GET
/
api
/
v1
/
legal
/
{slug}
Get a legal document
curl --request GET \
  --url https://api.example.com/api/v1/legal/{slug}
import requests

url = "https://api.example.com/api/v1/legal/{slug}"

response = requests.get(url)

print(response.text)
const options = {method: 'GET'};

fetch('https://api.example.com/api/v1/legal/{slug}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/legal/{slug}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/legal/{slug}"

req, _ := http.NewRequest("GET", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.get("https://api.example.com/api/v1/legal/{slug}")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/legal/{slug}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Overview

Returns one published legal document with its rich-text body. The mobile app’s Terms and Privacy screens render this directly, so the client can update the wording in the admin panel without an app release. slug is one of:
SlugDocument
TERMSTerms & Conditions
PRIVACYPrivacy Policy

Authentication

None. The app links to both documents from the sign-up screen, before a session exists.

About bodyHtml

The body is HTML, sanitized server-side against a fixed allowlist before it is stored. It is safe to render without further processing. Only these tags can appear: h1 h2 h3 h4 p ul ol li strong b em i u a br hr blockquote table thead tbody tr th td The only permitted attributes are href, target and rel on <a>, and link schemes are restricted to http, https, mailto and tel. Script tags, event handlers (onclick), inline styles, classes, ids, images and javascript: URLs are stripped at write time and can never reach a client.

Response — 200 OK

{
  "slug": "TERMS",
  "title": "Terms & Conditions",
  "version": 4,
  "effectiveAt": "2026-08-03T00:00:00.000Z",
  "bodyHtml": "<h2>1. Acceptance of Terms</h2><p>By creating a Swappr account…</p>"
}
FieldTypeNotes
slugstringTERMS or PRIVACY
titlestringDisplay title, editable by admins
versionnumberIncrements only when the title or body wording changes — not when the document is published/unpublished or its effective date is corrected. Use it to detect a genuine revision.
effectiveAtstringISO-8601. Shown to users as the “Last updated” date.
bodyHtmlstringSanitized rich text (see above)

Errors

StatusCodeWhen
400VALIDATION_FAILEDslug is not one of the known documents
404NOT_FOUNDThe document has never been written, or is currently a draft
A 404 is deliberate rather than an empty body: it lets the app show a real error state instead of rendering a blank legal page.