Skip to main content
POST
Submit a self-service access request

Body

application/json

A visitor's request for access submitted from the blocked-signup CTA.

The min-lengths mirror the client-side form validation; the max-lengths cap abuse on this unauthenticated endpoint. The required fields reject when they exceed theirs — the visitor is looking at the form and can fix it — while the optional fields the page fills in silently are clamped instead.

email
string<email>
required

Email the visitor tried to sign up with.

full_name
string
required

The visitor's name.

Required string length: 1 - 200
use_case
string
required

Free-text description of what the visitor wants to use the product for.

Required string length: 50 - 5000
attribution
Attribution · object | null

The visitor's first-touch marketing attribution, allow-listed server-side to the §3 shape. Used to say where the request came from in the team notification.

posthog_distinct_id
string | null

PostHog distinct id, so the notification can link the person.

Maximum string length: 200
referrer
string | null

document.referrer at submit time. Sent separately from attribution because the attribution snapshot only exists when the URL carried a UTM or click id, so an organic search arrival has no touch to carry a referrer.

Maximum string length: 2000
timezone
string | null

IANA timezone reported by the browser, used as a coarse location signal.

Maximum string length: 64

Response

Access request received

Constant acknowledgement that an access request was received.

Deliberately carries no record identifier and is identical whether the request was newly created or updated an existing one, so the unauthenticated endpoint can't be probed to learn which emails have already requested access (an email-enumeration oracle). The created-vs-existing distinction stays internal (it only gates the Slack notification).

status
string
default:received

Always 'received'.