REST API

Email check-ins

Mint a link your own system sends. The only presentation where the questions reach someone outside your app.

POST/api/v1/checkin-tokens

Returns a one-time URL on Moyo’s own domain. You email it; we never see the address, and the token carries nothing derived from one — so a link sitting in an inbox is not a name, even to us.

bash

curl -X POST https://moyo.3sb.io/api/v1/checkin-tokens \
  -H "Authorization: Bearer sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"expires_in_days": 14}'

json

{
  "url": "https://moyo.3sb.io/c/0f3a…",
  "dimensions": ["mood", "stop", "money"],
  "expires_at": "2026-11-19T00:00:00.000Z"
}

expires_in_days1 to 30

Defaults to 14. The link works once, whenever it is opened inside that window.

dimensionsresponse only

Drawn by Moyo, not chosen by you — picking which questions to send would be picking which readings to grow.

Before you send

Check the address against the opt-out list first. Someone who has opted out of email check-ins has opted out of yours.

POST/api/optout/check

bash

curl -X POST https://moyo.3sb.io/api/optout/check \
  -H "Authorization: Bearer sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"email": "someone@example.com"}'   # -> {"opted_out": false}

Yes, that means sending us an address. It is hashed in memory, compared, and dropped — not stored, not logged, not counted. The alternatives are worse: a hash you could compute yourself would also be one an attacker could brute-force from a leak, and a downloadable list of hashes is that leak.

The honest limit of this presentation

You know whom you emailed, so you know who could have answered. That is true of any emailed survey and it is true here. What you still cannot learn is what any one person said: the token shares no key with the answers it produces, and the answers carry nothing that links them back to it.