Skip to main content
Three calls that only read: confirm your key and see its workspace, list this workspace’s tags, and read one lead back by id.
Where
SettingsAPI & Integrations
Your role needs
Update access to Lead intake API update-companies. Admin have it by default.
Authenticated by a workspace API key, not by a signed-in session. Creating a key needs the same permission as the rest of the API settings tab.

The three endpoints

Every timestamp these three return is UTC ISO-8601 with microseconds: 2026-08-21T09:14:02.000000Z.

Status codes

GET /me

No scope is required for this one. Any key, whatever it’s scoped for, can call it. That makes it the fastest way to confirm a credential works before you build anything else on it, and the right endpoint to wire into your own monitoring as a health check.

Response

That example leaves out rate_limit to keep it short. It’s the two integer fields in the table above. See Idempotency, deduplication and rate limits for what they’re currently set to.

GET /tags

Returns every tag in the workspace the key belongs to, ordered by name. There’s no pagination on this list: by design, since a workspace has tens of tags, not thousands, so there’s nothing here worth adding a cursor for. By default only tags with active: true come back. Pass include_archived=true to also get the ones that have been archived.

Query parameters

Response

GET /leads/

Needs its own leads:read scope, separate from leads:write, which only guards the two POST routes. {id} must be numeric; anything else doesn’t match this route at all. A lead outside the key’s workspace returns the exact same 404 as an id that doesn’t exist anywhere:
404 Not Found
This endpoint can never confirm whether an id you don’t have access to exists. The response is identical either way.

Response

The body is { data }, with no meta: there’s nothing to report about an action, since nothing changed. data is the same lead shape POST /leads returns in its own data field, and every relation on it is loaded on every call (emails, phones, links, location, tags, and the company’s own links and tags), so none of these fields is ever left out here for lacking an eager load.
This is deliberately not the shape the app’s own screens use internally: no admin-triage columns, CRM bookkeeping, possibility scores or phone-reveal state, and contacts come back as plain string arrays ("emails": ["jane@…"]) instead of objects. So an integration reads lead.emails[0] directly.
company, when present:

API overview

Authentication, scopes and what counts as a stable contract.

Lead fields reference

Every field POST /leads accepts, grouped and described one by one.

Status vocabularies

Every value stage, source and status can hold, and what each renders as.