DemoTake Cloud REST API

# 1. Send a 6-digit code to your email (valid for 5 minutes)
curl -X POST https://api.demotake.my/api/auth/email-otp/send-verification-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "type": "sign-in"}'

# 2. Exchange it for a session token
curl -X POST https://api.demotake.my/api/auth/sign-in/email-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "otp": "123456"}'
# → {"token": "…", "user": {…}}

export DEMOTAKE_TOKEN="…"
curl https://api.demotake.my/v1/me -H "Authorization: Bearer $DEMOTAKE_TOKEN"

{ "error": { "code": "payment_required", "message": "Your plan doesn't include share links." } }

curl -X POST https://api.demotake.my/v1/shares \
  -H "Authorization: Bearer $DEMOTAKE_TOKEN" -H "Content-Type: application/json" \
  -d '{
    "take_id": "take_m3ehbyc0k7qv2x9d",
    "title": "Invoice export",
    "kind": "video",
    "file_name": "invoice-export-16x9.mp4",
    "content_type": "video/mp4",
    "size_bytes": 18234567,
    "expires_in_days": 30,
    "allow_download": true
  }'

{
  "share_id": "shr_…",
  "url": "https://demotake.my/s/Qm9vZ2xlLXN0eWxlLXNsdWc",
  "status": "pending_upload",
  "visibility": "public",
  "upload": { "method": "PUT", "url": "https://api.demotake.my/v1/uploads/…", "headers": { "Content-Type": "video/mp4" } }
}

curl -X PUT "$UPLOAD_URL" -H "Content-Type: video/mp4" --data-binary @invoice-export-16x9.mp4

GET    /v1/shares?workspace_id=&take_id=      list, with views, comments and invite counts
GET    /v1/shares/:id                         one link with its invites
PATCH  /v1/shares/:id                         title, allow_download, expires_in_days, visibility, access_code, generate_code,
                                              analytics_enabled, show_badge, cta, chapters, tracks
GET    /v1/shares/:id/analytics?range=30      views, unique viewers, watch time, completion, drop-off, … (7, 30 or 90 days)
POST   /v1/shares/:id/revoke                  stop the link now
DELETE /v1/shares/:id                         delete the link and the media it owns
GET    /v1/shares/:id/invites
POST   /v1/shares/:id/invites                 {"people": [...], "note"?}   (invite links only)
DELETE /v1/shares/:id/invites/:invite_id
POST   /v1/shares/:id/review                  {"status": "approved|changes_requested", "note"}

# Switch a link to an access code and get the new code back once
curl -X PATCH https://api.demotake.my/v1/shares/shr_… \
  -H "Authorization: Bearer $DEMOTAKE_TOKEN" -H "Content-Type: application/json" \
  -d '{"visibility": "code", "generate_code": true}'

# A "Book a demo" button at the end and a link 30 seconds in, with UTM parameters (Director, Team, Enterprise)
curl -X PATCH https://api.demotake.my/v1/shares/shr_… \
  -H "Authorization: Bearer $DEMOTAKE_TOKEN" -H "Content-Type: application/json" \
  -d '{"cta": {"end": {"kind": "lead", "text": "Book a demo", "url": "https://example.com/demo"},
               "mid": {"text": "See pricing", "url": "https://example.com/pricing", "at": 30},
               "utm": {"campaign": "launch"}}}'

GET  /v1/public/shares/:slug                 title, media_url (signed, 1 hour), comments, …
GET  /v1/public/shares/:slug/meta            link preview data (public, live links only); never counts a view
GET  /v1/public/shares/:slug/poster          the poster image (public, live links only)
POST /v1/public/shares/:slug/unlock          {"code"} → {"grant", "expires_at"}   (valid 12 hours)
POST /v1/public/shares/:slug/comments        {"name", "text", "timecode"?}
POST /v1/public/shares/:slug/events          analytics beacon from share pages and embeds (see API.md §13.9)

GET    /v1/schedules?take_id=…                  schedules, this month's usage, the plan's limits, runners online
POST   /v1/schedules                            {"take_id","cron"?,"timezone"?,"webhook"?,"options"?,"publish_mode"?,"notify"?,…}
PATCH  /v1/schedules/:id                        any of the same fields
DELETE /v1/schedules/:id
POST   /v1/schedules/:id/run                    run now (a run already waiting is returned instead)
POST   /v1/schedules/:id/rotate-token           new trigger token (shown once)
GET    /v1/schedules/:id/runs                   recent runs
GET    /v1/runs/:id                             one run: scenes changed/unchanged/failed with before/after stills, checks, exports
POST   /v1/runs/:id/approve | reject | rollback | cancel
GET    /v1/runners  ·  POST /v1/runners {"name"}  (token shown once)  ·  DELETE /v1/runners/:id

# Bearer token (GitHub Actions, scripts)
curl -X POST https://api.demotake.my/v1/schedules/sch_…/trigger -H "Authorization: Bearer $DEMOTAKE_TRIGGER_TOKEN"

# Signed: X-DemoTake-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(token, "<t>.<body>")>, within 5 minutes
# GitHub repository webhook (deployment_status): secret = the trigger token (X-Hub-Signature-256 is checked)
# Vercel or Netlify: paste hook_url (https://api.demotake.my/v1/hooks/schedules/dtt_…) as the deploy notification URL

GET    /v1/takes?workspace_id=&q=             list: name, goal, purpose, status, duration, scene_count, assertions, source
POST   /v1/takes                              create from {"name", "goal"?, "purpose"?, "outputs"?, "scenes"?}, or {"take": {…take.json…}}
GET    /v1/takes/:id                          take.json, its etag, your access, and signed media URLs (1 hour)
PUT    /v1/takes/:id                          replace take.json; needs If-Match: <etag>
DELETE /v1/takes/:id
POST   /v1/takes/:id/files                    {"files": [{"path", "size_bytes", "content_type"}]} → upload URLs
POST   /v1/takes/import/uploads               {"size_bytes"} → an upload for a .take.zip
POST   /v1/takes/import                       {"upload_path"} | {"library_id"} → a new cloud take
POST   /v1/takes/:id/shares                   share an uploaded export without re-uploading it

# Create a cloud take with two scenes, ready to record in DemoTake Web
curl -X POST https://api.demotake.my/v1/takes \
  -H "Authorization: Bearer $DEMOTAKE_TOKEN" -H "Content-Type: application/json" \
  -d '{"name": "Checkout", "purpose": "marketing", "scenes": [{"title": "Add to cart"}, {"title": "Pay", "intent": "Pay with the test card"}]}'
# → 201 {"take_id": "take_…", "take": {…}, "etag": "…"}

GET    /v1/takes/:id/collaborators
POST   /v1/takes/:id/collaborators            {"people": ["ana@example.com"], "role": "commenter"}
PATCH  /v1/takes/:id/collaborators/:cid       {"role"}
DELETE /v1/takes/:id/collaborators/:cid       remove someone (or leave, as that collaborator)
GET    /v1/takes/:id/comments
POST   /v1/takes/:id/comments                 {"text", "timecode"?}
GET    /v1/shared-with-me                     private links shared with you and takes you collaborate on

POST /v1/library/takes                        publish a version → upload URLs for the zip and thumbnail
GET  /v1/library/takes?workspace_id=&q=&tag=  search
GET  /v1/library/takes/:library_id            one take with a signed download URL and its versions
POST /v1/library/takes/:library_id/review     {"status", "note"}
GET  /v1/library/activity?workspace_id=       recent activity
GET  /v1/workspaces/:id/brand-kit             the team's shared style and edit rules
PUT  /v1/workspaces/:id/brand-kit

GET    /v1/me                                 you, your workspaces and roles, the active workspace
PATCH  /v1/me                                 {"name"?, "active_workspace_id"?}
POST   /v1/workspaces                         {"name"}
GET    /v1/workspaces/:id/members
POST   /v1/workspaces/:id/invites             {"email", "role"}
DELETE /v1/workspaces/:id/members/:user_id    owners and admins; owners can't be removed