LDM Developers

API Registration

A single endpoint — `POST /api/auth/register` — creates an account. For agent channels (`mcp`/`a2a`/`form`) it hands back a working API key in the same response, tied to a PENDING account. Reads work immediately; sending and unavailable writes wait for activation.

One endpoint, two response shapes

Both humans and agents go through POST /api/auth/register. The channel field decides the response shape.

  • Agent (channel: "mcp" | "a2a" | "form"): password optional, response includes a flat api_key you can use immediately for reads; sending and other unavailable writes wait for activation.
  • Web (channel omitted or "web"): password required, response is { pending: true } — the user logs in after confirming their email.

Agent signup — request

curl -X POST https://api.live-direct-marketing.online/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"agent@example.com","termsAccepted":true,"channel":"mcp"}'

MCP clients skip the raw HTTP call — see MCP Integration: ldm_terms then ldm_register.

What happens next

POST /api/auth/register { email, termsAccepted: true, channel: "mcp" }
   -> account + tenant created, status PENDING
   -> api_key returned immediately (read scopes; email:send unavailable until activation)
   -> confirmation email sent (link valid 48h): GET /api/auth/verify-email?token=...

Link opened
   -> if corporate email + matching live website: auto-activates (max 1 activation/hour platform-wide)
   -> otherwise: stays PENDING for questionnaire + admin review (admin notified by email at every step)

Owner expands scopes (email:send, mailing:write, ...) in CRM Settings -> API Keys once active

Response (trimmed)

{
  "pending": true,
  "status": "PENDING",
  "channel": "mcp",
  "api_key": "ldm_...",
  "scope": ["crm:read", "..."],
  "tenant": { "id": "...", "slug": "..." },
  "nextSteps": [
    "The account owner must open the confirmation link — the account stays PENDING until then.",
    "Reconnect your MCP client with the api_key below.",
    "The key starts with read scopes; sending and unavailable writes wait for activation. Expand scopes in Settings -> API Keys once active."
  ]
}

Limits and security

  • Agent-channel signup is rate-limited per IP (per-hour ceiling).
  • Self-signup workspaces have a 50MB database quota — over quota, POST/PUT/PATCH return 403 while reads and DELETE keep working.
  • Re-using an email that already has an account returns the same PENDING response as a fresh signup — the existing account is never revealed, and the real owner gets a notification email.
  • Email-confirmation links expire in 48 hours.
  • Agreement text: GET /api/legal/terms (or the MCP ldm_terms tool) — termsAccepted: true is required.

Request body — accepted fields

{
  "email":         "string, required",
  "termsAccepted": "boolean, required — must be true",
  "channel":       "web | mcp | a2a | form, optional (default web)",
  "password":      "string, required for channel=web, optional otherwise",
  "firstName":     "string, optional",
  "lastName":      "string, optional",
  "org":           "string, optional",
  "use_case":      "string, optional"
}