding
Requires org:update. What the drop-in components and the hosted portal render with: a logo and a short list of design tokens, per environment — so a palette can be tried in test and the live one stays untouched.
The same tokens are on GET /v1/config/{publishableKey}, which is public: a sign-in screen has to be able to read them. This route is the editor’s read, which is why it carries the write’s permission and why it is the only one that answers custom_css.
Nothing here is a plan feature. Branding is free on every plan.
A valid request URL is required to generate request examples{
"logo_url": "<string>",
"tokens": {
"light": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
},
"dark": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
}
},
"custom_css": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Path Parameters
The environment's id.
Response
The stored branding.
How one environment's screens look. Per environment on purpose: a palette can be tried in test while the live one stays untouched.
An absolute http(s) URL, or empty. It ends up in an <img src> on a page your customers read, which is why nothing else is accepted.
The design tokens the drop-in components render with, one set per theme. Both themes are always present in a response, even empty — an empty set is the honest spelling of "your own defaults", and a client that had to handle dark being absent would be a client whose dark palette works depending on whether anybody ever set one.
The keys are exactly the ones appearance.variables takes in @userkit/react, so a token set in the panel and one passed as a prop name the same thing. A key outside this list is refused by name.
Show child attributes
Show child attributes
Your own stylesheet. Present on this staff read so the editor can show what you wrote, and served to a browser only over a custom domain you have verified.