Quick asset creation

POST /api/projects/new-asset

Requires a signed-in website session and its CSRF token in X-CSRF-Token. Public API keys and OAuth bearer tokens are not accepted. No tokens are spent and no generation task is started. No endpoint-specific numeric rate limit is configured; deployment-level protections apply.

JSON body:

| Field | Type | Meaning |

| --- | --- | --- |

| asset_type | string, optional | 3d_asset (default) or pixel_art |

| prompt | string, optional | Idea, trimmed and capped at 500 characters. For 3D assets, names the asset from its first 80 characters and opens the Studio Text to Image dialog prefilled |

| name | string, optional | Explicit asset name, trimmed and capped at 180 characters, takes precedence over prompt naming |

| project_id | integer, optional | Accessible project, otherwise the user's default project |

| new_project_name | string, optional | Creates a project, takes precedence over project_id |

Example:

curl -X POST 'https://crateyard.com/api/projects/new-asset' \
  -b '{{sessionCookie}}; crateyard_csrf={{csrfToken}}' \
  -H 'X-CSRF-Token: {{csrfToken}}' \
  -H 'Content-Type: application/json' \
  -d '{"asset_type":"3d_asset","prompt":"Red dragon","name":"Dragon"}'

Response 200:

{"ok":true,"redirectUrl":"/projects/example/default-project/asset/dragon?action=describe&prompt=Red+dragon","asset":{"id":123,"name":"Dragon"}}

Errors: unauthenticated requests use the website login redirect, 403 for invalid CSRF, 500 with { "error": "create_failed" } if creation fails. Invalid asset types fall back to 3d_asset. Pixel art ignores prompt naming and the 3D dialog deep link.

POST /projects/new-asset accepts the same fields as a form and redirects to the asset. GET /projects/new-asset?idea=Red%20dragon only renders the chooser with the idea, it never creates an asset. The user confirms generation and its cost in Studio.