xavio-in Leads API

openapi: 3.2.0
info:
  title: Nafafy Public Leads API
  version: 1.0.0
  description: 'Programmatic access to publish stories, manage products and variants, fulfil orders, run bookings and read analytics on Nafafy.


    - **REST** — `Authorization: Bearer nf_live_…` (or `nf_test_…`) with a key of kind **REST API** minted at https://nafafy.com/dashboard/developer. Each Series F operation names the scope it needs (`x-required-scope`); `x:write` implies `x:read`. `customers:pii` and `refunds:write` are standalone and never implied.

    - **MCP** — https://nafafy.com/api/mcp (JSON-RPC 2.0 over HTTP) needs a key of kind **MCP**; a REST key is refused there, and an MCP key is refused on REST (`wrong_kind`).


    Errors use the envelope `components.schemas.V1Error`; branch on `error.code`. Series F operations list every code they can answer in `x-error-codes` and their limit in `x-rate-limit`.'
  contact:
    name: Nafafy support
    url: https://nafafy.com/developers
servers:
- url: https://nafafy.com
  description: Production
security:
- bearerAuth: []
tags:
- name: Leads
  description: Lead inbox + ingestion.
paths:
  /api/v1/leads:
    get:
      summary: List leads for the caller's host
      tags:
      - Leads
      responses:
        '200':
          description: OK
      operationId: getApiV1Leads
      x-operation-id-source: derived
    post:
      summary: Append a lead to one of your lead forms (scope leads:write).
      tags:
      - Leads
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                form_id:
                  type: string
                  format: uuid
                values:
                  type: object
                  description: Keyed by the form's field ids.
                idempotency_key:
                  type: string
                utm:
                  type: object
              required:
              - form_id
              - values
      responses:
        '200':
          description: Duplicate (same idempotency_key)
        '201':
          description: Created
        '409':
          description: Form requires phone OTP
      operationId: postApiV1Leads
      x-operation-id-source: derived
  /api/v1/leads/outcome:
    post:
      summary: 'Report what a lead turned out to be worth (scope leads:write): won + value…'
      tags:
      - Leads
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                pipeline_id:
                  type: string
                  format: uuid
                lead_id:
                  type: string
                  format: uuid
                email:
                  type: string
                phone:
                  type: string
                outcome:
                  type: string
                  enum:
                  - won
                  - lost
                  - disqualified
                value_inr:
                  type: number
                value_paise:
                  type: integer
                reason:
                  type: string
                outcomes:
                  type: array
                  maxItems: 100
                  description: 'Batch form: an array of the objects above.'
              required: []
      responses:
        '200':
          description: All applied
        '207':
          description: Some items failed — see data.results
      operationId: postApiV1LeadsOutcome
      x-operation-id-source: derived
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: nf_live_<32-char> | nf_test_<64-char>