diff --git a/src/app/api/create/route.ts b/src/app/api/create/route.ts
new file mode 100644
index 0000000..5087e55
--- /dev/null
+++ b/src/app/api/create/route.ts
@@ -0,0 +1,46 @@
+import { NextResponse } from "next/server";
+import { requireCreator } from "@/lib/session";
+import { isCreateEnabled, buildPrompt } from "@/lib/comfyui";
+import { moderateSubject } from "@/lib/moderation";
+import { createCreatedLesson, processCreation, listCreatedForUser } from "@/lib/createdLessons";
+
+const LEVELS = new Set(["early-beginner", "beginner"]);
+const DAILY_LIMIT = 20;
+
+export async function POST(req: Request) {
+  const user = await requireCreator();
+  if (!user) return NextResponse.json({ error: "Not authorized." }, { status: 403 });
+  if (!isCreateEnabled()) return NextResponse.json({ error: "Create is not available right now." }, { status: 503 });
+
+  let body: { level?: string; subject?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid request." }, { status: 400 });
+  }
+
+  const level = body.level || "";
+  if (!LEVELS.has(level)) return NextResponse.json({ error: "Pick a level." }, { status: 400 });
+
+  // Simple per-user daily cap (bounds abuse + GPU cost).
+  const todays = listCreatedForUser(user.id, level).filter((r) => r.created_at.slice(0, 10) === new Date().toISOString().slice(0, 10));
+  if (todays.length >= DAILY_LIMIT) return NextResponse.json({ error: "You've created a lot today — try again tomorrow!" }, { status: 429 });
+
+  const mod = moderateSubject(body.subject || "");
+  if (mod.decision === "blocked") {
+    return NextResponse.json({ error: "Let's pick a different, friendly thing to draw!" }, { status: 422 });
+  }
+
+  const prompt = buildPrompt(mod.subject);
+  const status = mod.decision === "allowlist" ? "pending" : "needs_review";
+  const row = createCreatedLesson({ userId: user.id, level, subject: mod.subject, prompt, moderation: mod.decision, status });
+
+  // Allowlisted → generate now (async). Review → wait for an admin to approve.
+  if (mod.decision === "allowlist") void processCreation(row.id);
+
+  return NextResponse.json({
+    id: row.id,
+    slug: row.slug,
+    status: mod.decision === "allowlist" ? "generating" : "needs_review",
+  });
+}