SupportDeveloper Platform
Build tenant-scoped REST API and MCP integrations with private credentials, verified scopes, typed operations, code examples, risk controls, and secure lifecycle guidance.
19 articlesLead360 workflow mapDeveloper Platform
- 01
Create, store, rotate, audit, and revoke private integration tokens.
- 02
Authenticate REST and MCP requests without client-selected tenant authority.
- 03
Discover scopes and operations available to the exact credential.
- 04
Handle risk, confirmation, rate limits, errors, and lifecycle changes safely.
About this collection
Build tenant-bound Lead360 API and MCP integrations
The Lead360 Developer Platform exposes a curated production contract for private integrations through REST API and MCP. A one-time Bearer token is bound on the server to one exact sub-account, limited to selected scopes, and filtered again by current service entitlements and operation policy.
Start in Developer Settings, create a narrowly scoped credential, verify tenant binding, discover the operations available to that token, and validate typed inputs before execution. Reviewed reads can run directly where documented. Mutations fail closed into approval-aware behavior instead of inheriting broad agency authority.
What you can accomplish
- Create, store, rotate, audit, and revoke private integration tokens.
- Authenticate REST and MCP requests without client-selected tenant authority.
- Discover scopes and operations available to the exact credential.
- Handle risk, confirmation, rate limits, errors, and lifecycle changes safely.
Articles
Lead360 Developer Platform overviewBuild tenant-scoped private integrations with the Lead360 REST API and MCP gateway using one-time credentials, least-privilege scopes, typed operation discovery, risk controls, and auditable access.Developer Settings and permissionsUse the Developers area in the correct Lead360 sub-account to create narrowly scoped credentials, apply agency-owner restrictions, and review active, rotated, or revoked integrations.Create a private integration tokenCreate a one-time Lead360 credential for one sub-account, choose the smallest production scopes, set expiration and rate controls, and store the secret before leaving the confirmation screen.Authentication and tenant bindingAuthenticate version 2 REST and MCP requests with a Bearer private integration token whose server-side location binding determines the only Lead360 sub-account the client can access.REST API quickstartConnect to the Lead360 version 2 REST API, verify a private integration token, discover authorized operation contracts, and execute a controlled read without sending tenant authority in request arguments.Lead360 MCP quickstartConnect a compatible MCP client to the tenant-bound Lead360 HTTP JSON-RPC endpoint, initialize protocol version 2025-03-26, list tools, search authorized operations, and execute reviewed reads.Configure a compatible MCP clientAdd the Lead360 MCP URL and one-time Bearer token to a compatible client, keep the credential in the client secret store, verify tool discovery, and prevent broad or unattended effects.MCP tools referenceUse the five Lead360 MCP tools to search and fetch tenant-authorized operation contracts and directly execute only reviewed read operations through typed JSON-RPC requests.Discover production operationsSearch 143 reviewed Lead360 operation contracts by name, scope group, risk, and effect, then fetch the exact input schema and execution mode allowed for the current private integration.Execute a reviewed operationExecute a supported direct-read operation with validated arguments, understand approval-required failures for mutations, and keep tenant, credential, transport, and server authority out of the request body.Production scopes referenceReview all 140 production-eligible Lead360 private integration scopes, their product groups, risk tiers, effect categories, confirmation requirements, and agency-owner restrictions.Risk tiers and confirmation controlsInterpret green, yellow, and red operation classifications, distinguish reads from consequential effects, and preserve the Lead360 draft, confirmation, approval, and exact-target controls.Rate limits and response headersRead per-token rate-limit headers, pace requests, use bounded retries for 429 responses, and select an appropriate requests-per-minute setting when a private integration is created.API and MCP errors and troubleshootingDiagnose Lead360 private integration authentication, rate, scope, operation, argument, approval, and execution errors without exposing tokens or probing other tenants.Response contracts and data handlingValidate Lead360 REST and MCP response envelopes, distinguish protocol errors from tool errors, minimize returned customer data, and keep authenticated responses out of shared caches and unsafe logs.Rotate and revoke private integration credentialsReplace a Lead360 private integration token without changing its intended access, verify the new credential, retire the old value, and revoke access immediately when an integration is removed or exposed.Versioning and deprecationsTrack the Lead360 version 2 private integration surface, MCP protocol negotiation, operation registry changes, schema changes, and deprecation notices without depending on undocumented internal routes.REST API and MCP code examplesUse secure cURL, Node.js, and Python patterns for Lead360 status checks, REST operation discovery, reviewed read execution, MCP initialization, tool listing, and tool calls.Developer support and security responsibilitiesPrepare a secure Lead360 integration, separate Lead360 platform controls from customer implementation duties, and provide useful redacted diagnostics when technical support is required.