Public API

The Public API v1 is a single JSON endpoint for your FlashBoards account, boards, model discovery and generation, called from your own server.

EndpointCopy Anchor Link

Get a keyCopy Anchor Link

Each row shows the key name, a full access badge, its prefix (fb_sk_ plus a few characters), creation date and last use (or never used). Refresh reloads the list.

• Limit. At most 25 active keys. Creating another fails with "You can have at most 25 active API keys. Revoke one first."
• Expiry. Keys don't expire. Revoke a key when you no longer need it.
• Rate limits. Creating and revoking keys and connected apps share a limit of 20 changes per minute.

Revoke a keyCopy Anchor Link

Click the Revoke API key icon on a row, then Revoke in the Revoke API key? dialog. Revoking prevents new authenticated requests with that key and can't be undone. It does not cancel work already started. Reference preview links the key already shared stay viewable for up to 24 hours. Create a new key for any server that still needs access.

×

You don't need provider keys to generate; a FlashBoards key is enough.

Call an operationCopy Anchor Link

POST the operation name and its input. Operations without arguments need only the name.

curl -X POST https://flashboards.yaroflasher.com/api/v1/operations \
  -H "Authorization: Bearer ${FLASHBOARDS_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"operation":"get_account"}'

Discover operationsCopy Anchor Link

GET the same URL (authenticated) for the current operations, each with a title, description, input JSON Schema and its annotations (for example readOnlyHint and destructiveHint).

The schemas are advisory: cross-field rules and count limits are enforced at parse time, so a schema-valid request can still be rejected. Many inputs are strict and reject unknown fields with 400 INVALID_INPUT, so send only the fields the schema lists.

Available operationsCopy Anchor Link

The MCP start menu (flashboards), chat upload tools (create_upload_link, get_upload, import_chat_file, show_media_upload_picker), chat viewers (show_reference_gallery, display_generated_image, display_generation) and social approval-card callback (social_publish_card) are MCP-only and aren't offered here. Discovery can include further operations for the account's available features; inspect it rather than treating this table as a fixed allowlist.

Board operations and media tool runs need an open, signed-in FlashBoards tab. Without one they return an error, and list_board_sessions returns an empty list.

Run media toolsCopy Anchor Link

Media tools transform items in your open tab. Read get_board_snapshot for item IDs, then call start_media_tool with a tool ID from list_media_tools, itemIds, its params, the snapshot’s board ID as expectedBoardId, and a requestId (1–120 letters, digits, underscores or hyphens).

Retry only the identical request in the originating tab. Its ID returns the existing run while that record is retained: up to 30 minutes after completion, or less if newer runs fill the 50-run registry. Different input under a retained ID is refused. After reload, expiry, eviction or an uncertain result, inspect the board before starting again; reusing a forgotten ID can start another run.

• The call waits up to 10 seconds by default (waitSeconds). If the run is still going, poll get_media_tool_run with its runId until it succeeds, fails or is cancelled. Success lists the new item ids.
• Results are added to the board next to the sources. A cancelled run adds nothing.
• engine: "auto" (the default) and "local" run in the browser without uploading. Server-only tools require explicit engine: "server": scene detection, collage, audio join, mix, reverb and soundtrack replacement. Read list_media_tools for the engines each tool accepts; server execution uploads the source media.
• Local-runner outputs are limited to 1 GB each and 2 GB per run; server tools have their own limits.
• A run lives in that tab. If the tab closes or reloads, the outcome is unknown: re-read the board before starting another run.

Read the responseCopy Anchor Link

Every accepted call answers 200 with { ok, operation, result }. ok is a transport-level flag, and business failures stay 200, so ok: true doesn't always mean the work succeeded. For generate_on_board, always read result.status.

Transport problems use other status codes, with the body { "ok": false, "error": { "code": "...", "message": "..." } }:

• Methods other than GET and POST return 405.
• The rate limit is 120 requests per minute per account, shared with MCP. Request bodies can be up to 11 MiB.

Edit boards and shareCopy Anchor Link

The board and sharing operations follow the same rules as in MCP; see Edit a board and Share and publish.

• Edits. Read get_board_snapshot first. execute_board_action takes an action, its args and expectedBoardId (the snapshot's activeBoardId), plus sessionId from list_board_sessions when more than one tab is live. describe_board_action returns the argument schema for one action and needs no tab.

{"operation":"execute_board_action","input":{"action":"addTextNote","args":{"text":"Shot 1"},"expectedBoardId":"BOARD_ID","sessionId":"SESSION_ID"}}

• Delete and undo. Pass the snapshot's board id and revision:

{"operation":"delete_board_items","input":{"expectedBoardId":"BOARD_ID","expectedRevision":"REVISION","itemIds":["ITEM_ID"]}}

Up to 50 ids per call, all or nothing. undo_board_edit reverts only edits made with the same API key.

• Confirm tokens. Sharing changes first return status: "needs_confirmation", a preview and a single-use confirmToken, valid for 5 minutes. Repeat the same input with that token. Publishing, invitations and widening access to Authenticated link then require Approve in your open tab (status: "awaiting_approval", with approvalId). Making access Invite only, revoking access and unpublishing can complete after the token confirmation without an open tab.
• Errors. A refused board or sharing call answers 200 with ok: false and a result that has error, code and retryable, plus fields (up to 50 entries, each with a path, code and message), details or docsUrl where useful. See Errors. TAB_OUTDATED means the open tab is older than the operation: reload it and try again.

Spend money safelyCopy Anchor Link

• enhance_video also requires generationAttemptId. Reuse it only for the exact same source and settings.
• If a start returns SUBMISSION_INDETERMINATE (with ok: false), or generate_on_board returns indeterminate_after_claim (with ok: true), the attempt may already be charged. Do not retry.
• API keys have no spending ceiling: a leaked key can spend your balance until you revoke it. Revoke keys you no longer use.
• Some models and tools accept an optional per-request maximum, maxCostUsd (for example GPT Image 2.5, Nano Banana 2 Lite, H3 Max video, generate_audio and enhance_media). Requests estimated above it are rejected. Check each discovery schema.
• Audio, voice, finishing and enhancement operations also take a requestId or generationAttemptId. Reuse it only to retry the exact same request. Voice and finishing operations refuse a reused ID with different input.
• Call estimate_generation_cost to see the price first.
• A failed generation returns code: "GENERATION_FAILED", retryable: false, attemptClosed: true, a failureKind (content_policy, invalid_input, timeout, provider_error or unknown) and a next step in error. Repeating that attempt only repeats the failure: fix the input and start a new attempt with a new generationAttemptId. charged: false appears only when FlashBoards confirmed the attempt wasn't charged.

Use a local reference imageCopy Anchor Link

generate_image accepts one approved local image in referenceImages as a base64 data URL, with no board, open tab or upload step. The data URL can be up to 10 MiB and the request up to 11 MiB; base64 adds about a third, so keep originals well under that. Some models only accept image URLs, so check the model's discovery schema.

{
  "operation": "generate_image",
  "input": {
    "prompt": "Describe the requested edit",
    "model": "nano-banana-2",
    "resolution": "1k",
    "generationAttemptId": "attempt-local-reference-1",
    "referenceImages": [
      { "filename": "reference.png", "dataUrl": "data:image/png;base64,..." }
    ]
  }
}

Send image bytes only after the user approved that attachment, and never a file path. imageUrls still works for URL-based references. For generate_video, compatible Seedance models accept one referenceImages attachment, or one referencePreviewHandle from a reference search, alongside supported imageUrls. Local video files can't be sent as references through the API. The voice operations take WAV bytes in audioBase64.

Reuse your own resultsCopy Anchor Link

Instead of a public URL, many inputs accept one of your completed results. FlashBoards checks that it's yours and reads it on the server.

• generate_image: referenceGenerationIds (your earlier image results) and referencePreviewHandles (from search_references) for image edit models that take references, up to 16 references in total for GPT Image 2.5.
• generate_video: an earlier image as the first frame (firstFrameUrl) or last frame (endFrameUrl, needs a first frame) of H3 Max and H3 Max Turbo, earlier images or reference previews as H3 Max references, earlier videos as H3 Max Reference to Video references (referenceVideoGenerationIds: a video generationId or the task ID of conform_video), earlier audio as an H3 Max Turbo soundtrack, and earlier images (referenceGenerationIds) and audio (referenceAudioUrls) as Seedance references.
• run_skill_model: an earlier audio result as the source of audio models, and an earlier video for video continuation.
• Finishing and voice operations: earlier generations, voice tasks and finishing results as sources, by ID. They never accept URLs. Video finishing results also return a video generationId, which works with get_generation, describe_media, transcribe_media, add_media_to_board and as a video source.
• describe_media and transcribe_media: generationId, videoFinishingTaskId or mediaSource read your own results on the server.

Describe and transcribe mediaCopy Anchor Link

Both operations bill your balance like a generation and work in two steps: start the request, then read the result. Each start takes a requestId you choose; reuse it only for the same request. A failed result is not proof that nothing was charged: an acknowledged response can be billed even when processing yields an empty or unusable result. Inspect the task's billing state and your history before starting again. Formats differ: for describe_media it is 1 to 128 characters from A-Z a-z 0-9 . _ : - and must start with a letter or digit; for transcribe_media it is 1 to 120 characters from A-Z a-z 0-9 _ - (no . or :).

Describe also accepts optional model, mode and sourceRange (see the discovery schema for values). These three are video-only: an image request with any of them returns INVALID_MEDIA_OPTIONS. On your own result (generationId), sourceRange is cut out on the server. With audioBase64, transcription takes audio bytes, not a URL or file path, as uncompressed PCM or floating-point WAV, and a range doesn't cut the recording: slice the audio yourself so its length matches the range to within 0.05 seconds. With mediaSource, the server does the cutting.

For the in-app version, see Describe and transcribe.

Recover a generationCopy Anchor Link

list_recoverable_generations returns your recent recoverable generations from the last 48 hours with a fresh generationId for each. Pass one to get_generation for status. Listing never starts, refreshes or charges a generation.

Search reference imagesCopy Anchor Link

{"operation":"search_references","input":{"query":"brutalist concrete museum at dusk","limit":12}}

query is 1 to 1,024 characters and limit is 1 to 100 (default 20). To search by image, search_references_by_image takes imageBase64 (a JPEG, PNG or WebP, up to 327,680 decoded bytes) and a limit of 1 to 50 (default 20). Pass a result's previewHandle to get_reference_preview to download a preview. Handles are short-lived and tied to the creating key. A previewUrl is a temporary share link: anyone with it can open the preview for about 24 hours, without your key and even after you revoke it. Don't publish or store it.

Export a board imageCopy Anchor Link

export_board_image renders a selection or the whole board to PNG from a live tab. Read get_board_snapshot, then pass expectedBoardId and sessionId.

{"operation":"export_board_image","input":{"expectedBoardId":"BOARD_ID","sessionId":"SESSION_ID","scope":"board","scale":2,"background":"#ffffff"}}

Limits: 256 items, 8192 pixels per edge, 16 megapixels and 8 MiB PNG. Decode result.base64 to save the file.

RelatedCopy Anchor Link