Public endpoints.

Three of our endpoints are public and unauthenticated by design — they exist so anyone can independently verify the integrity of any delivery. The rest of the API is buyer-scoped behind a session cookie or signed download token.

GET /api/audit/[lead_id]

Returns the public exclusivity record for a lead. No authentication. The buyer ID is hashed before exposure so the public never learns who received the lead.

curl https://merchantsourced.com/api/audit/ms_lead_8f3a2c

200 {
  "lead_id": "ms_lead_8f3a2c",
  "exclusivity": "exclusive",
  "status": "delivered",
  "captured_at": "2026-04-29T13:55:42Z",
  "max_delivery_count": 1,
  "delivered_to_count": 1,
  "deliveries": [{
    "delivery_id": "ms_dlv_a01",
    "buyer_hash": "9f41c6d2a0b87e1c",
    "delivered_at": "2026-04-29T14:02:11.293Z",
    "bid_won_cents": 12500,
    "signature": "ad42f1c8...",
    "status": "delivered"
  }],
  "attempts_to_others": 0
}

POST /api/audit/verify

Submit a receipt payload and signature. We HMAC the payload with our signing secret and timing-safe-compare. We also check the row against our delivery ledger.

curl -X POST https://merchantsourced.com/api/audit/verify \
  -H "content-type: application/json" \
  -d '{
    "lead_id":      "ms_lead_8f3a2c",
    "buyer_id":     "ms_buyer_demo01",
    "delivered_at": "2026-04-29T14:02:11.293Z",
    "exclusivity":  "exclusive",
    "signature":    "ad42f1c8..."
  }'

200 { "valid": true, "matches_record": true }

GET /api/audit/sample

Returns a freshly-signed sample receipt for our public demo lead. Useful for testing your own verifier integration locally.

curl https://merchantsourced.com/api/audit/sample

200 {
  "lead_id": "ms_lead_seed01",
  "buyer_id": "ms_buyer_demo01",
  "delivered_at": "2026-04-29T14:02:11.293Z",
  "exclusivity": "exclusive",
  "signature": "ad42f1c8..."
}

POST /api/v1/leads/intake

Affiliate revshare endpoint. Submit a lead with consent metadata and we credit your affiliate account a configurable percentage of every sale. Apply for an affiliate account.

curl -X POST https://merchantsourced.com/api/v1/leads/intake \
  -H "x-affiliate-key: aff_..." \
  -H "content-type: application/json" \
  -d '{
    "first_name": "Jane",
    "last_name": "Doe",
    "business_name": "Doe Trucking LLC",
    "phone": "5555550101",
    "email": "jane@example.com",
    "monthly_revenue": 80000,
    "fico": 670,
    "consent": true,
    "consent_text": "By submitting...",
    "consent_ip": "203.0.113.42",
    "source_url": "https://your-landing.example/quote"
  }'

201 { "lead_id": "ms_lead_8f3a2c", "quality_tier": "B", "credit_pending_cents": 1500 }

Webhook delivery format

When a lead matches a buyer's filter, we POST to the buyer's configured webhook URL. The buyer has 60 seconds to respond 200 or we move on to the next bidder.

POST https://your-crm.example/webhook
content-type: application/json
x-merchantsource-signature: ad42f1c8...

{
  "type": "lead.delivered",
  "delivery_id": "ms_dlv_...",
  "delivered_at": "2026-04-29T14:02:11.293Z",
  "exclusivity": "exclusive",
  "lead": {
    "first_name": "Jane",
    "last_name": "Doe",
    "business_name": "Doe Trucking LLC",
    "phone": "5555550101",
    "email": "jane@example.com",
    "industry": "Trucking",
    "business_address_state": "FL",
    "monthly_revenue": 80000,
    "fico": 670,
    "lead_quality_tier": "A"
  },
  "receipt": {
    "lead_id": "ms_lead_8f3a2c",
    "buyer_id": "ms_buyer_demo01",
    "signature": "ad42f1c8...",
    "verify_url": "https://merchantsourced.com/audit/ms_lead_8f3a2c"
  }
}