File a complaint or a grievance into a company's complaint book

The public door of the Libro de Reclamaciones. NO CREDENTIAL: the caller is a consumer, not an integrator, and has no account here. THE BOOK IDENTIFIER IS THE CAPABILITY. It is an opaque UUID we mint for a company and can rotate; it lets its holder WRITE ONE COMPLAINT into one book and nothing else. There is no GET under /public/v1: a leaked identifier cannot read a complaint, cannot reveal whose book it is, and cannot reach anything else on this hostname. EVERY UNUSABLE BOOK ANSWERS THE SAME 404. Unknown identifier, retired book, company no longer active: one code, one message. Distinguishing them would answer 'is this business a client of yours?' for anyone willing to iterate. CORS IS ALLOWED HERE AND NOWHERE ELSE ON THIS HOSTNAME, because the form lives on the client's own domain. `Access-Control-Allow-Origin: *` with NO `Access-Control-Allow-Credentials`, so a browser will not attach the console session cookie to these requests and will not expose a response to a script that tried. RATE LIMITED PER IP, ten entries per sixty seconds, keyed on the address Cloudflare saw. Per IP and not per book on purpose: a per-book bucket would let one flood close a company's legal complaint form for everybody else. THE RECEIPT IS NOT THE BOOK IDENTIFIER. The response carries a tracking code issued per company and per year, which is what the consumer quotes to follow up.

curl -X POST "https://example.com/public/v1/complaint-books/497f6eca-6276-4993-bfeb-53cbbbba6f08/entries" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "kind": "RECLAMO",    "consumer": {      "name": "Ana Torres Mendoza",      "documentType": "DNI",      "documentNumber": "40404040",      "email": "ana.torres@example.com",      "phone": "+51 987 654 321"    },    "item": {      "kind": "SERVICIO",      "description": "Plan mensual de consultoria contratado el 12 de agosto",      "amount": 1180    },    "detail": "Contrate el plan mensual y se cobro el importe completo, pero el servicio no se presto en la fecha acordada ni se me comunico ninguna reprogramacion.",    "requested": "Que se preste el servicio esta semana o se devuelva el importe cobrado."  }'

{  "schemaVersion": "2.0",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "trackingCode": "string",  "kind": "RECLAMO",  "submittedAt": "2019-08-24T14:15:22Z"}