ApplyToVolunteer Demos API

openapi: 3.2.0
info:
  title: Apply2Volunteer Demos API
  version: 1.0.0
  description: 'Convert volunteer PDFs into progressive online forms. Organization owners and admins create API keys in the dashboard. Send a key as Authorization: Bearer a2v_... The token starts with a2v_. This API does not implement OAuth. Public submit and anonymous grade or convert do not accept the key in place of a Turnstile token. Keyless agents use /mcp and POST /a2a for anonymous grade and preview.'
  license:
    name: Proprietary
    url: https://applytovolunteer.com/terms
servers:
- url: https://applytovolunteer.com
security:
- orgApiKey: []
tags:
- name: Demos
paths:
  /api/v1/demos/claim/verify:
    head:
      operationId: probeClaimLink
      summary: Probe a demo claim link without consuming it
      description: 'HEAD does not consume the claim token, does not write to D1, and does not set a session cookie. A usable token returns 200 with an empty body and Cache-Control no-store. A missing token returns 400 { error: "token" }. An unknown, used, expired, or wrong-purpose token returns 400 { error: "invalid" }. A later GET still claims the organization. No API key.'
      security: []
      parameters:
      - schema:
          type: string
          description: Magic-link token from the email.
        required: true
        description: Magic-link token from the email.
        name: token
        in: query
      responses:
        '200':
          description: Usable claim token. Empty body. Cache-Control is no-store. The token is not consumed, no row is written, and no session cookie is set.
        '400':
          description: '{ error: "token" } when the token query is missing. { error: "invalid" } when the token is unknown, used, expired, or the wrong purpose.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      tags:
      - Demos
components:
  schemas:
    ApiError:
      type: object
      properties:
        error:
          type: string
          description: Short error code or message.
        message:
          type: string
          description: Human-readable detail when the handler sends one.
        fields:
          type: object
          additionalProperties:
            type: string
          description: Field-level validation messages.
        retryable:
          type: boolean
          description: Set on some public submit conflicts.
      required:
      - error
  securitySchemes:
    orgApiKey:
      type: http
      scheme: bearer
      bearerFormat: a2v API key
      description: Organization API key. REST reads Authorization and accepts only the exact prefix "Bearer " (capital B, one space) followed by a token that starts with a2v_. Put the a2v_ token in the bearer credential. Do not include the word Bearer in the token. Owners and admins create keys at /app/settings/api-keys. The secret is shown once. Revoked keys are rejected. This API does not implement OAuth. Scopes are forms:read, forms:write, applications:read, and applications:write. forms:write does not include forms:read. A new key defaults to forms:read and forms:write. applications:read and applications:write are opt-in. A browser session cookie is also accepted on organization routes. Agents send the bearer key.