REST API and MCP code examples

Secret handling

The examples read the credential from LEAD360_TOKEN. Configure that value through a trusted secret manager or approved local environment mechanism. Do not replace the environment lookup with a committed string, browser variable, query parameter, log statement, or prompt.

LEAD360_TOKEN=<one-time private integration credential>

REST connection check

cURL

curl -sS 'https://app.lead360.io/v2/subaccount-api/status' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer $LEAD360_TOKEN'

Node.js

const response = await fetch('https://app.lead360.io/v2/subaccount-api/status', {
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${process.env.LEAD360_TOKEN}`,
  },
})

if (!response.ok) throw new Error(`Lead360 returned ${response.status}`)
console.log(await response.json())

Python

import os
import requests

response = requests.get(
    'https://app.lead360.io/v2/subaccount-api/status',
    headers={
        'Accept': 'application/json',
        'Authorization': f"Bearer {os.environ['LEAD360_TOKEN']}",
    },
    timeout=30,
)
response.raise_for_status()
print(response.json())

REST operation search and execution

Search before executing, then fetch the selected operation contract. The example execution uses contacts.profile.read only after the credential has contacts.readonly and the contract reports direct_read.

Search with cURL

curl -sS 'https://app.lead360.io/v2/subaccount-api/operations?query=contacts&risk_tier=green&limit=20' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer $LEAD360_TOKEN'

Execute with Python

import os
import requests

response = requests.post(
    'https://app.lead360.io/v2/subaccount-api/operations/contacts.profile.read/execute',
    headers={'Authorization': f"Bearer {os.environ['LEAD360_TOKEN']}"},
    json={'arguments': {'contact_id': 12345}},
    timeout=30,
)
response.raise_for_status()
print(response.json())

MCP initialization

cURL

curl -sS 'https://app.lead360.io/mcp/lead360/v2' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer $LEAD360_TOKEN' \
  --data '{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-03-26",
    "capabilities": {},
    "clientInfo": {
      "name": "lead360-client",
      "version": "1.0.0"
    }
  }
}'

Node.js

const response = await fetch('https://app.lead360.io/mcp/lead360/v2', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    'Content-Type': 'application/json',
    Authorization: `Bearer ${process.env.LEAD360_TOKEN}`,
  },
  body: JSON.stringify({
    jsonrpc: '2.0',
    id: 1,
    method: 'initialize',
    params: {
      protocolVersion: '2025-03-26',
      capabilities: {},
      clientInfo: { name: 'lead360-client', version: '1.0.0' },
    },
  }),
})

console.log(await response.json())

Python

import os
import requests

response = requests.post(
    'https://app.lead360.io/mcp/lead360/v2',
    headers={
        'Accept': 'application/json',
        'Content-Type': 'application/json',
        'Authorization': f"Bearer {os.environ['LEAD360_TOKEN']}",
    },
    json={
        'jsonrpc': '2.0',
        'id': 1,
        'method': 'initialize',
        'params': {
            'protocolVersion': '2025-03-26',
            'capabilities': {},
            'clientInfo': {'name': 'lead360-client', 'version': '1.0.0'},
        },
    },
    timeout=30,
)
response.raise_for_status()
print(response.json())

Production checklist

• Use the official app.lead360.io origin and HTTPS.
• Keep the token server-side and redact Authorization headers.
• Set connection and response timeouts.
• Verify the tenant and scopes with status.
• Fetch typed contracts rather than guessing arguments.
• Honor rate headers and use bounded retries.
• Stop on approval_required and use the Lead360 review workflow.
• Minimize, protect, retain, and delete returned data according to the approved purpose.