Overview
The Contact API allows visitors to send messages through the portfolio contact form. It automatically sends notification emails to André and confirmation emails to the sender.This endpoint is rate limited to 5 requests per hour to prevent spam.
Send Contact Message
POST /api/contact
Submit a contact form message. This endpoint:
- Validates the input data
- Sends a notification email to André with the message details
- Sends a confirmation email to the sender
- Returns success status
Request Body
Sender’s name (max 100 characters)
Sender’s email address (must be valid format)
Message subject (max 200 characters)
Message content (max 5000 characters)
Response
Indicates successful message delivery
Unique ID from the email service provider (Resend)
Whether the confirmation email was successfully sent to the sender
Example Request
cURL
JavaScript
Python
Example Response
Success (200)
Error - Missing Fields (400)
Error - Invalid Email (400)
Error - Field Too Long (400)
Error - Rate Limited (429)
Error - Server Error (500)
Validation Rules
The API enforces the following validation rules:Required Fields
All four fields (name, email, subject, message) are required
Email Format
Email must match standard email format:
[email protected]Name Length
Maximum 100 characters
Subject Length
Maximum 200 characters
Message Length
Maximum 5000 characters
XSS Protection
All HTML is escaped to prevent XSS attacks
Email Templates
The API uses custom HTML email templates with André’s branding:Notification Email (to André)
Confirmation Email (to Sender)
Security Features
HTML Escaping
Escapes all user input in email templates to prevent XSS attacks via the
escapeHtml() functionEmail Service
The API uses Resend as the email service provider:- Configured with
RESEND_API_KEYenvironment variable - Sends from verified domain
andreruperto.dev - Returns unique message IDs for tracking
- Handles errors gracefully (returns success if notification sent, even if confirmation fails)
Testing Email Templates
Authenticated users can preview email templates without sending actual emails.
Preview Notification Email
Preview Confirmation Email
Implementation Reference
Contact endpoint implementation:backend/src/server.js:337-389
Key functions:
escapeHtml()- Line 44 (XSS prevention)isValidEmail()- Line 54 (email validation)buildNotificationEmail()- Line 79 (notification template)buildConfirmationEmail()- Line 160 (confirmation template)- Contact rate limiter - Line 35 (5 per hour)
