> ## Documentation Index > Fetch the complete documentation index at: https://docs.teamfollowup.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the public API base URL: https://api.teamfollowup.ai/api. > Authenticate public API requests with Authorization: Bearer YOUR_API_KEY. > Use product-owned terms: agents, campaigns, projects (GoHighLevel sub-accounts), contacts, calls, outcomes, skills, cadences, phone numbers. > Scope requests by locationId rather than projectName. > Read the guide linked from each API reference group before recommending an endpoint. # Rotate the lead link > Issues a new token and retires the old one at once. Anything still posting to the old link starts failing immediately, so change your form or Zap in the same sitting. There is no grace period, deliberately: the reason to rotate is that somebody else has the old one. Cookie-auth callers must send the `x-csrf-token` header. Required API key scope: `contacts:write`. ## OpenAPI ````yaml /openapi.yaml post /api/native-contacts/lead-webhook/rotate openapi: 3.1.0 info: title: TFUAI Server API version: 1.0.0 description: >- API reference for the TFUAI SaaS server. All published endpoints are mounted under `/api`. Responses use a standard envelope: `{ "success": true, ... }` on success and `{ "success": false, "error": "..." }` on failure. Product API modules are being launched module by module. This spec currently exposes only contracted public modules. Authenticate public API requests with an API key in the `Authorization` header: `Authorization: Bearer YOUR_API_KEY`. servers: - url: https://api.teamfollowup.ai description: Production API origin. Public API paths are under /api. security: [] tags: - name: Agents description: Manage voice agents, campaigns, workflows, and outcomes. - name: Analytics description: >- Minimal, non-billing performance summary: volume, conversion, and pickup metrics. - name: Billing description: >- Billing for your own agency: balance, spend, transaction history, invoices and sub-account wallets; auto-recharge, rebilling, Credit Guard and Stripe customers; and, with the billing:charge scope, purchases and charges. - name: Calls description: Review calls, test runs, and execution history. - name: Campaign Workflows description: >- What runs after a call lands: for each outcome (booked, opted out, asked for a callback…), an ordered chain of actions — tag the contact, move a pipeline stage, send an SMS, book an appointment. Stored as a graph: `nodes` are the actions, `edges` say what follows what, and `dispositionEntries` maps each outcome to the node its chain starts at. **Pick the narrowest endpoint that does the job.** | To | Call | | | --- | --- | --- | | See what fires per outcome | `GET .../workflow/digest` | Reads as plain text, no graph walking | | Add steps to an outcome | `POST .../outcomes/{outcome}/nodes` | Server derives node ids, edge ids, handles, layout | | Change a message, tag or setting | `PATCH .../workflow` | Merges; carries no graph, so it cannot damage one | | Remove one step | `DELETE .../nodes/{nodeId}` | Also re-links the chain around it | | Author or replace the whole graph | `PUT .../workflow` | Replaces everything you send | `PUT` is the only one that can re-wire, position nodes, build an `if`, save an unconfigured draft, or copy a whole workflow — and the only one that can overwrite a change someone else made after you read it. Use it when you are genuinely authoring the graph, and send `expectedVersion` when you do. For everything else the narrower endpoints are both easier and safer. - name: Contacts description: Contact list, filters, contact call history, and do-not-call actions. - name: GHL description: CRM variables and contact helpers used by agent and campaign setup flows. - name: Native Calendar description: >- The diary of a sub-account with no CRM: its bookable calendars, the free slots they offer, and the appointments on them. Availability is computed per request against live bookings and is never cached, because a cached slot is one somebody else has already taken. - name: Native Contacts description: >- The people a sub-account with no CRM calls, and the fields it keeps on them. This is the system of record for those contacts: there is nowhere else they exist. A sub-account with a CRM keeps its contacts there and every operation here answers 400 for it. - name: Phone Numbers description: >- Caller ID pool, number search, assignment, movement, and release endpoints. - name: Power Dialer description: >- Power Dialer queue, lead cadence, callback, parked lead, and campaign schedule endpoints. - name: Projects description: >- Project management endpoints: list, update, disconnect, configure project campaigns, and validate setup. - name: Skills and Tools description: Manage reusable agent behaviors and in-call tool descriptions. - name: Split Testing description: >- Split live campaign traffic across agent variants and shift the weights between them. - name: Voices description: Voice catalogue endpoints for choosing the voice used by an agent. paths: /api/native-contacts/lead-webhook/rotate: post: tags: - Native Contacts summary: Rotate the lead link description: >- Issues a new token and retires the old one at once. Anything still posting to the old link starts failing immediately, so change your form or Zap in the same sitting. There is no grace period, deliberately: the reason to rotate is that somebody else has the old one. Cookie-auth callers must send the `x-csrf-token` header. Required API key scope: `contacts:write`. operationId: rotate-native-lead-link parameters: - name: locationId in: query required: true schema: type: string description: >- The sub-account. It is the only thing that identifies the tenant on these routes, and it is re-checked against your access on every call. A sub-account that keeps its contacts in a CRM answers 400. example: nat_fd9e2a8dd4be4396b604 requestBody: description: Request payload. _Detailed schema pending — see the route handler._ content: application/json: schema: type: object additionalProperties: {} responses: '200': description: The new token. The old one no longer works. content: application/json: schema: $ref: '#/components/schemas/NativeLeadLinkResponse' examples: default: value: success: true data: token: b20e4f7c118a49d3ae60c5d7f0921a44 createdAt: '2026-09-22T08:31:19.000Z' '400': description: >- The request is malformed, or this sub-account keeps its contacts in a CRM. content: application/json: schema: $ref: '#/components/schemas/NativeContactsErrorResponse' examples: default: value: success: false error: A phone number is required. '401': description: Missing or invalid authentication. content: application/json: schema: $ref: '#/components/schemas/NativeContactsErrorResponse' examples: default: value: success: false error: Unauthorized '403': description: Authenticated, but without access to this sub-account. content: application/json: schema: $ref: '#/components/schemas/NativeContactsErrorResponse' examples: default: value: success: false error: You do not have access to this sub-account. '429': description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/NativeContactsErrorResponse' examples: default: value: success: false error: TooManyRequests '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/NativeContactsErrorResponse' examples: default: value: success: false error: Contacts request failed. security: - ApiKeyAuth: [] x-codeSamples: - lang: bash label: cURL source: |- curl --request POST \ --url https://api.teamfollowup.ai/api/native-contacts/lead-webhook/rotate \ --header 'Authorization: Bearer YOUR_API_KEY' components: schemas: NativeLeadLinkResponse: type: object additionalProperties: {} required: - success - data properties: success: type: boolean data: type: object additionalProperties: {} properties: token: type: string description: >- The secret in the link. Post to https://api.teamfollowup.ai/api/native-leads/{locationId}/{token}. example: 7f3c9a2b41d8ac05e6b1d2f39a7c4e10 createdAt: type: string example: '2026-09-11T10:22:04.000Z' NativeContactsErrorResponse: type: object additionalProperties: {} required: - success - error properties: success: type: boolean error: type: string example: A phone number is required. errors: type: array description: Every reason the write was refused, when there is more than one. items: type: string failed: type: array description: >- On a refused delete: the bookings that would not cancel, which is why the contact is still here. items: type: object additionalProperties: {} cancelled: type: array description: >- On a refused delete: the bookings that HAD already been cancelled before it stopped. They do not come back. items: type: object additionalProperties: {} contactKept: type: boolean description: True when the contact is still here, whatever else failed. securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API key description: 'Send your API key as `Authorization: Bearer YOUR_API_KEY`.' ````