Conduyt Forms API

openapi: 3.2.0
info:
  title: Conduyt Forms API
  version: 1.0.0
  description: 'The Conduyt CRM API provides programmatic access to your CRM data including

    contacts, companies, deals, pipelines, tasks, notes, automations, invoices,

    email sequences, and more.


    ## Authentication


    All authenticated endpoints require a Bearer token (API key) in the

    `Authorization` header:


    ```

    Authorization: Bearer cdy_

    ```


    API keys are generated in **Settings > API Keys** within the Conduyt

    dashboard. Keys use the `cdy_` prefix and are hashed with bcrypt on

    creation — the full key is shown exactly once at creation time.


    Session cookie authentication (`conduyt_session`) is also supported for

    browser-based clients but is not recommended for integrations.


    ## Rate Limiting


    API keys enforce a per-key rate limit. New keys default to 100 requests per

    minute and can be configured at creation time or with PATCH `/api-keys/{id}`.

    Some public and provider-facing endpoints also enforce stricter per-IP or

    per-account limits. When exceeded, the API returns `429 Too Many Requests`

    with a `Retry-After` header indicating seconds until the next allowed

    request.


    | Endpoint Group | Limit |

    |---------------------|---------------------|

    | API keys | Default 100 / min per key |

    | Login/reset | 5 / min per IP |

    | Registration | 3 / hour per IP |

    | Contact/Deal create | 30 / min per IP |

    | Inbound messages | 120 / min per account/IP |


    ## Pagination


    List endpoints support cursor-based pagination via query parameters:


    - `page` — Page number (default: 1)

    - `per_page` — Items per page (default: 50, max: 200)

    - `limit` — Accepted as an alias of `per_page` on `GET /contacts`; if both are

    sent they must carry the same value.


    A page size above the maximum, a non-integer, a value below 1, or a

    pagination key repeated with different values is rejected with `400`

    (the message names the parameter and the rule); nothing is silently

    clamped or ignored.


    Responses include a `meta` object: `{ page, per_page, total }`.


    An operation that documents its own pagination rules follows those instead.

    `GET /sms-providers/options` pages with an opaque `cursor` and a `limit`

    that is capped at 50 rather than rejected; its responses carry

    `meta: { nextCursor, truncated }`.


    ## Response Format


    All successful responses wrap data in a `data` envelope:

    ```json

    { "data": { ... } }

    ```


    Error responses use:

    ```json

    { "error": "Human-readable error message" }

    ```


    ## Multi-Tenancy


    Conduyt is multi-tenant. All data is scoped to the authenticated user''s

    current account. API keys are bound to a specific account at creation time.


    ## Webhook Events


    Outbound webhooks fire on events including:

    `contact.created`, `contact.updated`, `contact.deleted`,

    `deal.created`, `deal.updated`, `deal.won`, `deal.lost`,

    `task.created`, `task.completed`, `note.created`,

    `appointment.created`, `appointment.updated`,

    `form.submitted`, `invoice.paid`


    Payloads are signed with HMAC-SHA256 using the webhook''s secret. Retry

    schedule: 1m, 5m, 30m, 2h, 12h, 72h (7 total attempts including the initial delivery).'
  contact:
    name: Conduyt Support
    url: https://conduyt.app
    email: support@conduyt.app
  license:
    name: Proprietary
    url: https://conduyt.app/terms
servers:
- url: https://conduyt.app/api/v1
  description: Production
security:
- BearerAuth: []
tags:
- name: Forms
  description: Lead capture forms and submissions
paths:
  /forms:
    get:
      operationId: listForms
      summary: List forms
      tags:
      - Forms
      responses:
        '200':
          description: All forms
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      data: {}
                      meta: {}
                    required:
                    - data
                    - meta
                required:
                - data
      parameters:
      - name: include_archived
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: boolean
      - name: is_active
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: string
      - name: page
        in: query
        required: false
        description: Page number
        schema:
          type: integer
          default: 1
          minimum: 1
        x-default-provenance: handler_literal
      - name: per_page
        in: query
        required: false
        description: Items per page (max 200)
        schema:
          type: integer
          default: 50
          minimum: 1
          maximum: 200
        x-default-provenance: handler_literal
      - name: search
        in: query
        required: false
        description: Full-text search query
        schema:
          type: string
    post:
      operationId: createForm
      summary: Create a form
      tags:
      - Forms
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - slug
              - fields
              properties:
                name:
                  type: string
                slug:
                  type: string
                description:
                  type: string
                fields:
                  type: array
                  items:
                    type: object
                    properties:
                      key:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      label:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      options:
                        type: array
                        items:
                          type: object
                          properties:
                            label:
                              description: Read by the handler from the JSON body (the route declares no schema for its type).
                            value:
                              description: Read by the handler from the JSON body (the route declares no schema for its type).
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      required:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      type:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                settings:
                  type: object
                  properties:
                    consent:
                      type: object
                      properties:
                        linkUrl:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                redirectUrl:
                  type: string
                thankYouMessage:
                  type: string
                template:
                  type:
                  - string
                  - 'null'
                  enum:
                  - bda
                  - null
                  description: Hosted page template. null (default) renders the standard card; "bda" renders the BDA split panel. Any other value is a 400.
                hyrosTag:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                isActive:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
      responses:
        '201':
          description: Form created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
      parameters:
      - name: dry_run
        in: query
        required: false
        description: Validate the mutation without persisting changes.
        schema:
          type: boolean
      - name: sandbox
        in: query
        required: false
        description: Run the mutation in sandbox mode.
        schema:
          type: boolean
  /forms/{id}:
    get:
      operationId: getForm
      summary: Get a form by ID
      tags:
      - Forms
      parameters:
      - $ref: '#/components/parameters/IdParam'
      responses:
        '200':
          description: Form details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
    patch:
      operationId: updateForm
      summary: Update a form
      tags:
      - Forms
      parameters:
      - $ref: '#/components/parameters/IdParam'
      - name: dry_run
        in: query
        required: false
        description: Validate the mutation without persisting changes.
        schema:
          type: boolean
      - name: sandbox
        in: query
        required: false
        description: Run the mutation in sandbox mode.
        schema:
          type: boolean
      responses:
        '200':
          description: Form updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                fields:
                  type: array
                  items:
                    type: object
                    properties:
                      key:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      label:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      options:
                        type: array
                        items:
                          type: object
                          properties:
                            label:
                              description: Read by the handler from the JSON body (the route declares no schema for its type).
                            value:
                              description: Read by the handler from the JSON body (the route declares no schema for its type).
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      required:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                      type:
                        description: Read by the handler from the JSON body (the route declares no schema for its type).
                    description: Read by the handler from the JSON body (the route declares no schema for its type).
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                hyrosTag:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                isActive:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                name:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                redirectUrl:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                settings:
                  type: object
                  properties:
                    consent:
                      type: object
                      properties:
                        linkUrl:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                slug:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                template:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                thankYouMessage:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
    delete:
      operationId: deleteForm
      summary: Archive a form
      tags:
      - Forms
      parameters:
      - $ref: '#/components/parameters/IdParam'
      - name: dry_run
        in: query
        required: false
        description: Validate the mutation without persisting changes.
        schema:
          type: boolean
      - name: sandbox
        in: query
        required: false
        description: Run the mutation in sandbox mode.
        schema:
          type: boolean
      responses:
        '200':
          description: Form archived
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      id: {}
                      archived:
                        type: boolean
                    required:
                    - id
                    - archived
                required:
                - data
  /forms/{id}/submissions:
    get:
      operationId: listFormSubmissions
      summary: List submissions for a form
      tags:
      - Forms
      parameters:
      - $ref: '#/components/parameters/IdParam'
      - name: page
        in: query
        required: false
        description: Page number
        schema:
          type: integer
          default: 1
          minimum: 1
        x-default-provenance: handler_literal
      - name: per_page
        in: query
        required: false
        description: Items per page (max 200)
        schema:
          type: integer
          default: 50
          minimum: 1
          maximum: 200
        x-default-provenance: handler_literal
      responses:
        '200':
          description: Paginated form submissions
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      data: {}
                      meta: {}
                    required:
                    - data
                    - meta
                required:
                - data
  /forms/{id}/submit:
    post:
      operationId: submitForm
      summary: Submit a form (public, no auth)
      description: 'Idempotent retries: send a random UUID v4 per attempt as _submissionKey. A lost response or a 409 submission_unconfirmed answer is retried with the same payload and the submissionKey that answer carries (it can differ from the key sent). A key whose submission committed answers 201 with replayed: true and runs nothing twice. Retrying without a key creates a second submission.'
      tags:
      - Forms
      security: []
      parameters:
      - $ref: '#/components/parameters/IdParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - data
              properties:
                data:
                  type: object
                  additionalProperties: true
                  description: Key-value pairs matching the form's field definitions
                  properties:
                    _hp_field:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    _submissionKey:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    address:
                      type: object
                      properties:
                        city:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        line1:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        line2:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        state:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                        zip:
                          description: Read by the handler from the JSON body (the route declares no schema for its type).
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    addressLine1:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    addressLine2:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    city:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    company:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    country:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    email:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    firstName:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    first_name:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    jobTitle:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    lastName:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    last_name:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    name:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    phone:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    source:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    state:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_campaign:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_content:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_medium:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_source:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_term:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    zip:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                _submissionKey:
                  type: string
                  format: uuid
                  description: Idempotency key, a random UUID v4 generated per attempt; reuse it (or the one a 409 answer returns) on every retry. Other UUID versions are ignored.
                _hp_field:
                  type: string
                  description: Honeypot, leave empty
                consent:
                  type: object
                  additionalProperties: true
                  properties:
                    accepted:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    acceptedAt:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                utm:
                  type: object
                  additionalProperties: true
                attribution:
                  type: object
                  additionalProperties: true
                  properties:
                    landingUrl:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    pageTitle:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    source:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_campaign:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_content:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_medium:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_source:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                    utm_term:
                      description: Read by the handler from the JSON body (the route declares no schema for its type).
                source:
                  type: string
      responses:
        '201':
          description: Submission accepted (replayed is true when the key's earlier attempt had already committed)
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                properties:
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      contactId:
                        type:
                        - string
                        - 'null'
                        format: uuid
                      redirectUrl:
                        type:
                        - string
                        - 'null'
                      thankYouMessage:
                        type: string
                        description: The form's configured thank-you message, or the default "Thanks! Your submission was received." when none is set. Never null.
                  warnings:
                    type: array
                    description: Present only when the submission was saved but an answer could not be stored. A phone answer that is not a valid number is not saved (the lead is never refused over it); the contact gets an activity naming it.
                    items:
                      type: object
                      required:
                      - field
                      - code
                      - value
                      properties:
                        field:
                          type: string
                        code:
                          type: string
                          enum:
                          - phone_invalid
                        value:
                          type: string
                  replayed:
                    type: boolean
        '400':
          description: Validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Form not found or inactive
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: The attempt could not be confirmed. Retry the same payload with submissionKey; uploadsNeedReattach means the attempt's file uploads must be uploaded again first.
          content:
            application/json:
              schema:
                type: object
                required:
                - error
                - code
                - submissionKey
                - uploadsNeedReattach
                properties:
                  error:
                    type: string
                  code:
                    type: string
                    enum:
                    - submission_unconfirmed
                  submissionKey:
                    type: string
                    format: uuid
                  uploadsNeedReattach:
                    type: boolean
    options:
      x-generated: true
      operationId: optionsFormsIdSubmit
      summary: OPTIONS forms id submit
      tags:
      - Forms
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
  /forms/{id}/analytics:
    get:
      x-generated: true
      operationId: getFormsIdAnalytics
      summary: Get forms id analytics
      tags:
      - Forms
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: period
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      period: {}
                      totals: {}
                      daily: {}
                      sources: {}
                    required:
                    - period
                    - totals
                    - daily
                    - sources
                required:
                - data
  /forms/{id}/install-check:
    post:
      x-generated: true
      operationId: postFormsIdInstallCheck
      summary: Create / invoke forms id install-check
      tags:
      - Forms
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      installed: {}
                      status: {}
                      checkedUrl: {}
                      checks: {}
                    required:
                    - installed
                    - status
                    - checkedUrl
                    - checks
                required:
                - data
  /forms/{id}/uploads:
    get:
      x-generated: true
      operationId: getFormsIdUploads
      summary: Get forms id uploads
      tags:
      - Forms
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: pointer
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: string
      responses:
        '302':
          description: Redirect
          headers:
            Location:
              schema:
                type: string
components:
  schemas:
    DataEnvelope:
      type: object
      properties:
        data:
          description: Response payload (shape varies by endpoint)
    ErrorResponse:
      type: object
      required:
      - error
      properties:
        error:
          type: string
        code:
          type: string
          description: Machine-readable error code (e.g., TRIAL_EXPIRED, PLAN_LIMIT_REACHED)
  parameters:
    IdParam:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
      description: Resource UUID
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'API key authentication. Generate keys in Settings > API Keys.

        Keys use the `cdy_` prefix.


        Example: `Authorization: Bearer cdy_a1b2c3d4e5f6...`

        '
x-mcp:
  transport:
  - stdio
  - http
  orchestration: code
  endpoint_tools: hidden