{"contractVersion":"1.1","deliveryMode":"legacy","configured":true,"retrySupported":false,"enabled":true,"rate":"3 attempts per hour in the strict bucket. Agent requests need no spam check. Send one introduction per person you represent. Limits count HTTP attempts, including invalid requests, per server instance and trusted IP attribution bucket. IPv4 uses one bucket; IPv6 shares a /64 bucket. Unknown attribution uses one shared strict bucket. Shared networks share the allowance. These are request limits, not successful delivery counts.","retry":"Legacy mode: retrySupported:false. Idempotency-Key is ignored; no UUID validation or deduplication is active. A 504 may already have reached the provider; do not resend automatically.","endpoint":"https://finceldesign.com/api/contact","openapi":"https://finceldesign.com/openapi.json","operationId":"submitIntroduction","method":"POST","contentType":"application/json","description":"Send Kevin a message. A successful response records provider acceptance; it does not promise inbox placement or reading.","fields":{"name":{"type":"string","required":true,"maxUtf16Units":200,"normalization":"trim","x-maxUtf16Units":200},"replyTo":{"type":"string","required":true,"maxUtf16Units":320,"normalization":"trim","format":"ascii-mailbox","x-maxUtf16Units":320},"message":{"type":"string","required":true,"maxUtf16Units":6000,"normalization":"trim-crlf","x-maxUtf16Units":6000},"company":{"type":"string","required":false,"maxUtf16Units":200,"normalization":"trim","x-maxUtf16Units":200},"nextStep":{"type":"string","required":false,"maxUtf16Units":80,"normalization":"trim","x-maxUtf16Units":80},"channel":{"type":"string","required":false,"normalization":"trim","values":["contact","ask-kevin","agent"],"default":"agent","enum":["contact","ask-kevin","agent"]},"website":{"type":"string","required":false,"normalization":"trim","compatibilityOnly":true}},"validation":{"strings":"Every documented field must be a string. Required values must contain non-whitespace content. Optional empty strings canonicalize to omission; channel omission defaults to agent, but an empty channel is invalid.","characters":"Lone UTF-16 surrogates, NUL and C0/C1 control characters are rejected before trimming. Message permits TAB, LF and CRLF; single-line fields reject all controls including CR/LF.","whitespace":"Fields are trimmed; message normalizes CRLF to LF before trimming and checking length. Email local-part case is preserved. No Unicode compatibility folding is performed.","lengths":"Limits count UTF-16 code units after normalization: an emoji such as 😀 uses two units. 100 emoji fit a 200-unit name; 101 do not. Raw JSON Schema maxLength is only a conservative body-size bound, not the field limit. x-normalizedSchema.maxLength counts code points after normalization and remains an upper bound; x-maxUtf16Units is authoritative.","mailbox":"replyTo accepts one ASCII dot-atom mailbox: local part at most 64 characters, no leading/trailing/consecutive dots, no quotes/display-name/list syntax. Domain at most 255 characters, at least two DNS-style labels of 1–63 ASCII letters/digits/hyphens, no edge hyphens, final label at least two characters. Syntax does not prove ownership.","additionalProperties":"Unknown properties return 422; fieldErrors use $ without echoing unknown names or submitted values.","compatibilityField":"website is compatibility-only: omit it or send an empty string (whitespace is trimmed). Nonempty website returns 422 invalid_fields, including for agents, and is never delivered."},"transport":{"maxBodyBytes":32768,"bodyReadTimeoutMs":5000,"request":"HTTPS application/json UTF-8 object; no Content-Encoding other than identity. The byte cap and body deadline are application bounds, not full edge DDoS protection.","agent":"No authentication is required. Server-side agents omit Origin and Sec-Fetch-Site. These headers classify transport independently of channel; they do not authenticate identity.","browser":"Use https://finceldesign.com/#contact or same-origin browser requests following /api/clearance. Browsers manage Origin and Sec-Fetch-Site; do not attempt to remove them. Cross-origin browser CORS is not supported.","response":"Every POST response is Cache-Control:no-store with X-Request-Id, a fresh opaque requestId per HTTP attempt. Never exposes recipient addresses, provider identifiers, submitted values or credentials."},"response":{"fieldErrors":{"maxItems":8,"item":{"path":"documented field name or $","code":"machine-readable validation code","message":"human-readable validation message"}}},"outcomes":{"accepted":"200 ok:true includes receivedAt and retrySupported:false; no durable receipt is promised.","errors":{"invalid_json":{"http":400,"action":"Correct the UTF-8 JSON object; no delivery occurred."},"invalid_request":{"http":400,"action":"Supply a readable body; no delivery occurred."},"request_timeout":{"http":408,"action":"Body was incomplete; no delivery occurred. Retry the same keyed request."},"payload_too_large":{"http":413,"action":"Reduce the body to the published byte limit."},"unsupported_media_type":{"http":415,"action":"Send application/json with UTF-8."},"unsupported_encoding":{"http":415,"action":"Send uncompressed JSON."},"browser_origin_required":{"http":403,"action":"Use the same-origin browser form or a server-side agent client."},"clearance_required":{"http":403,"action":"Follow /api/clearance in the browser before resubmitting."},"missing_fields":{"http":422,"action":"Supply name, replyTo and message."},"invalid_reply_to":{"http":422,"action":"Supply one ASCII dot-atom mailbox with a dotted DNS-style domain."},"invalid_fields":{"http":422,"action":"Correct the bounded fieldErrors; no delivery occurred."},"rate_limited":{"http":429,"action":"Wait matching Retry-After and retryAfter seconds before another HTTP attempt."},"delivery_rejected":{"http":502,"action":"Provider definitively rejected delivery. Retry only if retryable is true, retaining any original key and payload."},"delivery_unconfigured":{"http":503,"legacyOnly":true,"action":"No provider attempt occurred. Keep your draft while configuration is restored."},"contact_unavailable":{"http":503,"action":"Configuration, storage or capacity is unavailable. Keep your draft; respect retryable and retryAfter."},"delivery_deferred":{"http":503,"action":"Provider or capacity deferred the attempt. Respect retryable and retryAfter; preserve any existing key and payload."},"delivery_unknown":{"http":504,"action":"Provider may have accepted. Only durable keyed requests with retryable:true may retry identical key and payload within retryUntil. Otherwise stop; never create a new key to resolve uncertainty."}}},"idempotency":{"retrySupported":false,"note":"Legacy mode: retrySupported:false. Idempotency-Key is ignored; no UUID validation or deduplication is active. A 504 may already have reached the provider; do not resend automatically."},"activePolicy":{"deliveryMode":"legacy","configured":true,"retrySupported":false,"enabled":true,"rate":"3 attempts per hour in the strict bucket. Agent requests need no spam check. Send one introduction per person you represent. Limits count HTTP attempts, including invalid requests, per server instance and trusted IP attribution bucket. IPv4 uses one bucket; IPv6 shares a /64 bucket. Unknown attribution uses one shared strict bucket. Shared networks share the allowance. These are request limits, not successful delivery counts.","retry":"Legacy mode: retrySupported:false. Idempotency-Key is ignored; no UUID validation or deduplication is active. A 504 may already have reached the provider; do not resend automatically."},"rateLimit":{"agent":"3 attempts per hour in the strict bucket. Agent requests need no spam check. Send one introduction per person you represent.","browser":"10 attempts per 10 minutes only with verified non-degraded contact clearance and known trusted IP. Other allowed browser requests use the strict 3 attempts per hour allowance, including when clearance is off or monitoring. Enforcing deployments require browser clearance first; see /api/clearance.","scope":"Limits count HTTP attempts, including invalid requests, per server instance and trusted IP attribution bucket. IPv4 uses one bucket; IPv6 shares a /64 bucket. Unknown attribution uses one shared strict bucket. Shared networks share the allowance. These are request limits, not successful delivery counts.","requestAgent":{"limit":3,"windowSeconds":3600},"requestBrowser":{"limit":10,"windowSeconds":600}},"maxBodyBytes":32768}