> ## Documentation Index > Fetch the complete documentation index at: https://docs.apostra.com/llms.txt > Use this file to discover all available pages before exploring further. # List creative review queue > List buyer-submitted creatives awaiting (or having received) operator review. Defaults to `status=pending` — pass `?status=` to filter by lifecycle state. ## OpenAPI ````yaml /v2/storefront-api-v2.yaml get /creative-reviews openapi: 3.0.0 info: title: Scope3 Storefront API version: 2.0.0 description: >- REST API for partners to manage Seller Accounts, inventory sources, and billing. ## Authentication All endpoints require a Bearer token in the Authorization header: ``` Authorization: Bearer your-api-key ``` ## Base URL `https://api.interchange.io/api/v2/storefront` ## For AI Agents AI agents can use the MCP endpoint at `/mcp/v2/storefront` with three tools: - `initialize`: Start an MCP session - `api_call`: Make REST API calls - `ask_about_capability`: Learn about API features servers: - url: https://api.interchange.io/api/v2/storefront description: Production server security: [] tags: - name: Account description: Account management, service tokens, and preferences - name: Asks description: >- What you are waiting on Scope3 for — support, product, and supply asks in one list - name: Storefront description: Manage storefront and inventory sources - name: Storefront Agents description: List and manage registered sales, signals, and outcomes agents - name: Storefront Activity description: Audit log of configuration and inventory changes on the storefront - name: Storefront Billing description: Payout bank details and billing configuration for Seller Accounts - name: AI Usage description: Seller Account AI token usage visibility by model - name: MCP description: Model Context Protocol endpoints paths: /creative-reviews: get: tags: - Storefront summary: List creative review queue description: >- List buyer-submitted creatives awaiting (or having received) operator review. Defaults to `status=pending` — pass `?status=` to filter by lifecycle state. operationId: listCreativeReviews parameters: - in: query name: status schema: description: >- Filter the queue by review status. Omit to return only `pending` rows (the operator queue default). allOf: - $ref: '#/components/schemas/CreativeReviewStatus' description: >- Filter the queue by review status. Omit to return only `pending` rows (the operator queue default). responses: '200': description: List creative review queue content: application/json: schema: $ref: '#/components/schemas/CreativeReviewListResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: CreativeReviewStatus: type: string enum: - pending - approved - rejected - revoked description: >- Lifecycle state of a buyer-submitted creative awaiting storefront review. `pending` until an operator decides; `approved` or `rejected` after a decision; `revoked` if an operator pulls a previously-approved creative. CreativeReviewListResponse: type: object properties: items: type: array items: $ref: '#/components/schemas/CreativeReviewResponse' description: >- Creative review rows, newest first. Default scope is `status = pending`; pass `?status=` to filter. total: type: integer minimum: 0 maximum: 9007199254740991 description: Number of rows in the current filtered view. required: - items - total additionalProperties: false description: List response for the operator creative review queue endpoint. ErrorResponse: type: object properties: data: type: string nullable: true enum: - null error: $ref: '#/components/schemas/ApiError' required: - data - error additionalProperties: false description: Standard error response CreativeReviewResponse: type: object properties: id: type: string pattern: ^[1-9]\d*$ description: >- Legacy surrogate review row id (BIGINT serialized as a string). Preserved for response compatibility; prefer reviewRef for follow-up actions. example: '42' reviewRef: type: string pattern: ^review:[1-9]\d*$ description: >- Collision-free opaque review reference. Pass this exact value to get, evaluate, or decide this review. example: review:42 storefrontId: type: string description: Storefront the submission was made against. example: '1234' creativeId: type: string description: AdCP creative id as submitted by the buyer. example: cr_abc123 contentDigest: type: string pattern: ^[a-f0-9]{64}$ description: >- Immutable SHA-256 identity of the exact creative object forwarded downstream. Request-level account and correlation fields are excluded. sourceTrust: nullable: true description: >- Receipt-bound source classification and review concurrency identity when observed. Null means provenance was not observed or cannot be proven; clients must fail closed and never use this projection to load network resources. type: object properties: classification: type: string enum: - platform_managed_media - platform_assembled_static - buyer_supplied_active evidence: type: object properties: kind: type: string minLength: 1 digest: type: string pattern: ^[a-f0-9]{64}$ policyVersion: type: string enum: - creative-review-source-trust/v1 required: - kind - digest - policyVersion additionalProperties: false reviewVersionDigest: type: string pattern: ^[a-f0-9]{64}$ inlineAssets: description: >- Legacy response metadata retained for compatibility. Clients must never use these URLs to create image, video, audio, source, prefetch, or other browser network requests; SHA-256 digests are consistency checks, not signatures or rendering authority. maxItems: 20 type: array items: type: object properties: kind: type: string enum: - image - video - audio url: type: string format: uri pattern: ^https:\/\/.* required: - kind - url additionalProperties: false staticRepresentation: type: object properties: kind: type: string enum: - text value: type: string maxLength: 16000 required: - kind - value additionalProperties: false required: - classification - evidence - reviewVersionDigest additionalProperties: false mediaBuyId: nullable: true description: >- AdCP media_buy_id this creative was associated with at submit time, if any. Null when the buyer attaches creatives independently of a buy. type: string buyerCustomerId: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: >- customer_id of the buyer that submitted the creative — the tenancy boundary on buyer-side reads. submittedPayload: description: >- Credential-stripped snapshot of the buyer submission used for review and delivery. It contains the creative fields and may also contain request-level `account`, `buyer_ref`, and `context` used for downstream account selection and callback correlation. Only `push_notification_config` and `pushNotificationConfig` are removed from this operator-facing response and stored separately. previewContexts: type: array items: $ref: '#/components/schemas/CreativePreviewContext' description: >- Current exact preview targets. Empty for legacy, standalone, defaulted, ambiguous, stale, or superseded routes. interactivePreviewAvailable: type: boolean description: >- Server-issued availability for the explicit third-party interactive-preview request. False disables that action only; source inspection and approval decisions remain available. renderPreview: description: >- Live sandboxed preview of the submitted creative, when the render origin is enabled for this environment and the seller. Null or absent means only source inspection is available. nullable: true type: object properties: url: type: string format: uri description: >- Signed, expiring link on the Interchange creative render origin that shows this exact creative inside a sandboxed frame. Embed it in a sandboxed iframe or open it in a new tab; never fetch it server-side. expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: When the link stops working (ISO 8601, about 15 minutes). required: - url - expiresAt additionalProperties: false observation: description: >- What this exact creative version did when Interchange ran it once, headlessly, on the render origin (domains contacted, pixel-shaped requests, redirects, popups, navigation attempts, bytes). Null or absent means it has not been observed; `status` says whether a run is queued, running, or ended without a result. Evidence from one run, never a safety verdict. nullable: true type: object properties: status: type: string enum: - queued - running - completed - timed_out - failed observedAt: nullable: true description: When the run finished, or null while queued or running. type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ record: nullable: true description: The observation itself; null until a run completes. type: object properties: version: type: number enum: - 1 outcome: type: string enum: - completed - timed_out - failed startedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ durationMs: type: integer minimum: 0 maximum: 9007199254740991 viewport: type: object properties: width: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 height: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 required: - width - height additionalProperties: false domains: maxItems: 200 type: array items: type: object properties: domain: type: string minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$ description: Registrable domain (eTLD+1); never a URL. requests: type: integer minimum: 0 maximum: 9007199254740991 kinds: maxItems: 6 type: array items: type: string enum: - script - image - media - xhr - document - other firstParty: type: boolean description: The render origin or the Interchange API itself. required: - domain - requests - kinds - firstParty additionalProperties: false pixels: type: integer minimum: 0 maximum: 9007199254740991 description: >- Heuristic: image responses of at most 128 bytes, 204s, and beacons. redirects: maxItems: 100 type: array items: type: object properties: from: type: string minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$ description: Registrable domain (eTLD+1); never a URL. to: type: string minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$ description: Registrable domain (eTLD+1); never a URL. required: - from - to additionalProperties: false popups: maxItems: 50 type: array items: type: object properties: to: nullable: true type: string minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$ description: Registrable domain (eTLD+1); never a URL. required: - to additionalProperties: false navigationAttempts: type: integer minimum: 0 maximum: 9007199254740991 description: >- Heuristic: sandbox-blocked top navigations reported by the browser plus any main-frame navigation off the shell. consoleErrors: type: integer minimum: 0 maximum: 9007199254740991 bytes: type: integer minimum: 0 maximum: 9007199254740991 media: maxItems: 100 type: array items: type: object properties: kind: type: string enum: - vast - daast - video - audio - image domain: type: string minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$ description: Registrable domain (eTLD+1); never a URL. required: - kind - domain additionalProperties: false metering: type: string enum: - cdp - declared blockedRequests: type: integer minimum: 0 maximum: 9007199254740991 failure: type: string screenshotDropped: type: string enum: - too_large - capture_failed required: - version - outcome - startedAt - durationMs - viewport - domains - pixels - redirects - popups - navigationAttempts - consoleErrors - bytes - media - metering - blockedRequests additionalProperties: false required: - status - observedAt - record additionalProperties: false thumbnailUrl: description: >- App-relative, authenticated path to a PNG of the creative frame from the observation run, e.g. `/api/v2/storefront/creative-reviews/review:42/thumbnail`. Null or absent when no screenshot exists. Never a public URL. nullable: true type: string status: $ref: '#/components/schemas/CreativeReviewStatus' reviewedBy: nullable: true description: >- User id of the operator who decided this review (BIGINT serialized as string). Null while pending. type: string reviewedAt: nullable: true description: Decision timestamp (ISO 8601). Null while pending. type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ reviewerNotes: nullable: true description: >- Free-text reviewer note attached at decide time. Null when the operator did not supply one. type: string createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: Submission timestamp (ISO 8601). updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: >- Last-modified timestamp (ISO 8601). Equal to created_at while pending; bumped when the row transitions to a decided state. required: - id - reviewRef - storefrontId - creativeId - contentDigest - sourceTrust - mediaBuyId - buyerCustomerId - submittedPayload - previewContexts - interactivePreviewAvailable - status - reviewedBy - reviewedAt - reviewerNotes - createdAt - updatedAt additionalProperties: false description: >- A single creative review queue row — one buyer-submitted creative awaiting (or having received) an operator decision. ApiError: type: object properties: code: type: string description: Machine-readable error code message: type: string description: Human-readable error message field: description: Field path associated with the error type: string details: description: Additional error context type: object additionalProperties: {} required: - code - message additionalProperties: false description: Structured error object CreativePreviewContext: type: object properties: contextRef: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ description: >- Opaque server-resolved preview context. Clients cannot substitute a route, provider, capability, package, or placement. buyerPackageId: type: string minLength: 1 placement: anyOf: - type: object properties: kind: type: string enum: - publisher publisherDomain: type: string minLength: 1 placementId: type: string minLength: 1 required: - kind - publisherDomain - placementId additionalProperties: false - type: object properties: kind: type: string enum: - seller placementId: type: string minLength: 1 required: - kind - placementId additionalProperties: false required: - contextRef - buyerPackageId - placement additionalProperties: false description: >- Opaque package/placement context eligible for authority-resolved preview. Provider, agent, route, capability, and format identities stay server-side. Missing contexts mean the review remains source-inspection only. securitySchemes: bearerAuth: type: http scheme: bearer description: API key or access token ````