Meta

Two endpoints that need no scope and answer what this key is and what the API accepts.

GET /v1/me

no scope requiredread bucket

Who this key is, what it may do, which workspaces it currently reaches

bash

curl -sS https://api.leadarc.io/v1/me \
  -H "Authorization: Bearer $LEADARC_API_KEY"

No scope required. Every integration should call this first. It is the discovery endpoint, and it is the only place the API tells a caller what the API will let it do.

Response:

json

{
  "object": "api_key",
  "id": "key_S9tS9paEDRZu_GZza8ocAsSM5au-B8DbWbtzY3",
  "name": "Claude inbox agent",
  "description": "Triages AirPay and Cliniconex replies each morning",
  "display_prefix": "lak_live_k7m2p9qh_9fK2…",
  "environment": "live",
  "scopes": [
    "workspaces:read", "members:read", "leads:read", "leads:write",
    "threads:read", "notes:read", "notes:write", "tasks:read", "tasks:write",
    "templates:read", "campaigns:read"
  ],
  "granted_scopes": [
    "workspaces:read", "members:read", "leads:read", "leads:write",
    "threads:read", "notes:read", "notes:write", "tasks:read", "tasks:write",
    "templates:read", "campaigns:read"
  ],
  "all_workspaces": false,
  "workspaces": ["airpay", "cliniconex"],
  "owner": {
    "object": "member",
    "id": "usr_zaDRRpdu8EPZSU3i89lvZgKPkVQo4uBFA_KOhm",
    "name": "Leon Matschke",
    "email": "leon@leadarc.io",
    "role": "admin",
    "timezone": "Europe/Berlin",
    "active": true
  },
  "created_at": "2026-07-27T09:00:00Z",
  "expires_at": "2027-07-27T09:00:00Z",
  "last_used_at": "2026-07-27T10:14:03Z",
  "rate_limits": {
    "read_per_minute": 120,
    "write_per_minute": 60,
    "thread_per_minute": 30,
    "upstream_per_minute": 10,
    "max_concurrent": 4
  },
  "api_version": "v1",
  "read_only_mode": false
}

scopes is what the key was granted. granted_scopes is what it can actually use right now, after intersecting with what the owner's role permits. If those two lists differ, the key was over-provisioned or the owner's role changed, and the difference is the honest answer. A caller should branch on granted_scopes.

workspaces is the live resolved set, recomputed on this request. On an all_workspaces key it will grow as clients are onboarded, which is why it is enumerated here rather than described.

GET /v1/capabilities

no scope requiredread bucket

Every enum value, limit, and filter this version accepts

bash

curl -sS https://api.leadarc.io/v1/capabilities \
  -H "Authorization: Bearer $LEADARC_API_KEY"

No scope. responses_index.last_action, .category, and .meeting_outcome are all text with a TypeScript-only { enum: [...] } constraint. The only real Postgres enum types in the database are the ten orphaned finance_* types. A caller cannot learn the real vocabulary from anywhere except here.

Response (abridged):

json

{
  "object": "capabilities",
  "api_version": "v1",
  "enums": {
    "lead_status": ["interested", "not_interested", "automated", "unsubscribed", "untagged"],
    "lead_state": ["active", "booked", "disqualified"],
    "lead_classification": ["INTERESTED", "NOT_INTERESTED", "BAD_TIMING", "WRONG_PERSON", "AUTOMATED", "DNC"],
    "meeting_outcome": ["showed", "no_show", "no_show_host", "cancelled", "rescheduled"],
    "meeting_source": ["mark_booked", "calendar"],
    "meeting_confirmation_status": ["confirmed", "pending", "declined"],
    "meeting_location_type": ["google_meet", "phone", "zoom"],
    "meeting_channel": ["Cold Email", "LinkedIn", "Cold Call", "Ads", "Referral", "Other"],
    "message_direction": ["inbound", "outbound"],
    "message_kind": ["reply", "campaign_send"],
    "task_type": ["email", "call", "linkedin", "custom"],
    "task_status": ["open", "completed"],
    "asset_kind": ["loom", "doc", "link", "text"],
    "asset_visibility": ["private", "workspace"],
    "template_visibility": ["private", "workspace", "global"],
    "sequence_visibility": ["private", "workspace", "global"],
    "sequence_step_type": ["email", "call", "linkedin", "custom"],
    "sequence_delay_unit": ["days", "hours"],
    "enrollment_status": ["active", "paused", "completed", "cancelled"],
    "event_type_scheduling_type": ["single", "collective", "round_robin"],
    "event_type_form_field_type": ["text", "textarea", "select", "multiselect", "checkbox"],
    "member_role": ["admin", "user"],
    "assignment_source": ["auto", "manual"],
    "assignment_method": ["off", "one", "all", "round_robin"]
  },
  "notes": {
    "lead_classification": "The AI categorizer's verdict, passed through. BAD_TIMING and WRONG_PERSON are normalized to null on the tag path but can appear here verbatim. Tolerate values not in this list.",
    "lead_status": "'dnc' is accepted as an input alias for 'unsubscribed' and is never returned. The app's own label for this state is 'Unsubscribed'.",
    "asset_visibility": "There is no 'global' for assets, unlike templates and sequences. Sending it is 422."
  },
  "limits": {
    "page_limit_max": 100,
    "page_limit_default": 50,
    "expand_max": 3,
    "insights_window_days_max": 366,
    "insights_daily_window_days_max": 120,
    "slots_window_days_max": 60,
    "messages_max_returned": 200
  },
  "filters": {
    "leads": ["status", "campaign_id", "assignee_id", "email", "has_open_task",
              "task_due_before", "meeting_outcome", "direction",
              "updated_since", "updated_before"],
    "tasks": ["lead_id", "assignee_id", "status", "due_before", "due_after", "task_type"],
    "meetings": ["outcome", "source", "host_id", "event_type_id", "booked_since", "booked_before", "starts_after", "starts_before"],
    "notes": ["lead_id", "author_id", "created_since"]
  },
  "phases": {
    "available": ["v1"],
    "coming": {
      "v2": ["replies:send", "bookings:write", "events:read", "webhooks:read", "webhooks:write"],
      "v3": ["leads:suppress", "sequences:write", "assignments:write", "enrichment:read"]
    }
  },
  "deprecated": []
}

The notes block is part of the contract. Half of the mistakes an integration makes are documentation problems, and serving the caveat next to the enum is cheaper than hoping someone read a docs page.