# Create a draft review session, optionally with initial file content.

File content fields are literal UTF-8 payloads. Commentary never treats submitted paths as local files to read.

Canonical: https://commentary.dev/docs/reference/api/create-draft-review

`POST /api/v1/draft-reviews`

File content fields are literal UTF-8 payloads. Commentary never treats submitted paths as local files to read.

## Access

Use a credential with `commentary.comments.write`.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Parameters

| Name | Location | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Commentary-Workspace-Id` | header | string | No | Must match the credential workspace. This header cannot widen grant authority. |
| `X-Correlation-Id` | header | string | No |  |

## Request body

Required. Supported content types: `application/json`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `collaboration` | [ReviewCollaboration](/docs/reference/schemas/review-collaboration) | No |  |
| `title` | string | Yes |  |
| `description` | string | No |  |
| `sourceType` | `"api"` · `"mcp"` · `"cli"` · `"agent_api"` | No |  |
| `agentAlias` | string or null | No | Stable per-agent identifier for agent-authored activity. clientName is not a substitute; the connected human identity remains visible. |
| `files` | array of [DraftReviewFileInput](/docs/reference/schemas/draft-review-file-input) | No |  |
| `gitBase` | [DraftGitBase](/docs/reference/schemas/draft-git-base) | No |  |
| `base` | [DraftGitBase](/docs/reference/schemas/draft-git-base) | No |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request POST \
  'https://commentary.dev/api/v1/draft-reviews' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `201` | Successful response. | object |
| `400` | The request was invalid. | [ExternalError](/docs/reference/schemas/external-error) |
| `401` | Authentication is required. | [ExternalError](/docs/reference/schemas/external-error) |
| `403` | The token or session does not have permission for this resource. | [ExternalError](/docs/reference/schemas/external-error) |
| `404` | The resource was not found. | [ExternalError](/docs/reference/schemas/external-error) |
| `429` | The request was rate limited. | [ExternalError](/docs/reference/schemas/external-error) |

### Successful response fields

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `ok` | `true` | No |  |
| `draftReview` | [DraftReview](/docs/reference/schemas/draft-review) | No |  |
| `sessionId` | string | No |  |
| `reviewUrl` | string | No | Format: uri. |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `createDraftReview`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).