Outbound Lead Partner API

{ "error": { "code": "validation_failed", "message": "The request is invalid. See `issues`.", "issues": [{ "path": "minScore", "message": "Too big: expected number to be <=5" }] } }

# 0) who am I?
curl -s https://outbound.mcloud.co.th/api/partner/v1/whoami -H "Authorization: Bearer $OL_KEY"

# 1) create (or find) the business of your customer — idempotent on externalRef
curl -s -X POST https://outbound.mcloud.co.th/api/partner/v1/businesses \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -H "Idempotency-Key: create-tenant-42" \
  -d '{"name":"ร้านตัวอย่าง","externalRef":"tenant-42"}'

# 2) configure what to look for
curl -s -X PUT https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/settings \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -d '{"keywords":["ขายฝาก","จำนอง"],"leadDefinition":"คนที่ต้องการเงินด่วนโดยมีที่ดินค้ำ","minScore":3,"dailyBudgetThb":200}'

# 3) the Facebook groups to read
curl -s -X POST https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/groups \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -d '{"url":"https://www.facebook.com/groups/123456789","name":"กลุ่มขายฝาก"}'

# 4) switch the feature on (businesses start OFF)
curl -s -X PUT https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/features \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -d '{"outboundLead":{"enabled":true}}'

# 5) read leads (keep nextCursor and poll with it), update their status
curl -s "https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/leads?limit=50&cursor=$CURSOR" -H "Authorization: Bearer $OL_KEY"
curl -s -X PATCH https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/leads/$LEAD_ID \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -d '{"status":"contacting","note":"โทรแล้ว","partnerRef":"crm-77"}'

# 6) bill your customer: import usage rows (de-duplicate on id)
curl -s "https://outbound.mcloud.co.th/api/partner/v1/usage/records?cursor=$USAGE_CURSOR" -H "Authorization: Bearer $OL_KEY"

# 7) out of credit? pause scanning (no AI is spent while paused)
curl -s -X PUT https://outbound.mcloud.co.th/api/partner/v1/businesses/$BID/scanning \
  -H "Authorization: Bearer $OL_KEY" -H "Content-Type: application/json" \
  -d '{"paused":true,"reason":"credit exhausted"}'

POST https://your.app/webhooks/outbound-lead
Content-Type: application/json
X-OL-Event: lead.created
X-OL-Delivery: 0193f1c2-…            (one per attempt series)
X-OL-Signature: t=1761900000,v1=5f2c…  (HMAC-SHA256(secret, t + "." + rawBody), hex)

{
  "id": "0193f1c0-…",                 // event id — the same on every retry
  "type": "lead.created",
  "createdAt": "2026-10-31T09:12:00.000Z",
  "businessId": "0193e…",
  "data": { "lead": { "id": "…", "score": 4, "phone": "081…", "summary": "…", "postUrl": "…", … } }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.OL_WEBHOOK_SECRET; // whsec_…

// IMPORTANT: verify the RAW body, before any JSON parsing
app.post("/webhooks/outbound-lead", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-OL-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return res.sendStatus(400); // replay window 5 min

  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.${req.body}`).digest("hex");
  const ok = header.split(",").some((p) => {
    const [k, v] = p.trim().split("=");
    return k === "v1" && v.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(v, "hex"), Buffer.from(expected, "hex"));
  });
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  // de-duplicate on event.id (the same on every retry), then handle event.type
  res.sendStatus(200); // answer within 10 s; do slow work in the background
});

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["OL_WEBHOOK_SECRET"].encode()  # whsec_…

@app.post("/webhooks/outbound-lead")
def outbound_lead():
    raw = request.get_data()  # the RAW body
    header = request.headers.get("X-OL-Signature", "")
    parts = [p.strip().split("=", 1) for p in header.split(",") if "=" in p]
    t = next((int(v) for k, v in parts if k == "t" and v.isdigit()), None)
    if t is None or abs(time.time() - t) > 300:
        abort(400)
    expected = hmac.new(SECRET, f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    if not any(k == "v1" and hmac.compare_digest(v, expected) for k, v in parts):
        abort(401)
    event = json.loads(raw)
    # de-duplicate on event["id"], then handle event["type"]
    return "", 200