# Submit an authorized observation

This is HTTP API documentation, not an automatically installed chat skill. The client must support binary multipart uploads and reach the running service.

1. Read /agents.md and obtain the user's explicit consent described there.
2. POST /api/observations as multipart/form-data, not JSON or an image URL.
3. Required fields: photo (actual JPEG, PNG, HEIC or HEIF bytes, at most 15 MiB), idempotency_key (a new UUID for each new submission), accepted_terms=true ONLY after consent. Send terms_version=terms-2026-09-04 and privacy_version=privacy-2026-09-04 after checking the current notices.
4. Optional: note (up to 1,000 characters), repeated tags fields (wildlife, trash, erosion, water-color, vegetation, hazard, documenting). No email or device_id is required. Omit location, latitude and longitude: the normal flow extracts available GPS from the photo; missing GPS is allowed.
5. On 201, report status=received and preserve the receipt. Do not describe it as scientific validation. The returned place story is the Montgomery test content.
6. On a connection failure, retry the same payload with the SAME idempotency key. Do not reuse that key for a different photo. A 422 means validation failed: read detail and ask the user to correct the input. Never bypass access controls.

Example (run only after the user's consent; replace file path and UUID):

```sh
curl --fail-with-body 'https://snapforwater.org/api/observations' \
  -F 'photo=@/path/to/authorized-photo.jpg' \
  -F 'idempotency_key=REPLACE-WITH-A-NEW-UUID' \
  -F 'accepted_terms=true' -F 'terms_version=terms-2026-09-04' \
  -F 'privacy_version=privacy-2026-09-04'
```

The exact field schema is at /api/observation-openapi.json. When CAPTCHA is enabled, also send g-recaptcha-response: a fresh v3 token for action observation from the canonical website. Plain HTTP clients without a legitimate browser token cannot submit; no agent bypass exists. The preview gate may require owner-issued credentials; none are published here.