Previews and confirm

Some writes cannot be undone: deleting a file, deleting a digital product, deleting licence keys. Others reach a lot of people at once, or overwrite work. For these actions API v2 asks you to confirm, and it shows you the effect first.

How it works

1. Send the request without confirm. Nothing changes. The API answers 409 with code: "confirmation_required", a sentence saying exactly what would happen, and the counts involved.
2. Show that to the merchant (or check it in your code), and decide.
3. Send the same request again with confirm: true. Now it runs.

For example, deleting a file without confirm:

curl -X DELETE 'https://app.filemonk.io/api/v2/external/assets/a1b2c3d4-e5f6-7890-abcd-ef1234567890' \
  -H 'X-Auth-Token: fm_api_key_your_key_here'

answers with a 409 that tells you how many digital products and orders the file is on, and changes nothing. To go ahead:

curl -X DELETE 'https://app.filemonk.io/api/v2/external/assets/a1b2c3d4-e5f6-7890-abcd-ef1234567890?confirm=true' \
  -H 'X-Auth-Token: fm_api_key_your_key_here'

The 409 also carries a next_step sentence, which is written to be passed on to a person: “Tell the merchant exactly this; only after they agree, send the same request with confirm: true.”

Where to put confirm

Verb	Where
DELETE	In the query string: DELETE /assets/:id?confirm=true
POST, PATCH, PUT	In the JSON body: {"confirm": true}

Each action page tells you whether the action takes confirm. These do:

• DELETE /assets/:id and POST /assets/bulk_delete
• DELETE /digital_products/:id and POST /digital_products/:id/files/detach
• DELETE /licences/:id, POST /licences/bulk_delete and DELETE /licence_tags/:name
• DELETE /orders/:id, POST /orders/:id/files/detach and DELETE /orders/:id/licences/:licence_id
• POST /orders and POST /orders/:id/resync
• POST /settings/texts/setup

Other previews

• Imports. POST /imports/preview previews an import before POST /imports runs it.
• Emails. Sending is real. send_email, send_emails and notify_buyers email your buyers, so use POST /settings/test_email to see the email first.

AI assistants and previews

The same rule protects you when an AI assistant works on your store through the MCP server. The assistant is told to run a destructive action without confirm first, tell you what it would do, and only repeat it with confirm: true once you agree. Nothing is deleted on the first call.