Skip to content
API reference

Two endpoints, one token

Leadmend answers written enquiries. This is how an enquiry reaches it from somewhere other than a website we built — a WordPress form, a Zap, a custom front end, anything that can make an HTTP request.

The machine-readable version is at /openapi.yaml.

Your token, and what it is not

Every request carries one credential: your business's ingest token, in the URL path. You will find it in your dashboard — it is the last segment of your form link.

It is not a password, and you should not treat it as one.

It appears in your embed snippet, in the page source of your own website, and in your form URL. It grants exactly one capability: submit an enquiry to your business. It cannot read your enquiries, cannot change your settings, and cannot be used to sign in anywhere. If one leaks, the consequence is spurious enquiries — bounded by the hourly cap below — and you rotate it from the dashboard.

There is no endpoint that reads enquiries back

This is a design decision, not a missing feature. Reading requires a credential, and the only credential a business has today is the token above — which is public. Accepting it as a read key would turn every published customer website into a way to download that business's customer list. If you need enquiries flowing outward, use the outbound webhook in your integrations settings, which posts every new enquiry to a URL you control.

POST/api/ingest/{token}

Submit an enquiry

Records the enquiry, drafts a reply in your business's voice, sends it to the enquirer when an email address is present, and alerts you. Accepts application/json or application/x-www-form-urlencoded, so a plain HTML form can post here with no JavaScript at all.

Body

Every field is optional on its own, but at least one of phone or message is required. Longer values are truncated, not rejected.

messagestring · max 1000

What the enquirer wrote. The reply is drafted from this, so send the real message rather than a subject line.

namestring · max 80

Used to address the reply.

emailstring · max 200

Where the reply is sent. Without it the enquiry is still recorded and you are still alerted, but the enquirer cannot be answered.

phonestring · max 40

Stored and shown with the enquiry. Leadmend does not call or send SMS — it answers written enquiries.

Request

curl -X POST https://leadmend.com/api/ingest/YOUR_TOKEN \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Sarah Doucette",
    "email": "sarah@example.com",
    "phone": "902-555-0142",
    "message": "Hi, could I get a quote for a full bathroom renovation?"
  }'

Response

reply is the text that was sent to the enquirer, so you can display or log it.

{
  "ok": true,
  "reply": "Hi Sarah — thanks for getting in touch. I'm not at a desk right now, but I'd be glad to help with the bathroom renovation. Could you tell me roughly the size of the room?",
  "urgent": false
}

Three behaviours worth knowing

It is slow on purpose, and you should not wait for it

A successful call drafts a reply before returning, so expect single-digit seconds. If a person is waiting on a form submission, dispatch the request without blocking on it — the enquiry is recorded and answered either way.

A double-clicked submit does not send two replies

The same phone and message inside a ten-minute window returns 200 with duplicate: true and a warm acknowledgement. Nothing is drafted and nobody is contacted a second time.

An AI outage does not cost you the enquiry

If drafting fails, the enquiry is still saved, you are alerted loudly that a human needs to answer it, and the enquirer gets an honest holding reply. The response is still 200.

Errors

400 need_phone_or_message

Neither field was supplied. There is no way to reach the person and nothing to write a reply from.

400 bad_request

The body could not be parsed.

404 not_found

The token did not resolve to an active business. Deliberately generic — this endpoint never confirms whether a token exists.

429 rate_limited

Two limits produce this: a per-IP limiter on the endpoint, and a durable cap of 60 enquiries an hour per business — every accepted enquiry costs an AI call. Some responses include retryAfter in seconds.

Calling it from a browser

This endpoint is called by customers' own websites on their own domains, so it is cross-origin callable and answers OPTIONS preflight with 204. A wildcard origin is correct here specifically because the token in the path is the only credential and cookies are never accepted, so there is no CSRF surface to widen.

GET/api/ingest/{token}/verify

Check a token without creating anything

Answers “is this token good?” without writing an enquiry. Integrations re-check credentials in the background; without this the only way to test a token would be to post an enquiry, which would bill an AI reply and email you about a customer who does not exist — every time.

curl https://leadmend.com/api/ingest/YOUR_TOKEN/verify

{
  "ok": true,
  "business": "Northgate Plumbing"
}

The business name is returned so an integration can label the connection — it is already printed on the website the token came from. Nothing about an enquiry is reachable here. A bad token returns 404 not_found.

Before you write a client

Two of these already exist, and both are open source. If one fits, you do not need this page at all.

  • WordPress. A plugin that hooks Contact Form 7, WPForms and Gravity Forms and forwards submissions server-side — you keep the form you already have.
  • Zapier. A Send Enquiry action, so anything Zapier speaks to can post here without code.
  • Anything else. Your dashboard has a copy-paste HTML snippet that works on Wix, Squarespace, or a plain static page.

Building something we have not thought of? Tell us what you are posting from — hello@leadmend.com. The API is small on purpose, and the endpoints that get added are the ones somebody asked for.

How the data is handled · Privacy · Terms