> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parmanasystems.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Capture an email address, then redirect straight to the handbook PDF

> Backs the plain-HTML-form download at docs/site/handbook/download.mdx -- a GET so a `<form method="get">` with no client-side JavaScript can submit it directly, since the docs site host may sandbox or strip inline `<script>` tags. Deliberately mounted before this app's caller-auth middleware, see packages/api/src/app.ts: a visitor downloading the handbook has no Parmana credential yet. Records the email address; does not send a verification email, see migration 20260916150000_add_handbook_download_leads.sql's own comment for why that is a deliberate scope boundary, not an oversight.




## OpenAPI

````yaml /openapi.bundled.yaml get /handbook/download-leads
openapi: 3.1.0
info:
  title: Parmana API
  version: 1.0.0
  description: >
    Parmana is an Execution Trust Infrastructure that ensures there is no gap
    between what humans decide and what AI systems do. The API enables creation,
    execution, verification, replay, and auditing of Business Transactions
    through cryptographically verifiable Execution Trust Records.


    **Every route requires a caller bearer key**, except the liveness/readiness
    probes and documentation/verification routes that must be reachable with no
    credential: GET /health, GET /ready, GET /openapi.yaml, GET /documentation,
    GET /reference, POST /refusal/verify, POST /audit/verify, GET /keys/{keyId},
    and GET /.well-known/jwks.json. Send `Authorization: Bearer <key>` on every
    other request. Keys are issued by `scripts/generate-api-key.ts` and
    configured server-side via `PARMANA_API_KEYS`; only a hash of each key is
    ever held by the server, verified in constant time. A missing or invalid
    credential returns 401 before a Business Transaction is even constructed,
    independent of Policy evaluation and gateway attestation, see
    `packages/api/src/middleware/caller-auth.ts` and
    [Authentication](/api-reference/authentication). Local development may set
    `PARMANA_AUTH_DISABLED=true` to skip this middleware entirely; that flag
    must never be set in a real deployment.
  contact:
    name: Parmana Systems
    email: founder@parmanasystems.com
  license:
    name: Proprietary, source-available for evaluation only, see LICENSE
    url: https://github.com/pavancharak/AgentLabsBuildathon/blob/main/LICENSE
servers:
  - url: https://parmana-api-real.vercel.app
    description: >-
      Production (real, deployed instance -- the docs site playground uses this
      by default)
  - url: http://localhost:3000
    description: Local (packages/api, PORT env var, default 3000)
security:
  - bearerAuth: []
tags:
  - name: Execution
    description: >-
      Executes a Business Transaction through the complete Execution Trust
      pipeline
  - name: Transactions
    description: Business Transaction creation and retrieval
  - name: Verification
    description: Deterministic verification of an Execution Trust Record
  - name: Receipts
    description: Cryptographically signed Execution Trust Receipts
  - name: Trust Records
    description: Execution Trust Record retrieval
  - name: Replay
    description: Deterministic replay of a recorded Execution Trust Record
  - name: Policies
    description: Policy existence/readability check
  - name: Policy Governance
    description: Maker-checker proposal, listing, approval, and rejection of policy changes
  - name: Refusal Records
    description: >-
      Durable, signed evidence that a policy decision rejected a transaction
      (RFC-0021)
  - name: Audit
    description: >-
      Signed caller-authentication audit events, independently
      third-party-verifiable
  - name: System
    description: Operational endpoints
paths:
  /handbook/download-leads:
    get:
      tags:
        - Handbook
      summary: Capture an email address, then redirect straight to the handbook PDF
      description: >
        Backs the plain-HTML-form download at docs/site/handbook/download.mdx --
        a GET so a `<form method="get">` with no client-side JavaScript can
        submit it directly, since the docs site host may sandbox or strip inline
        `<script>` tags. Deliberately mounted before this app's caller-auth
        middleware, see packages/api/src/app.ts: a visitor downloading the
        handbook has no Parmana credential yet. Records the email address; does
        not send a verification email, see migration
        20260916150000_add_handbook_download_leads.sql's own comment for why
        that is a deliberate scope boundary, not an oversight.
      operationId: getHandbookDownloadLead
      parameters:
        - name: email
          in: query
          required: true
          schema:
            type: string
            format: email
      responses:
        '302':
          description: >-
            Email captured. Redirects to the static PDF file on the docs site's
            own domain.
          headers:
            Location:
              schema:
                type: string
              example: https://parmana-api-real.vercel.app/parmana-handbook.pdf
        '400':
          description: >-
            Missing or malformed email address (plain text body, not the shared
            error envelope, since this route is meant to be hit by a browser
            form submission, not an API client).
          content:
            text/plain:
              schema:
                type: string
              example: A valid email address is required.
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >
        Caller API key issued by scripts/generate-api-key.ts. Sent as
        Authorization: Bearer <key>. Verified against a stored SHA-256 hash in
        constant time by packages/api/src/auth/StaticKeyAuthenticator.ts.
        Required on every route not listed as exempt in this document's
        top-level description. See /api-reference/authentication.

````