Version: 1.0.0

ProspectConnect Public API

Whitelabel-neutral public REST API for the platform.

Conventions (apply to every endpoint):

Auth: OAuth 2.0 Bearer (Authorization: Bearer <token>). Workspace-scoped Personal Access Tokens (PAT) in v1; full auth-code + PKCE for marketplace apps. The token carries the workspace (business_id) and the user's role/permissions — the gateway enforces scope ∩ role.
Versioning: major version in the path (/v1) and echoed in a required Version header (e.g. v1). The API reference lists the published versions and preselects the latest.
Pagination: cursor-based; one uniform envelope { data, meta: { cursor: { next, has_more }, total? } }. Search is POST /{resource}/search with { filters, search_text, order_by, sort_direction, limit, cursor }.
Errors: RFC 9457 application/problem+json with trace_id.
Dates: ISO-8601 / RFC 3339 UTC (2026-06-17T14:30:00Z); date-only fields YYYY-MM-DD.
Casing: snake_case JSON (matches internal storage; reduces mapping).
Methods: POST create, GET read, PATCH partial update, DELETE; Idempotency-Key honored on creates.
Rate limits: per-token; X-RateLimit-* response headers.

Authentication

Workspace-scoped Personal Access Token (client-credentials) for server-to-server use.