Cardagain API

Exchange a Google or Apple ID token, or a session, for a device token.

Two entry modes. With `idToken`, no prior credential is needed -- the token itself is verified in-process, by the provider `idToken.provider` names (`google` when omitted), the same way a browser completing that provider's redirect would be. Without it, the caller must already hold a session cookie. Either way the minted token is scoped to `sync` on the `collection` surface and expires in 180 days.

curl -X POST "https://api.cardaga.in/auth/device-tokens" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Revoke the device token that made this call.

The bearer token the request carries is revoked and answers 401 from then on. Other device tokens of the same account and any browser session are untouched.

curl -X DELETE "https://api.cardaga.in/auth/device-tokens/current" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Mint a one-time code that hands this browser session to an app.

Requires a browser session (a device token cannot mint one). The code is single-use, expires in five minutes, and is exchanged at `POST /auth/device-tokens` with `handoff` and the PKCE verifier whose S256 challenge this request carried.

curl -X POST "https://api.cardaga.in/auth/device-handoffs" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Receive Apple's notice that a Sign in with Apple account changed.

Called by Apple, not by a client. `payload` is a JWS Apple signed; it is refused unless its issuer is Apple, its audience is this deployment's app, and its signature verifies against Apple's published keys. A verified `consent-revoked` or `account-deleted` removes the Apple link from the account and ends every session and device token it holds; the account and its collection stay. Forwarding changes are acknowledged and change nothing. 404 on a deployment with no Sign in with Apple configured.

curl -X POST "https://api.cardaga.in/auth/apple/notifications" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List decks, flat and paginated.

A flat, keyset-paginated scan, for pickers and autocomplete. Pass the `nextCursor` from one page as `?cursor=` for the next; there is no offset, and sending one is a 400. Use `tree` instead when you need nesting or due counts — this route returns neither.

curl "https://api.cardaga.in/decks" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Create a deck, optionally under a parent.

Pass `parentId` to nest. The response carries the materialized `path` and the `::`-joined `displayPath`, both derived server-side — do not construct either yourself. A sibling with the same name under the same parent is a 409.

curl -X POST "https://api.cardaga.in/decks" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

The whole deck tree with due counts, as the deck screen renders it.

One bounded read of the entire collection, with new/learning/review counts rolled up to each node the way the deck screen shows them. Unpaginated by design: a deck tree is small and a partial one is not useful. Counts honour the caller’s day rollover, so this route’s answer changes at their rollover hour rather than at midnight UTC.

curl "https://api.cardaga.in/decks/tree" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one deck.

The deck itself, with no counts and no children. Another user’s deck answers 404, identically to a deck that does not exist — the two are deliberately indistinguishable.

curl "https://api.cardaga.in/decks/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Rename a deck, or change its options.

A rename is the expensive half: it rewrites `path` and `displayPath` for every descendant in one statement, so renaming a deck with a large subtree costs proportionally more than changing its preset. Cosmetic changes take neither that cost nor that lock, which is why the two are dispatched separately. A name colliding with a sibling is a 409.

curl -X PATCH "https://api.cardaga.in/decks/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Delete a deck, moving or cascading its cards explicitly.

The body must state where the cards go, because there is no safe default: `ON DELETE RESTRICT` in the database refuses an unqualified delete, and this route cannot express one. `affected` reports how many cards were moved or deleted.

curl -X DELETE "https://api.cardaga.in/decks/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Re-parent a deck, rewriting the subtree path.

Moves the deck and everything beneath it. Re-parenting a deck into its own descendant is a 409 rather than a cycle. Scheduling is untouched: cards keep their state, and their preset unless it was inherited, in which case they inherit the new parent’s.

curl -X POST "https://api.cardaga.in/decks/{id}/reposition" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List option presets.

Keyset-paginated. A preset is a named group of scheduling options — new/day, maximum interval, learning steps, burying — shared by however many decks point at it.

curl "https://api.cardaga.in/deck-presets" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Create an option preset.

Options you omit take the same defaults a new collection starts with, so a preset that sets only `newPerDay` is complete rather than partial. Creating one changes no deck until a deck points at it.

curl -X POST "https://api.cardaga.in/deck-presets" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one option preset.

The preset’s full option set. It does not report which decks use it; list decks and filter on `presetId` for that.

curl "https://api.cardaga.in/deck-presets/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Change an option preset.

Takes effect for **every** deck that points at this preset, on the next queue build — that shared blast radius is the whole reason presets are a separate resource rather than fields on a deck. Cards already in a learning step keep the steps they started.

curl -X PATCH "https://api.cardaga.in/deck-presets/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Delete an option preset.

Decks referencing it are not deleted and not blocked: `ON DELETE SET NULL` drops them back to inheriting their parent’s preset, which is why this is a 200 rather than the 409 a restrictive constraint would produce.

curl -X DELETE "https://api.cardaga.in/deck-presets/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List note types with their fields and templates.

A note type is the schema for a note: its ordered fields, and the card templates that turn those fields into cards. Small and bounded, so this returns the whole structure rather than making a caller fetch each one.

curl "https://api.cardaga.in/note-types" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Create a note type.

Standard types generate one card per template; a cloze type generates one card per distinct cloze ordinal found in its fields. That choice is fixed at creation because the two kinds generate cards by different rules.

curl -X POST "https://api.cardaga.in/note-types" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one note type.

Fields in their display order with their ids, plus every template’s question and answer format. The ids are what `POST /notes` expects as field keys.

curl "https://api.cardaga.in/note-types/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Rename a note type, or edit its fields and templates.

Editing a template re-renders every card that uses it, which is cheap. Adding or removing a FIELD is not: it rewrites every note of this type. To restructure fields across existing notes, use `migrationPreview` and `migrate`, which are transactional and undoable — this route is not the place for it.

curl -X PATCH "https://api.cardaga.in/note-types/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Record how this note type's cards should be written. Changes no schema.

Prose guidance for agents and for humans — what a good card of this type looks like, what to put in each field. Read by the Scribe and by `get_deck_profile` over MCP. It touches no field, no template and no note, so it is safe to edit at any time.

curl -X PATCH "https://api.cardaga.in/note-types/{id}/guide" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Copy the structure under a new name. Notes are not copied.

The way to experiment with templates without risking existing notes: you get an empty note type with the same fields and templates, and the original is untouched.

curl -X POST "https://api.cardaga.in/note-types/{id}/clone" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

What a plan would change, orphan, add, and remove. Writes nothing.

Field restructuring is the one operation here that can lose data, so the preview is a first-class route rather than a flag. It reports which notes lose content, which cards would be orphaned, and which would be created — before anything happens.

curl -X POST "https://api.cardaga.in/note-types/{id}/migration-preview" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Apply a plan in one transaction, with an undo entry holding the inverse.

All of it or none of it, and reversible afterwards. Run `migrationPreview` with the same plan first: this route does not report what it is about to do, it does it.

curl -X POST "https://api.cardaga.in/note-types/{id}/migrate" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

The browser list, and search, which are the same query.

Keyset-paginated. The Browse screen and a `?q=` search hit this one route through one parser, so a query that works in the UI works here character for character — there is no second grammar to learn and none to drift.

curl "https://api.cardaga.in/notes" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Create a note, generating its cards.

Cards are generated from the note type’s templates, so a two-template type produces two cards and a cloze type produces one per distinct ordinal. The response reports what was generated rather than leaving the caller to infer it. A duplicate first field is allowed, and reported — see `duplicates`.

curl -X POST "https://api.cardaga.in/notes" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one note with its fields and tags.

Field values are keyed by field id, not by name, because names are editable and ids are not. Resolve names through the note’s type. Another user’s note answers 404.

curl "https://api.cardaga.in/notes/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Patch fields and/or tags. 409 when `ifUnmodifiedSince` is stale.

Editing a field can create or destroy cards: adding a cloze ordinal generates one, and emptying a field that a template is conditional on can orphan one. The response says what changed. `ifUnmodifiedSince` makes the write a compare-and-swap, which is what stops an agent’s stale edit from overwriting a human’s newer one.

curl -X PATCH "https://api.cardaga.in/notes/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Delete a note and its cards.

A soft delete that is undoable and syncs as a tombstone, so a deletion made offline propagates rather than being resurrected by the next replica that has not heard about it.

curl -X DELETE "https://api.cardaga.in/notes/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Apply one action to many notes at once.

Every action reports `affected` before anything else, and every one writes a single undo entry so the whole batch reverses as one action rather than as N. Prefer this to looping: a thousand single calls is a thousand transactions and a thousand undo entries.

curl -X POST "https://api.cardaga.in/notes/bulk" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Live duplicate detection while typing.

Matches on the first field, the same rule Anki uses, scoped to the note type. Built to be called on every keystroke: it reads an index and returns ids, and it is a POST only because the field value can be longer than a URL should carry.

curl -X POST "https://api.cardaga.in/notes/duplicates" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List cards, filtered and paginated.

Keyset-paginated. Cards are generated from notes by a note type — this route reads them, and nothing here changes what a note says. Filter by deck, state, flag or suspension; for anything richer use the browser query grammar at `GET /search/cards`.

curl "https://api.cardaga.in/cards" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one card.

The card with its scheduling state — due date, interval, ease, lapses, queue position — and the note fields it renders from. Another user’s card answers 404, not 403.

curl "https://api.cardaga.in/cards/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Suspend cards, taking them out of the queue indefinitely.

A suspended card is never gathered, keeps its scheduling state untouched, and resumes exactly where it was when unsuspended. Batch: pass every id in one call rather than looping, and `affected` reports how many actually changed.

curl -X POST "https://api.cardaga.in/cards/suspend" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Return suspended cards to the queue.

Restores the card to whatever state it held when suspended. A card whose due date passed while suspended becomes due immediately rather than being rescheduled — no time was served, and pretending otherwise would silently rewrite the user’s history.

curl -X POST "https://api.cardaga.in/cards/unsuspend" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Bury until the user’s next rollover, computed server-side.

Burying hides a card for the rest of the study day only. The rollover instant is computed from the caller’s own rollover hour and timezone, server-side, so a client in a different zone cannot bury a card until the wrong moment.

curl -X POST "https://api.cardaga.in/cards/bury" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Unbury cards immediately, before rollover.

Clears both the buried-until instant and the reason, so a sibling buried by the answer of another card becomes available again in the same session.

curl -X POST "https://api.cardaga.in/cards/unbury" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Set or clear a colour flag on cards.

Flags are the user’s own marks and mean nothing to the scheduler — flagging changes nothing about when a card is next seen. Flag 0 clears. Batch, with `affected`.

curl -X POST "https://api.cardaga.in/cards/flag" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Renumber new cards. `shiftExisting` renumbers everything after the start.

New cards are gathered in queue-position order, so this is how a caller controls what gets studied first. With `shiftExisting`, every new card at or after `start` is pushed along to make room, which touches far more rows than the ids you passed — the response reports the true count.

curl -X POST "https://api.cardaga.in/cards/reposition" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Move cards to another deck.

Scheduling is preserved: a card carries its own state and does not restart because it changed deck. What can change is which preset applies, and therefore its limits and burying behaviour, from the next queue build onward.

curl -X POST "https://api.cardaga.in/cards/move" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List saved card skills.

A card skill is a reusable AI instruction the user has written — “generate audio for the Back field”, “reformat until it fits on a phone” — that can be run over a whole deck.

curl "https://api.cardaga.in/card-skills" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Create a card skill.

`instructions` is what to do per card and `doneWhen` is how the agent judges it finished; both are prose. `config` is validated against a schema per skill kind rather than accepted as a free object, so a misspelled voice fails here and not mid-run.

curl -X POST "https://api.cardaga.in/card-skills" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one card skill.

Its instructions, its definition of done, and its typed config: the voice and language for a speech skill, the target field for a formatting one.

curl "https://api.cardaga.in/card-skills/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Edit a card skill.

Affects future runs only. A run in flight carries the version of the skill it started with, so editing a skill cannot change what an executing batch is doing halfway through.

curl -X PATCH "https://api.cardaga.in/card-skills/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Delete a card skill.

Past runs and the revisions they produced are kept — deleting the instruction does not delete the history of what it did, or the ability to undo it.

curl -X DELETE "https://api.cardaga.in/card-skills/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List the speech voices this deployment can use.

Read from the configured speech upstream, not hard-coded, so it reflects what is actually available. Returns an empty list when no speech service is configured, which is a supported deployment rather than an error.

curl "https://api.cardaga.in/card-skills/voices" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List skill runs, newest first.

A run is one card skill executed across a deck. Keyset-paginated, with per-run counts of what succeeded, failed and was skipped.

curl "https://api.cardaga.in/skill-runs" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Start a card skill over a deck.

Queues the run and answers immediately with an id. The worker executes per card against the same MCP tool surface an external client would use, so a skill can do nothing a third-party agent could not.

curl -X POST "https://api.cardaga.in/skill-runs" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Fetch one run with its per-card outcomes.

Every card the run touched, what happened to it, and the revision it produced. This is what makes a batch of AI edits auditable rather than something that just happened.

curl "https://api.cardaga.in/skill-runs/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Stop a running skill run.

Cards already processed keep their edits and stay undoable; cards not yet reached are skipped. Cancelling is not a rollback — use `undo` for that.

curl -X POST "https://api.cardaga.in/skill-runs/{id}/cancel" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Reverse every revision a run produced, as one action.

A run can touch hundreds of notes, so undoing it card by card is not a real option. This reverts the whole batch in one transaction, restoring each note’s prior snapshot.

curl -X POST "https://api.cardaga.in/skill-runs/{id}/undo" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Due cards in queue order, with counts and the scheduling preset.

The whole study session in one read: the gathered cards in the order they should be shown, the new/learning/review counts behind them, and the resolved preset the client needs to render predicted intervals on the answer buttons. Honours the caller’s day rollover, suspension and burying.

curl "https://api.cardaga.in/queue/next" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Commit one answer. Idempotent on `clientEventId`.

Writes the review, advances the card’s FSRS state, and buries siblings when the preset says to. `clientEventId` makes a retry free rather than merely harmless: replaying one returns the original result and schedules nothing twice, which is what lets an offline client flush a queue of answers without checking what landed.

curl -X POST "https://api.cardaga.in/queue/answer" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Reverse the most recent answer.

Pops the newest entry off the undo stack and restores the card’s prior state wholesale rather than computing an inverse. 404 when the stack is empty. Pass `expectedReviewLogId` to make it a compare-and-swap: a mismatch is a 409 rather than undoing an answer the caller did not know about, which is what stops two devices undoing each other’s reviews.

curl -X POST "https://api.cardaga.in/queue/undo" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Review history for a card or a deck.

The raw `review_log` rows — rating, interval before and after, duration, and when. Keyset paginated and append-only: this is the record the scheduler’s behaviour can be replayed from, so nothing here is ever rewritten.

curl "https://api.cardaga.in/reviews" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Where this account’s study day starts.

Timezone, rollover hour and the knobs beside them. An account that has never set anything reads as the defaults — UTC, a 04:00 rollover — rather than as missing, because the scheduler already falls back to exactly those.

curl "https://api.cardaga.in/preferences" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Change the timezone or the rollover hour.

Send only what changed. A value equal to the stored one is a no-op that leaves the row untouched, so a client may report the browser’s zone on every sign-in — which the web app does — without churning sync. The zone must be one the server can resolve; a UTC offset is not a zone and is refused.

curl -X PATCH "https://api.cardaga.in/preferences" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

List tags with their usage counts.

Hierarchical, `::`-separated, and independent of decks. `usageCount` is maintained by a trigger rather than counted per request, so this stays cheap on a large collection.

curl "https://api.cardaga.in/tags" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Rewrite the tag and its subtree. Also re-parents, if the path moves.

One statement over the subtree, not a loop: renaming `spanish` to `Spanish` rewrites every descendant path with it. Because a tag’s identity IS its path, a rename whose new path sits under a different parent is also a move, which is why there is no separate re-parent route.

curl -X PATCH "https://api.cardaga.in/tags/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Delete a tag and its subtree.

Removes the tag from every note carrying it. The notes themselves are untouched: a tag is a label, and deleting a label has never been a reason to delete what it labelled.

curl -X DELETE "https://api.cardaga.in/tags/{id}" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Move `note_tags` rows to the target, then drop the source subtree.

The fix for `spanish` versus `Spanish` after an import. Notes already carrying the target are not duplicated — `notesMoved` counts only the rows that actually gained it — and the source subtree is deleted once its notes are re-pointed.

curl -X POST "https://api.cardaga.in/tags/merge" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Type-ahead for the token under the caret.

Given a partial query and a caret position, returns completions for the token being typed — deck names after `deck:`, tags after `tag:`, and the field names of the note type in scope. It parses the same grammar the search itself uses.

curl "https://api.cardaga.in/search/suggest" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

The headline numbers for a collection or a deck.

Card counts by state, review totals, streak and retention — what the statistics screen shows above the charts. Day boundaries follow the caller’s rollover hour, not UTC.

curl "https://api.cardaga.in/stats/summary" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Reviews per day, as the calendar grid renders them.

One bucket per study day over the requested range, counted against the caller’s own rollover so a session finished at 2am lands on the day the user considers it.

curl "https://api.cardaga.in/stats/heatmap" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Cards coming due per day, capped at a one-year horizon.

Projects existing due dates forward; it does not simulate answers, so it is a floor rather than a prediction — cards that lapse will reappear sooner than this says. The cap is deliberate: beyond a year the numbers are noise with a chart around them.

curl "https://api.cardaga.in/stats/forecast" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

How current intervals are distributed across the collection.

Bucketed by interval length, which is what makes the difference between a healthy collection and one full of leeches visible at a glance. Every bucket is returned even when empty, so the shape of the chart does not change with the data.

curl "https://api.cardaga.in/stats/intervals" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Answer counts split by review kind, because Again means two things.

Again on a learning card is an ordinary step; Again on a mature card is a lapse. Folded together they produce a retention number that flatters a collection nobody is retaining, so they are counted apart.

curl "https://api.cardaga.in/stats/buttons" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Pass rate over cards already in review, young and mature apart.

Excludes learning cards entirely. Including them is the most common way this number gets inflated — a card answered correctly thirty seconds after being shown has demonstrated nothing about retention.

curl "https://api.cardaga.in/stats/true-retention" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

What a break would cost: recall projected forward, and the reviews that pile up.

Every studied card’s forgetting curve, run forward day by day as if nothing were reviewed, summed into the number of cards you would still recall — plus the reviews that would be waiting on each day. Expected values from the scheduler’s own model, not a simulation. Reads `cards`, not the review log.

curl "https://api.cardaga.in/stats/memory" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Every deck's recall against its own target, and how fast its new cards are met.

One row per deck, counting its own cards only: true retention over the last 30 study days, young and mature apart, with the deck’s effective target retention beside it; its studied and new card counts; and how many cards were answered for the first time over the last 28 study days. Reads the daily rollup and `cards`, never the review log.

curl "https://api.cardaga.in/stats/decks" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Where review time went: the costliest cards, and how lopsided the time is.

Cards ranked by the answer time they took over the window, each answer counted for at most a minute; the cumulative share of time against the share of cards; and the five costliest cards with their whole answer history. The one stats route that reads the review log -- a per-card number the daily rollup cannot hold -- bounded to one user and the window.

curl "https://api.cardaga.in/stats/time-sinks" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"

Thread roots on a card back, or a thread’s replies.

Insights are the tutor’s answers, persisted against the card rather than living in a chat window — which is the whole feature: they are still there on the next review. Without `threadId` you get the roots; with it, that thread’s replies in order.

curl "https://api.cardaga.in/cards/{cardId}/insights" \
  -H "Authorization: Bearer $CARDAGAIN_API_KEY"