@@ -19,6 +19,9 @@ that may never merge. They are not releases and are not listed here.
 
 ## Unreleased
 
+- `mapbox feedback create` submits a feedback item, filed under the
+  account that owns the token. `mapbox auth login` now also asks for the
+  `user-feedback:write` scope it needs, so log in again to use it.
 - `install.sh`/`install.ps1`: when the install finds a coding agent on the
   machine, it now asks, once, whether to write this CLI's own skill and
   install the Mapbox Agent Skills library for it, naming the agent and what
@@ -33,11 +36,6 @@ that may never merge. They are not releases and are not listed here.
   apps built with Mapbox — filterable, sortable, paginated. Each filter
   takes one value for now. Hand-authored into
   `custom-openapi/`, like `search`, because no upstream spec exists yet.
-  `feedback create`, the write side, is not a command — confirmed directly
-  against production that `user-feedback:write` is silently dropped from a
-  `POST /oauth/register` grant, the same unregistrable shape
-  `accounts create-token` already documents, so no `mapbox auth login`
-  token can ever carry it.
 - `mapbox generate-skills`/`agent-skills install`/`agent-skills update`,
   when no coding agent is detected and none was named with `--agent`,
   `--global` or `--dir`: the failure now carries a stable
 
@@ -6,15 +6,9 @@ openapi: "3.0.0"
 #
 # Hand-authored down to the parameters documented at
 # docs.mapbox.com/api/feedback. See `custom-openapi/README.md` for how a
-# file like this is wired in. `createFeedbackItem` is declared here but
-# never reaches the command surface: it needs `user-feedback:write`, which
-# `POST /oauth/register` silently drops from the granted scope — confirmed
-# directly against production (`curl -X POST
-# https://api.mapbox.com/oauth/register?scope=user-feedback:write ...`
-# returns a registration with that scope missing from the response, the
-# same shape `tokens:write` already documents in `src/spec.rs`'s
-# `UNSUPPORTED_OPERATIONS`). No `mapbox auth login` token
-# can ever carry it, so `feedback create` is not a command today.
+# file like this is wired in. `create` needs `user-feedback:write`, which
+# `mapbox auth login` asks for. `POST /oauth/register` drops it until
+# mapbox/api-accounts#2152 is deployed.
 info:
   title: "Mapbox Feedback API"
   description: >-
@@ -171,26 +165,66 @@ paths:
           description: Forbidden
 
     post:
-      # Not `create`: this operation is never reachable (see below), so the
-      # user-facing name doesn't matter — but the withheld-operation guard
-      # in `generate_skills.rs` checks the bare command word against every
-      # generated file's text, and a bare `create` collides with the
-      # exposed, unrelated `styles create`. A multi-word operationId, the
-      # same shape every other disabled operation already has
-      # (`createToken`, `getFontCoverage`, …), sidesteps that.
-      operationId: createFeedbackItem
-      summary: Submit a new feedback item.
+      operationId: create
+      summary: Submit a feedback item.
       description: >-
-        Not a command — see this file's own header comment for why.
+        Submits one feedback item to Mapbox, filed under the account that owns
+        the token. It goes to Mapbox's review queue, and there is no way to
+        delete it afterwards. Needs a token with `user-feedback:write`.
+      parameters:
+        - name: "access_token"
+          in: query
+          required: true
+          description: "Mapbox API Access Token"
+          schema:
+            type: string
+            minLength: 1
       requestBody:
         required: true
         content:
           application/json:
             schema:
               type: object
+              required: ["feedback", "lat", "lon", "category"]
+              properties:
+                id:
+                  type: string
+                  format: uuid
+                  description: >-
+                    A UUID for the item. Generated when omitted. Sending one
+                    makes a retry safe: a second request with the same id is
+                    rejected rather than filed twice.
+                feedback:
+                  type: string
+                  description: "The text of the feedback."
+                lat:
+                  type: number
+                  description: "Latitude of the place the feedback is about."
+                lon:
+                  type: number
+                  description: "Longitude of the place the feedback is about."
+                category:
+                  type: string
+                  description: >-
+                    The feedback category. Not checked against a list;
+                    `feedback list` shows the ones already in use.
+                feature:
+                  type: object
+                  description: >-
+                    A GeoJSON Feature the feedback is about, with coordinates
+                    in GeoJSON's [longitude, latitude] order.
+                screenshot:
+                  type: string
+                  description: >-
+                    A PNG or JPEG as a data URI (`data:image/png;base64,…`),
+                    not bare base64.
       responses:
-        "201":
+        "200":
           description: The created feedback item.
+        "400":
+          description: >-
+            Bad Request — a missing or invalid field, or an id that already
+            exists.
         "401":
           description: Unauthorized
         "403":
 
@@ -1,6 +1,6 @@
 # Implemented commands
 
-Every command the CLI ships: five auth commands, 35 API operations across 11
+Every command the CLI ships: five auth commands, 36 API operations across 11
 command groups, the tilesets-cli proxy, `completion` and `generate-skills`. Each is
 shown in both of its renderings. Which one you get is decided by `--output`, whose default
 (`auto`) reads stdout: a terminal gets the left column, a pipe or redirect
@@ -10,10 +10,11 @@ gets the right one. See
 Account names, style ids and tokens in the examples are replaced; everything
 else is as the API sent it.
 
-**31 of the 35 were run against the live API and show what came back:** 26
+**32 of the 36 were run against the live API and show what came back:** 26
 on 2026-09-01, `fonts list`, `fonts upload` and `fonts delete` on
 2026-09-08, once `fonts:list`/`fonts:write` became registrable, and
-`feedback list` and `feedback get` on 2026-09-24.
+`feedback list` and `feedback get` on 2026-09-24, and `feedback create` on
+2026-10-02.
 The write operations were exercised as round trips on throwaway objects —
 a style created, updated, drafted and deleted; icons uploaded to a sprite
 and taken out again; a font uploaded and deleted — leaving the account as
@@ -78,7 +79,8 @@ nests, and is typed `mapbox styles draft get`.
 [accounts.list-scopes](#mapbox-accounts-list-scopes)
 
 **[Feedback](#feedback)** — [feedback.list](#mapbox-feedback-list) ·
-[feedback.get](#mapbox-feedback-get)
+[feedback.get](#mapbox-feedback-get) ·
+[feedback.create](#mapbox-feedback-create)
 
 **[Fonts](#fonts)** — [fonts.list](#mapbox-fonts-list) ·
 [fonts.upload](#mapbox-fonts-upload) · [fonts.delete](#mapbox-fonts-delete)
@@ -488,7 +490,8 @@ telling apart:
   registrable — nothing here can force that. `fonts:list` and
   `fonts:write` became registrable on 2026-09-08, which shipped
   `fonts list`, `fonts upload` and `fonts delete`; `styles:download`
-  followed on 2026-09-30 and shipped `styles download`.
+  followed on 2026-09-30 and shipped `styles download`, and
+  `user-feedback:write` shipped `feedback create`.
 - **Withheld deliberately.** `styles set-style-protected` unlocks a style
   for deletion — a live token holding `styles:protect` (which *is*
   registrable) can call it successfully, this CLI just declines to offer a
@@ -898,11 +901,9 @@ hand down to the parameters documented at docs.mapbox.com/api/feedback —
 see `custom-openapi/README.md` for why this command group doesn't come from
 the vendored specs the way most others do.
 
-**`feedback create`, the write side of this API, is not a command.** It
-needs a `user-feedback:write` scope that `POST /oauth/register` silently
-drops from the granted set — confirmed directly against production, the
-same shape `accounts create-token` already documents. No
-`mapbox auth login` token can ever carry it.
+`list` and `get` need `user-feedback:read` and `create` needs
+`user-feedback:write`; `mapbox auth login` asks for both. A login from
+before `create` shipped lacks the write scope, so log in again to use it.
 
 ### `mapbox feedback list`
 
@@ -1031,6 +1032,72 @@ time, not wrapped in `items`:
 
 Same trimming as `list` above.
 
+### `mapbox feedback create`
+
+Submits one feedback item, filed under the account that owns the token.
+It goes to Mapbox's review queue, and the API has no way to delete it, so
+check the body with `--dry-run` first.
+
+#### Parameters
+
+The body is JSON, through `--data` (a string, `@<path>` or `@-`).
+
+| Field | Effect |
+| --- | --- |
+| `feedback` (required) | The text of the feedback. |
+| `lat`, `lon` (required) | The place the feedback is about. |
+| `category` (required) | Any string. It isn't checked against a list; `feedback list` shows the ones already in use. |
+| `id` | A UUID. Generated when omitted. Send your own to make a retry safe: a second request with the same id gets a 400 `Feedback with id … already exists.` rather than a duplicate. |
+| `feature` | A GeoJSON Feature the feedback is about, coordinates in `[lon, lat]` order. |
+| `screenshot` | A PNG or JPEG as a data URI (`data:image/png;base64,…`), not bare base64. |
+
+`trace_id` can't be set here: the API drops it, and an item created this
+way has `trace_id: null`. The new item is readable with `get` at once; it
+can take a minute or so to show up in `list`.
+
+#### Examples
+
+```sh
+mapbox feedback create --dry-run --data @feedback.json
+mapbox feedback create --data '{"id":"77bf502a-026a-460b-a3d1-56a604465a7d","feedback":"Test from mapbox-cli development (feedback create). Please ignore.","lat":60.1699,"lon":24.9384,"category":"general"}'
+```
+
+#### Outputs
+
+Captured live on 2026-10-02. `place_name` is filled in by the API from
+`lat`/`lon`:
+
+<table>
+<tr><th width="50%">Terminal — <code>-o text</code></th><th width="50%">Agent — <code>-o json</code></th></tr>
+<tr><td>
+
+```text
+category             general
+created_at           2026-10-02T11:59:35.969Z
+feedback             Test from mapbox-cli development (feedback create). Please ignore.
+has_screenshot       no
+id                   77bf502a-026a-460b-a3d1-56a604465a7d
+location.lat         60.1699
+location.lon         24.9384
+location.place_name  Mannerheimintie 20b, 00100 Helsinki, Finland
+received_at          2026-10-02T11:59:35.969Z
+status               received
+updated_at           2026-10-02T11:59:35.969Z
+```
+
+</td><td>
+
+```json
+{"category":"general","created_at":"2026-10-02T11:59:35.969Z","feedback":"Test from mapbox-cli development (feedback create). Please ignore.","has_screenshot":false,"id":"77bf502a-026a-460b-a3d1-56a604465a7d","location":{"lat":60.1699,"lon":24.9384,"place_name":"Mannerheimintie 20b, 00100 Helsinki, Finland"},"received_at":"2026-10-02T11:59:35.969Z","status":"received","updated_at":"2026-10-02T11:59:35.969Z"}
+```
+
+</td></tr>
+</table>
+
+A token without `user-feedback:write` gets a 403 naming the scope. For a
+login, the fix is `mapbox auth login` again; for a token passed with
+`--token` or `MAPBOX_ACCESS_TOKEN`, it is adding the scope to that token.
+
 ---
 ## Fonts
 
 
@@ -70,6 +70,9 @@ const VALIDATION_ENDPOINT: &str = "https://api.mapbox.com/tokens/v2";
 // Holding it is not enough on its own: the account also needs access Mapbox
 // grants on request, and `remedy::for_http` tells that 403 apart from a
 // missing scope.
+// `user-feedback:write` (`feedback create`) is registrable once
+// mapbox/api-accounts#2152 is deployed. Until then registration silently
+// drops it, so asking for it changes nothing.
 const DEFAULT_SCOPES_LIST: &[&str] = &[
     "styles:tiles",
     "styles:read",
@@ -88,6 +91,7 @@ const DEFAULT_SCOPES_LIST: &[&str] = &[
     "user-feedback:read",
     "statistics:read",
     "styles:download",
+    "user-feedback:write",
 ];
 
 /// [`DEFAULT_SCOPES_LIST`], space-joined the way the OAuth `scope` parameter
@@ -2318,6 +2322,7 @@ mod tests {
             "tilesets:list",
             "statistics:read",
             "styles:download",
+            "user-feedback:write",
         ] {
             assert!(requested.contains(&needed), "{needed} is not requested");
         }
 
@@ -1729,15 +1729,12 @@ mod tests {
             .filter(|op| op.disabled_scope.is_some())
             .map(|op| op.command())
             .collect();
-        // Every current UNSUPPORTED_OPERATIONS entry sourced from
-        // `MAPBOX_SPEC_ENTRIES` is also `disabled` (or `tbd`, which strips
-        // the same way) in the maintainer-only decision record, so those
-        // are absent from the bundled specs rather than merely filtered
-        // here. A custom spec has no such record to strip it at the
-        // source — `feedback.yaml`'s `createFeedback` is UNSUPPORTED_OPERATIONS'
-        // first entry that actually reaches this list non-empty — so the
-        // loop below is doing real work for it, not just standing guard
-        // over an empty case.
+        // Every current UNSUPPORTED_OPERATIONS entry is also `disabled` (or
+        // `tbd`, which strips the same way) in the maintainer-only decision
+        // record, so this is legitimately empty now rather than a broken guard — the
+        // operations are absent from the bundled specs, not merely filtered
+        // here. Nothing left to assert on `disabled` itself; the loop below
+        // still holds for whatever, if anything, shows up.
 
         let app = build_app(&specs);
         for (path, _) in leaf_commands(&app, &[]) {
 
@@ -226,11 +226,14 @@ fn for_forbidden(remedy: Remedy, body: &str) -> Remedy {
         .with_doc(Some(TOKENS_DOC))
 }
 
-/// The scope a 403 names: "This API requires a token with styles:download
-/// scope." Checked against the shape of a scope, since it is echoed into
-/// advice the user may paste.
+/// The scope a 403 names. The shared auth middleware says "This API
+/// requires a token with styles:download scope."; the Feedback API says
+/// "Access token does not have user-feedback:write scope". Checked against
+/// the shape of a scope, since it is echoed into advice the user may paste.
 pub fn missing_scope(body: &str) -> Option<&str> {
-    let (_, rest) = body.split_once("requires a token with ")?;
+    let (_, rest) = body
+        .split_once("requires a token with ")
+        .or_else(|| body.split_once("does not have "))?;
     let (scope, _) = rest.split_once(" scope")?;
     let well_formed = scope.contains(':')
         && scope
@@ -653,6 +656,10 @@ paths:
         assert_eq!(missing_scope("requires a token with `rm -rf` scope"), None);
         assert_eq!(missing_scope("requires a token with admin scope"), None);
         assert_eq!(missing_scope("Forbidden"), None);
+        assert_eq!(
+            missing_scope("Access token does not have user-feedback:write scope"),
+            Some("user-feedback:write")
+        );
     }
 
     /// A status nobody has written advice for still gets the page. Inventing
 
@@ -497,13 +497,6 @@ const UNSUPPORTED_OPERATIONS: &[(&str, &str, &str)] = &[
     ("accounts", "createToken", "tokens:write"),
     ("accounts", "updateToken", "tokens:write"),
     ("accounts", "deleteToken", "tokens:write"),
-    // Confirmed 2026-09-24 with a direct POST /oauth/register against
-    // production requesting `user-feedback:write` alongside two scopes
-    // already known registrable — the response's granted `scope` carried
-    // the other two and silently dropped this one, the same shape
-    // `tokens:write` above already documents. `user-feedback:read`
-    // (list/get) is unaffected and already in `DEFAULT_SCOPES_LIST`.
-    ("feedback", "createFeedbackItem", "user-feedback:write"),
 ];
 
 fn unsupported_scope_for(service_name: &str, operation_id: &str) -> Option<&'static str> {
@@ -1960,37 +1953,24 @@ paths:
         assert!(hidden.is_empty());
     }
 
-    /// `createFeedbackItem` needs `user-feedback:write`, confirmed
-    /// unregistrable via a direct `POST /oauth/register` against
-    /// production — see `UNSUPPORTED_OPERATIONS`'s own comment for that.
-    /// `list` and `get` need only `user-feedback:read`, already in
-    /// `DEFAULT_SCOPES_LIST`, so they must stay reachable.
+    /// All three are commands: `list` and `get` need `user-feedback:read`
+    /// and `create` needs `user-feedback:write`, both of which a login asks
+    /// for.
     #[test]
-    fn feedback_create_is_unreachable_but_list_and_get_are_not() {
+    fn every_feedback_operation_is_exposed() {
         let spec = parse_spec(
             "feedback",
             include_str!("../custom-openapi/feedback/openapi/feedback.yaml"),
         )
         .expect("feedback.yaml parses");
 
-        let create = spec
-            .operations
-            .iter()
-            .find(|op| op.command_path == ["create-feedback-item"])
-            .expect("the create-feedback-item operation exists in the spec");
-        assert!(
-            create.disabled_scope.is_some(),
-            "createFeedbackItem must be disabled — user-feedback:write isn't registrable"
-        );
-        assert!(!create.is_exposed());
-
-        for path in [["list"], ["get"]] {
+        for path in [["list"], ["get"], ["create"]] {
             let op = spec
                 .operations
                 .iter()
                 .find(|op| op.command_path == path)
                 .unwrap_or_else(|| panic!("the {path:?} operation exists in the spec"));
-            assert!(op.is_exposed(), "{path:?} needs only user-feedback:read");
+            assert!(op.is_exposed(), "{path:?} must be a command");
         }
     }
 }
@@ -1,6 +1,7 @@
 mapbox accounts list-scopes | aliases: (none)
 mapbox accounts list-tokens | aliases: (none)
 mapbox accounts retrieve-token | aliases: (none)
+mapbox feedback create | aliases: (none)
 mapbox feedback get | aliases: (none)
 mapbox feedback list | aliases: (none)
 mapbox fonts delete | aliases: (none)