---
title: "POST /config/import/preview"
method: POST
path: "/config/import/preview"
tags: ["config"]
---

# POST /config/import/preview

`POST /config/import/preview`

Decrypt a bundle's manifest and return its non-secret descriptive metadata
so the UI can confirm before staging. Read-only and ungated. D14:
session-JWT gated; the handler MUST NOT log the request body.

## Request body

- PreviewImportRequest — Request body for `POST /config/import/preview`. Read-only: decrypts the bundle's manifest to surface descriptive metadata for operator confirmation. The handler MUST never log this body.
  - `password` string, required
  - `sourcePath` string, required

## Response `200`

Bundle preview metadata

- PreviewImportEnvelope — Canonical success envelope: `{ "data": T, "ts": <unix millis i64> }`. `ts` is `chrono::Utc::now().timestamp_millis()`, set in the webserver handler via [`ApiEnvelope::now`] (the contract carries only the type + the clock helper, not a hard dependency on when the handler reads the clock). `rename_all = "camelCase"` is a no-op for the single-word fields here but is declared for forward-compat. IMPORTANT (utoipa v4): every concrete `ApiEnvelope<X>` that needs a named OpenAPI component is declared in the `#[aliases(...)]` block below. Add a new alias line whenever a new payload type needs enveloping. NEVER register the bare `ApiEnvelope` in `components(schemas(...))` — utoipa errors on a bare generic, and an un-aliased generic inlines an anonymous schema.
  - `data` PreviewImportResponse, required — Response payload for `POST /config/import/preview`. Carries only non-secret descriptive metadata read from the bundle manifest.
    - `appVersion` string, required — Application version string of the installation that produced the bundle.
    - `createdAtUnixMs` integer, required — Bundle creation time, milliseconds since the Unix epoch.
    - `deviceFingerprint` string, required — Stable identity fingerprint of the producing device, for human confirmation. Adopting this bundle makes the target device present itself under this same identity.
    - `profileId` string, required — Profile the bundle's configuration belongs to.
    - `sourceMode` string, required — Storage layout the bundle was produced under (`portable` / `installed`).
  - `ts` integer, required — Server time when the response was built (unix epoch milliseconds).

## Other responses

- `400` — Invalid password or corrupt bundle
- `422` — Incompatible bundle
- `500` — Internal server error

---

[API](https://skmtc.net/uniclipboard/apis/uniclipboard-daemon-api.md) · [All operations](https://skmtc.net/uniclipboard/apis/uniclipboard-daemon-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/uniclipboard/uniclipboard-daemon-api/versions/a5d29889448a/schema)