Build on a clear contract.

Know what is supported.

LeadBin exposes a bounded workspace API. An internal /api/ route is not automatically an integration contract. The matrix separates documented v1 behavior from app-only and hub-specific workflows.

Read and write tokens remain bound to one workspace and an active member. This page lists the supported public contract; it does not imply that every app feature can be automated through v1.

Workspace allowance and API scope

Free includes one workspace owned by an account. One Starter subscription covers up to three owned workspaces, Growth up to five, and Scale has no workspace cap. Seat and contact limits apply to each workspace. Membership in another owner's workspace does not use the account allowance.

Quickstart

Use https://theleadbin.com as the production base URL. In the intended workspace, an owner or admin opens Settings → Integrations → API tokens, names a token and copies its one-time secret. Begin with read scope.

curl -H 'Authorization: Bearer YOUR_TOKEN' 'https://theleadbin.com/api/v1/companies?limit=10'

A list response contains resource, workspace (id and name), data and count. The token decides the workspace; the caller cannot select a different one.

Authentication & scope

Send Authorization: Bearer YOUR_TOKEN over HTTPS. Keep separate tokens for separate integrations and environments. Token management itself uses a signed-in owner/admin app session, not Bearer authentication.

Endpoint reference

The four resource values are companies, people, tasks and notes. There is no public v1 DELETE route, bulk write endpoint or arbitrary resource expansion.

Read and write records

List

GET /api/v1/people?limit=100 returns non-deleted records in newest-created order. Default limit: 100. The server clamps it to 1–2,000. There is no cursor pagination on this route, so do not treat it as a complete bulk export for a larger workspace.

Create

Send JSON with a write token. A successful create returns HTTP 201 with an id and resource. Save the ID for later updates.

curl -X POST -H 'Authorization: Bearer YOUR_WRITE_TOKEN' -H 'Content-Type: application/json' -d '{"firstName":"Avery","lastName":"Stone","email":"avery@example.com"}' https://theleadbin.com/api/v1/people

Update

PATCH /api/v1/people accepts the record id in the JSON body or ?id=, plus supported fields to change. A successful response includes updated: true. This route does not document a field-clearing operation: null-like values do not clear existing values.

curl -X PATCH -H 'Authorization: Bearer YOUR_WRITE_TOKEN' -H 'Content-Type: application/json' -d '{"id":"TASK_ID","status":"completed"}' https://theleadbin.com/api/v1/tasks

Task status accepts open, in_progress or completed. Linked company/person IDs must belong to the token’s workspace; owner IDs must identify an active member. A concurrent task status change can return 409. Task completion can run enabled internal workflows.

Poll the event feed

Starter+ workspaces can use GET /api/v1/events with a read token. Omit cursor to start at zero. The default limit is 50, maximum 100. The response contains events, nextCursor, hasMore, workspaceId and eventKinds. Persist the returned cursor only after processing its page.

GET /api/v1/events?cursor=0&limit=50
Authorization: Bearer YOUR_TOKEN

Event fields: id, sequence, kind, personId, companyId, opportunityId, recordId, occurredAt

Eligible kinds: lead_form.submitted, lead.qualification, opportunity.stage, task.status, ticket.created. Imported mail, calendar, notes and free-form activity are excluded. Treat cursors as workspace-specific and deduplicate processed event IDs.

Analytics & sales metrics

GET /api/v1/analytics?from=2026-10-01&to=2026-10-20
GET /api/v1/sales-metrics?start=2026-10-01T00%3A00%3A00Z&end=2026-10-20T23%3A59%3A59Z

Analytics from/to must be supplied together as inclusive UTC YYYY-MM-DD dates, maximum 366 days; omission means trailing 30 UTC days. Sales-metric boundaries are parseable timestamps with start ≤ end. Both routes are read-only. Deal value and weighted forecast are not payments, recognized revenue or predictive Revenue Risk; currencies are not converted.

Outbound webhook receivers

For an approved receiver pilot, accept a public HTTPS POST. Verification sends { "type": "leadbin.verification", "challenge": "…" }; answer HTTP 200 JSON { "challenge": "the same value" }. Normal deliveries include X-LeadBin-Event-Id, X-LeadBin-Timestamp (Unix seconds) and X-LeadBin-Signature.

Verify v1= plus lowercase HMAC-SHA256 over timestamp + "." + raw_request_body, keyed by the one-time 32-byte hex signing key as bytes. Compare in constant time, reject stale timestamps and deduplicate event IDs. Delivery is at least once; send a final 2xx after durable processing. Redirects are not followed, and transient failures may retry.

Provider connections

Google Gmail/Calendar and Microsoft 365 mail/calendar connections are per-user, read-only approved pilots. They begin in Settings → Integrations with the provider’s consent flow; an API token does not grant mailbox access. Do not build against undocumented LeadBin OAuth callbacks or assume these pilots are included in a normal plan.

Campaign delivery is a selected-workspace pilot. An authorized manager connects a workspace-owned Brevo account or dedicated campaign SMTP mailbox, verifies the exact sender and authenticated feedback, and reviews consent and suppression before a launch. This is a signed-in app workflow, not a public mail endpoint; Personal email remains separate. Customer-owned revenue integrations remain test-only, predictive Revenue Risk is unpublished, and the customer portal is an internal pilot. For an integration request, contact LeadBin with the use case and desired data flow—never email credentials.

Errors & safe handling

Responses are JSON and errors include an error message. Avoid logging token values or full customer payloads. Use conservative polling and design write retries to avoid duplicate creates after timeouts—the v1 create route does not advertise an idempotency key.

Teamwork is app-only

Written Teamwork is available inside signed-in LeadBin workspaces: shared updates, private direct and group messages, record conversations, replies, mentions, and message-linked tasks. Access is checked against active workspace membership; a CRM API token does not authorize a Teamwork conversation.

Members can share existing Google Meet, Microsoft Teams, or Zoom links. Active workspace members can start private LeadBin video calls with in-call chat; the chat is not archived in Teamwork. Meeting creation, join tokens, and call state require a signed-in app session and are not supported public API resources. See the video call guide.

Calendar is app-only

Every workspace can use the signed-in Calendar for month, week, and day views of dated tasks and LeadBin meetings. A meeting may be private to its owner or visible to workspace members. An optional supported HTTPS external meeting link is a reference, not an invitation or a provider-created call. Active workspace members can instead choose native LeadBin video for a workspace-visible meeting.

Connected provider events are per-user, read-only approved pilots. They are not written into LeadBin by Calendar, do not grant an API token provider access, and do not enable creating, changing, or inviting to Google or Microsoft events.

Import Center and prospect lists are app-only

The signed-in People workbench supports reviewed CSV and Excel imports, inline and selected-record edits, and workspace-shared static or filter-based prospect lists. These operations have their own interactive review and permission checks.

QuoteBin is a signed-in extension

An owner or admin can enable QuoteBin in Settings → Extensions for an individual workspace. Its catalog, versioned quotes, separate buyer-approved contracts, direct invoices, and payment status use that workspace’s own Stripe Connect merchant. A direct invoice can link a saved contact or use a one-time buyer email. Issuing and email delivery require explicit review in the app.

LeadBin subscription billing is separate from each workspace merchant. Provider payment status must be checked before treating an invoice as paid; an open invoice or successful email request is not a payment.

Personal SMTP is not a mail API

Active non-viewer members can connect an individual SMTP identity in Settings → Integrations → Personal email for reviewed, one-to-one sends within that workspace. The general connection does not read Inbox or Sent mail. Google and Microsoft activity sync are separate, read-only pilots. Campaign sending uses a separate selected-workspace gate and dedicated provider connection.

TimeBin is a signed-in extension

Owners and admins enable TimeBin per workspace in Settings → Extensions. Members can track time from supported CRM records, and authorized reporters can review hours, projects, and labor contribution. Paid QuoteBin invoices count as verified revenue only when linked; TimeBin does not expose a general-purpose billing or time-entry API.