Conduyt Admin API

openapi: 3.2.0
info:
  title: Conduyt Admin API
  version: 1.0.0
  description: 'The Conduyt CRM API provides programmatic access to your CRM data including

    contacts, companies, deals, pipelines, tasks, notes, automations, invoices,

    email sequences, and more.


    ## Authentication


    All authenticated endpoints require a Bearer token (API key) in the

    `Authorization` header:


    ```

    Authorization: Bearer cdy_

    ```


    API keys are generated in **Settings > API Keys** within the Conduyt

    dashboard. Keys use the `cdy_` prefix and are hashed with bcrypt on

    creation — the full key is shown exactly once at creation time.


    Session cookie authentication (`conduyt_session`) is also supported for

    browser-based clients but is not recommended for integrations.


    ## Rate Limiting


    API keys enforce a per-key rate limit. New keys default to 100 requests per

    minute and can be configured at creation time or with PATCH `/api-keys/{id}`.

    Some public and provider-facing endpoints also enforce stricter per-IP or

    per-account limits. When exceeded, the API returns `429 Too Many Requests`

    with a `Retry-After` header indicating seconds until the next allowed

    request.


    | Endpoint Group | Limit |

    |---------------------|---------------------|

    | API keys | Default 100 / min per key |

    | Login/reset | 5 / min per IP |

    | Registration | 3 / hour per IP |

    | Contact/Deal create | 30 / min per IP |

    | Inbound messages | 120 / min per account/IP |


    ## Pagination


    List endpoints support cursor-based pagination via query parameters:


    - `page` — Page number (default: 1)

    - `per_page` — Items per page (default: 50, max: 200)

    - `limit` — Accepted as an alias of `per_page` on `GET /contacts`; if both are

    sent they must carry the same value.


    A page size above the maximum, a non-integer, a value below 1, or a

    pagination key repeated with different values is rejected with `400`

    (the message names the parameter and the rule); nothing is silently

    clamped or ignored.


    Responses include a `meta` object: `{ page, per_page, total }`.


    An operation that documents its own pagination rules follows those instead.

    `GET /sms-providers/options` pages with an opaque `cursor` and a `limit`

    that is capped at 50 rather than rejected; its responses carry

    `meta: { nextCursor, truncated }`.


    ## Response Format


    All successful responses wrap data in a `data` envelope:

    ```json

    { "data": { ... } }

    ```


    Error responses use:

    ```json

    { "error": "Human-readable error message" }

    ```


    ## Multi-Tenancy


    Conduyt is multi-tenant. All data is scoped to the authenticated user''s

    current account. API keys are bound to a specific account at creation time.


    ## Webhook Events


    Outbound webhooks fire on events including:

    `contact.created`, `contact.updated`, `contact.deleted`,

    `deal.created`, `deal.updated`, `deal.won`, `deal.lost`,

    `task.created`, `task.completed`, `note.created`,

    `appointment.created`, `appointment.updated`,

    `form.submitted`, `invoice.paid`


    Payloads are signed with HMAC-SHA256 using the webhook''s secret. Retry

    schedule: 1m, 5m, 30m, 2h, 12h, 72h (7 total attempts including the initial delivery).'
  contact:
    name: Conduyt Support
    url: https://conduyt.app
    email: support@conduyt.app
  license:
    name: Proprietary
    url: https://conduyt.app/terms
servers:
- url: https://conduyt.app/api/v1
  description: Production
security:
- BearerAuth: []
tags:
- name: Admin
  description: Super-admin account management and impersonation
paths:
  /admin/accounts:
    get:
      operationId: adminListAccounts
      summary: List all accounts (super-admin)
      description: 'Every account with the columns the admin console needs. `status=trialing` is the trial users listing: it leaves comped and test accounts out. (#518) `isTest` is read-only: it is set only by registration''s test-account rule, which needs both an e2e+ address on conduyt.com, conduyt.app or brightmarketingsolutions.com and the harness secret (TEST_ACCOUNT_SIGNUP_SECRET, sent as the conduyt_test_signup cookie or the x-conduyt-test-signup header), and no route accepts it.'
      tags:
      - Admin
      responses:
        '200':
          description: All accounts
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      additionalProperties: false
                      properties:
                        id:
                          type: string
                          format: uuid
                        name:
                          type: string
                        slug:
                          type: string
                        domain:
                          type:
                          - string
                          - 'null'
                        plan:
                          type: string
                        billingStatus:
                          type: string
                          description: The stored billing status, or "comp" for a comped account.
                        storedBillingStatus:
                          type: string
                          description: The stored billing status column, unchanged for a comped account.
                        trialEndsAt:
                          type:
                          - string
                          - 'null'
                          format: date-time
                        currentPeriodEnd:
                          type:
                          - string
                          - 'null'
                          format: date-time
                        isComp:
                          type: boolean
                        isTest:
                          type: boolean
                          readOnly: true
                          description: An end-to-end test workspace that took the real sign-up path; never counted as a trial.
                        createdAt:
                          type: string
                          format: date-time
                        memberCount:
                          type: integer
                          minimum: 0
                        contactCount:
                          type: integer
                          minimum: 0
                        activeMemberCount:
                          type: integer
                          minimum: 0
                        liveContactCount:
                          type: integer
                          minimum: 0
                        owners:
                          type: array
                          description: Accepted, active owner members.
                          items:
                            type: object
                            additionalProperties: false
                            properties:
                              email:
                                type: string
                              name:
                                type:
                                - string
                                - 'null'
                            required:
                            - email
                            - name
                        lastActiveAt:
                          type:
                          - string
                          - 'null'
                          format: date-time
                        featureInterest:
                          type: array
                          description: Clicks on not-yet-live features, summed per feature over the account's people.
                          items:
                            type: object
                            additionalProperties: false
                            properties:
                              feature:
                                type: string
                              label:
                                type: string
                              clicks:
                                type: integer
                                minimum: 0
                              lastAt:
                                type:
                                - string
                                - 'null'
                                format: date-time
                            required:
                            - feature
                            - label
                            - clicks
                            - lastAt
                      required:
                      - id
                      - name
                      - slug
                      - domain
                      - plan
                      - billingStatus
                      - storedBillingStatus
                      - trialEndsAt
                      - currentPeriodEnd
                      - isComp
                      - isTest
                      - createdAt
                      - memberCount
                      - contactCount
                      - activeMemberCount
                      - liveContactCount
                      - owners
                      - lastActiveAt
                      - featureInterest
                required:
                - data
        '403':
          $ref: '#/components/responses/Forbidden'
      parameters:
      - name: limit
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: integer
          default: 200
        x-default-provenance: handler_literal
      - name: q
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: string
      - name: status
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: string
  /admin/accounts/{id}/comp:
    patch:
      operationId: adminToggleComp
      summary: Toggle comp (free) status for an account
      tags:
      - Admin
      parameters:
      - $ref: '#/components/parameters/IdParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - isComp
              properties:
                isComp:
                  type: boolean
                reason:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
      responses:
        '200':
          description: Comp status toggled
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties: {}
                required:
                - data
        '403':
          $ref: '#/components/responses/Forbidden'
  /admin/impersonate:
    post:
      operationId: adminImpersonate
      summary: Impersonate a user (super-admin)
      tags:
      - Admin
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - accountId
              properties:
                accountId:
                  type: string
                  format: uuid
                reason:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                ticket:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
      responses:
        '200':
          description: Impersonation started
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      redirectTo:
                        type: string
                      account: {}
                      expiresAt: {}
                    required:
                    - redirectTo
                    - account
                    - expiresAt
                required:
                - data
        '403':
          $ref: '#/components/responses/Forbidden'
      parameters: []
  /admin/impersonate/stop:
    post:
      operationId: adminStopImpersonate
      summary: Stop impersonating
      tags:
      - Admin
      responses:
        '200':
          description: Impersonation ended
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
      parameters: []
  /admin/clean-test-data:
    post:
      operationId: adminCleanTestData
      summary: Clean test data from the system
      tags:
      - Admin
      responses:
        '200':
          description: Test data cleaned
          content:
            application/json:
              schema:
                type: object
                properties:
                  data: {}
                required:
                - data
        '403':
          $ref: '#/components/responses/Forbidden'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                confirm:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
  /admin/clean-test-accounts:
    delete:
      operationId: adminCleanTestAccounts
      summary: Delete test accounts
      tags:
      - Admin
      responses:
        '200':
          description: Test accounts deleted
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    data:
                      type: object
                      properties:
                        deleted:
                          type: number
                        message:
                          type: string
                      required:
                      - deleted
                      - message
                  required:
                  - data
                - type: object
                  properties:
                    data:
                      type: object
                      properties:
                        deleted: {}
                        orphanUsersDeleted: {}
                        accounts: {}
                      required:
                      - deleted
                      - orphanUsersDeleted
                      - accounts
                  required:
                  - data
        '403':
          $ref: '#/components/responses/Forbidden'
      parameters: []
components:
  schemas:
    DataEnvelope:
      type: object
      properties:
        data:
          description: Response payload (shape varies by endpoint)
    ErrorResponse:
      type: object
      required:
      - error
      properties:
        error:
          type: string
        code:
          type: string
          description: Machine-readable error code (e.g., TRIAL_EXPIRED, PLAN_LIMIT_REACHED)
  responses:
    Forbidden:
      description: Insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  parameters:
    IdParam:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
      description: Resource UUID
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'API key authentication. Generate keys in Settings > API Keys.

        Keys use the `cdy_` prefix.


        Example: `Authorization: Bearer cdy_a1b2c3d4e5f6...`

        '
x-mcp:
  transport:
  - stdio
  - http
  orchestration: code
  endpoint_tools: hidden