API reference
POSTReceive a lead (inbound source, secret in the URL)
POST /v1/inbound/{source_id}/{token}: For senders that cannot set headers.
POST
https://api.light-ai.app/v1/inbound/{source_id}/{token}For senders that cannot set headers. The URL itself is the credential: keep it private and rotate it if it leaks.
| Credential | The source's secret URL token (lai_whu_…) in the path. |
|---|---|
| Test mode | Works with test keys (test objects only). |
| Idempotency | Idempotency-Key supported. See Idempotency. |
Path parameters#
The inbound source id (
src_…). Id prefix src_.The source's URL token (
lai_whu_…).Headers#
Retry-safe writes: the same key and body replay the first response for 24 hours (
Idempotent-Replayed: true). 8–128 characters.Request body#
Where the request came from. One of:
api, google_ads_lead_form, google_lsa, meta_lead_ad, highlevel, hubspot, jobber, service_autopilot, realgreen, sweepandgo, deeplawn, zapier, n8n, make, crm_import, other.At most 200 characters.
Your id for this request. Retrying with the same ref returns the original lead.
Lowercase system name, e.g.
jobber, hubspot, highlevel.Optional sub-namespace in that system (e.g. an account id). null or "": none. At most 120 characters.
1–255 characters.
A name, and an email or a phone. null or "" in an optional field is the same as leaving it out.
At most 100 characters.
At most 100 characters.
Normalized when valid. An address that is not a valid email is kept as contact.email_raw when the phone works. At most 254 characters.
Any common format; normalized to E.164. A number that cannot be normalized is kept as phone_raw when the email works. At most 40 characters.
Optional. A lead without a street address is stored (a partial address as a hint) and becomes a project when one is added.
At most 200 characters.
At most 200 characters.
At most 120 characters.
State or region, e.g.
TX. At most 120 characters.At most 20 characters.
ISO 3166-1 alpha-2 in any case, or a common name ("USA", "United States"); normalized to alpha-2. Defaults to US. At most 60 characters.
A one-line address, when components are not available. At most 500 characters.
-90–90.
-180–180.
Google place id, when known (best dedupe key). At most 300 characters.
One of christmas_lights, permanent_lighting, landscape_lighting, custom; other text is kept and filed as custom. At most 200 characters.
At most 5000 characters.
utm_*, gclid, campaign ids and similar.
The exact consent wording the person agreed to. At most 2000 characters.
RFC 3339 date-time with offset.
At most 100 characters.
RFC 3339 date-time with offset.
Live keys reject true (use a test key for test data).
Response 202#
Received (identical for new, repeat and replayed leads).
Always
receipt.Id prefix
rcpt_.Always
received.false for objects created with a test key.
Errors#
| Status | Meaning |
|---|---|
400 | Bad request. bad_request, test_mode_mismatch, test_mode_unsupported, unsupported_api_version |
401 | Missing or invalid credential. authentication_required, invalid_api_key, api_key_revoked, api_key_expired, api_key_suspended |
403 | Not allowed. insufficient_scope, plan_upgrade_required, organization_paused, organization_off_season, api_disabled, api_access_not_enabled, ip_not_allowed, forbidden |
404 | Not found (also for objects of other organizations and for organizations without an active grant). |
409 | Conflict. stale_state, conflict, idempotency_in_progress, idempotency_scope_mismatch, quote_already_decided, quote_not_current, billing_review_required |
413 | Request bodies are limited to 256 KB. |
415 | The body is not JSON: send Content-Type: application/json. unsupported_media_type |
422 | Validation failed. idempotency_key_reused |
429 | Rate limited or daily cap reached. See Retry-After and the RateLimit headers. rate_limited, daily_cap_reached |
500 | Unexpected server error. Safe to retry with exponential backoff; quote the Request-Id to support. internal_error |
503 | Temporarily unavailable. Retry with exponential backoff. service_unavailable |