New Feature: Webhook & Public API for Tenant Integrations

Priority: 🟢 Post-MVP
Area: Integrations / Developer Platform
Competitive Reference: Jasper (API + MCP), Copy.ai (2000+ integrations via Zapier + API), Predis.ai (API for posts/videos/reels)

Why This Matters

Agencies and clients want to integrate Leadmetrics into their existing stack — trigger content generation from their CRM, pull reports into their BI tools, get notified in their Slack when content is approved. Every mature SaaS platform offers a public API and webhook system.

What Leadmetrics Has Today

Internal REST API (/auth/v1, /tenant/v1, /admin/v1, /dm/v1) — not designed for external access
No API key management — all auth is JWT-based for dashboard users
No webhook system — no outbound event notifications
No rate limiting per API key (only per-IP rate limiting)
No OpenAPI/Swagger documentation
No Zapier/Make integration

Proposed Implementation

Phase 1 — API Key Management


model ApiKey {
  id          String   @id @default(cuid())
  tenantId    String
  name        String   // "Zapier Integration"
  keyHash     String   @unique  // SHA-256 hash of the actual key
  prefix      String   // "lm_live_" or "lm_test_"  
  permissions String[] // ["read:blog", "write:social", "read:analytics"]
  lastUsedAt  DateTime?
  expiresAt   DateTime?
  isActive    Boolean  @default(true)
  createdAt   DateTime @default(now())
  tenant      Tenant   @relation(fields: [tenantId], references: [id])
}

Dashboard UI: Settings → API Keys → Create/Revoke/Rotate

Phase 2 — Public API Endpoints

Versioned public API under /api/v1/:

GET /api/v1/blog-posts — list blog posts
POST /api/v1/blog-posts/generate — trigger blog generation
GET /api/v1/social-posts — list social posts
POST /api/v1/social-posts/generate — trigger social post generation
GET /api/v1/analytics/overview — performance summary
GET /api/v1/leads — list leads
POST /api/v1/leads — create lead

Auth: Authorization: Bearer lm_live_xxxxx

Phase 3 — Webhook System


model WebhookEndpoint {
  id          String   @id @default(cuid())
  tenantId    String
  url         String   // HTTPS endpoint
  events      String[] // ["blog.approved", "social.published", "lead.created"]
  secret      String   // HMAC signing secret
  isActive    Boolean  @default(true)
  createdAt   DateTime @default(now())
  tenant      Tenant   @relation(fields: [tenantId], references: [id])
}

Events fired:

blog.created, blog.approved, blog.published
social.created, social.approved, social.published
lead.created, lead.updated
agent.completed, agent.failed
invoice.paid, subscription.changed

Delivery: HTTP POST with HMAC-SHA256 signature header, 3x retry with exponential backoff.

Phase 4 — OpenAPI Documentation

Auto-generate from Fastify schemas using @fastify/swagger. Host at docs.leadmetrics.app/api.

Phase 5 — Zapier Integration

Build a Zapier app with triggers (webhook events) and actions (create lead, generate blog). This multiplies the integration surface by 5,000+ apps.

White-Label Client Portal — API enables headless client experiences