Propose an intent

POST 
/intents

Propose a dangerous or irreversible action for human approval. Returns a review_url where a human must review the impact and approve before the action executes.

The entity that proposes an intent can never approve it. Approval always happens on Wefunder's UI by a user with permission on the resource.

Each action names the scope that may propose it and the resource type it targets (syndicates.* → write:syndicates on a syndicate; comments.create → write:comments on a Company). The token must hold that action's scope; holding another proposing scope is not enough (403 insufficient_scope).

comments.create posts a question on a company's Ask tab, or an answer to one, as the requesting user once they approve on wefunder.com. resource_id is the company (co_...); params is \{ target_type: "company" | "comment", target: "co_..." | "cmt_...", body, disclosure_key? \} (disclosure_key ∈ investor, stockholder, promoter, financial_stakeholder). Who may post is the site's own rule: anyone the page is available to may ask (unless the company has closed questions); only the company's team may answer. Only the requester can approve. 20 proposals per user per day (429).

An idempotency_key names one operation. Reusing it for the same operation returns the existing intent (200) while that intent is pending, approved, executing, or executed; reusing it for a different action, resource, or params is a 409 idempotency_conflict.

An action still rolling out per account returns 403 feature_disabled for a user who is not yet enabled. POST /intents/preview runs the same checks without minting.

syndicates.close_deal and syndicates.finalize_deal were removed in 2026-10-15: on this version they answer 400 bad_request ("Unknown action") with details.removed_in_version. A syndicate's managers close and finalize deals on wefunder.com. Intents minted before still appear in GET /intents with those action names.

See Intents documentation for the full pattern.

Request

Responses

200

Idempotent replay — the existing intent for this key and operation.

201

Intent created

401

Authentication required or token is invalid/expired. This error occurs when:

• No Authorization header is provided
• The access token is invalid or malformed
• The access token has expired
• The access token has been revoked

To resolve: Obtain a new access token using the OAuth 2.0 flow.

403

The authenticated user does not have permission to access this resource. This typically means:

• The user is authenticated but lacks the required OAuth scope
• The resource belongs to a different user
• The user's role doesn't allow this operation

Check that your OAuth token includes the necessary scopes for this endpoint.

409

idempotency_conflict — the key was already used for a different operation. Nothing was minted.

422

Invalid action or parameters