One scoped API key operates the whole production + outreach stack — source and qualify leads, run campaigns, scope and invoice estimates, cut clips, and hand jobs to our team. The same surface our own dashboard runs on, opened up for you.
Every call is a POST to a single endpoint. You name the underlying path and method in the JSON envelope. Mint a key in the dashboard under Company → Settings → Keys (the plaintext shows once).
curl -s https://api.cybercitymedia.com/v1 \ -H "x-agent-key: $CCM_AGENT_KEY" \ -H "Content-Type: application/json" \ -d '{ "action": "outreach_api", "path": "leads", "method": "GET", "query": { "limit": 25, "campaign": 3 } }'
Send your key on every request. A key resolves to an owner identity, a role (member / admin / owner), and a scope list — each call must pass both. Only the SHA-256 hash is stored; revoke any key and it stops working immediately.
Cyber City Mediax-agent-key: ccm_agent_<owner>_<token>
# or
Authorization: Bearer ccm_agent_<owner>_<token>Keys may only call action: "outreach_api". Reads (GET:*) are safe to call freely; writes change real state and money/send actions must be explicitly granted. Every call is attributed in the activity log as <owner>-agent.
A scope is <METHOD>:<pathGlob> — method is GET, POST, or *; the glob is an exact path, a prefix/* wildcard, or *. Even with POST:*, admin-only endpoints require an admin/owner role.
| Preset | Scopes | For |
|---|---|---|
| Read only | GET:* | Dashboards & reporting agents. |
| Drafting & CRM | GET:* + draft/organize writes (compose preview, estimates, list & contact management) | Draft content and estimates, organize contacts. No sending or spending. |
| Full | GET:*, POST:* | Everything the owner can do (still blocked from admin-only paths unless the owner is admin). |
🔒 = admin/owner role required. Money and send actions are intentionally not in the default scope — grant them explicitly on the key.
| Method | Path | Purpose |
|---|---|---|
| GET | leads | List leads (filters: limit, q, status, source, list, campaign). |
| GET | prospect | Full prospect 360 (query: id). |
| GET | contact/{id} | Contact record + unified timeline + quotes. |
| POST 🔒 | leads/import | Import contacts → leads + list. |
| POST 🔒 | lead/status, lead/approve… | Per-lead state changes. |
| Method | Path | Purpose |
|---|---|---|
| GET | campaigns, campaign/stats | List & metrics. |
| POST 🔒 | campaign/create, campaign/pause… | Manage campaigns. |
| GET | replies, conversations, needs-trent | Inbound replies, threads, human escalations. |
| POST 🔒 | compose, reply/send, sequence/run | Generate copy, send replies, run cycles. |
| Method | Path | Purpose |
|---|---|---|
| GET | quotes, quote/{id} | List / read estimates. |
| POST 🔒 | quote/generate | AI scopes + prices an estimate. |
| POST 🔒 | quote/{id}/invoice | Issue a real Stripe invoice. |
| POST 🔒 | quote/{id}/paid | Mark paid → unlocks the production scheduler. |
| GET | production/access | Prepaid gate check. |
| Method | Path | Purpose |
|---|---|---|
| GET | clips, clip/winners | Clip data. |
| POST 🔒 | clip/render, clip/{id}/deliver | Render & deliver clips. |
| GET | gmb/list, comms | Google Business posts, call/SMS feed. |
| POST 🔒 | voice/call, sms/send, gmb/publish | Place a call, text, publish. |
This is a representative slice. The full endpoint reference (deliverability, sourcing, opportunities, warmup, settings) is a live, machine-readable OpenAPI 3.1 spec — import it into Swagger, Postman, or a codegen tool: /openapi.json. It's generated from the enforced endpoint catalog, so it never drifts from what actually works.
Two native ways in, one auth model. MCP: point any MCP-capable agent at mcp.cybercitymedia.com (JSON-RPC over HTTP, x-agent-key header) — it discovers dashboard_call + list_endpoints automatically. REST: call api.cybercitymedia.com/<path> directly with the same x-agent-key header (or Authorization: Bearer ccm_agent_…) — every path in /openapi.json, same scopes and role gates.
Add the CCM MCP server (or hit the REST API) with your scoped key. Your agent discovers the toolset automatically.
Source leads, scope estimates, invoice, and track delivery — all as native tool calls.
Post a job to the freelancer marketplace — skill-matched invites, signed bid links, one-call award. UI coming; API live.