---
seo:
  description: Versioned public API.
sidebar:
  label: Overview
title: Leadtime Public API
---
Versioned public API.

Authentication:
- Personal Access Tokens (PAT): Create/manage in your Profile → API Tokens. Use the raw token once returned to you as Bearer: `Authorization: Bearer <pat>`.
- OAuth 2.0 (Authorization Code + PKCE): Workspace admin creates an OAuth client in Workspace Settings → API & Integrations, then obtain tokens via the standard OAuth flow. Use the access token as Bearer. Refresh tokens are supported at `/api/oauth/token`.

Dynamic Client Registration (RFC 7591):
The API supports RFC 7591 compliant dynamic client registration, allowing applications to register OAuth clients programmatically without requiring workspace admin setup.

**Registration Endpoint**: `POST /api/oauth/register`

**Features**:
- Automatically creates OAuth clients with generated `client_id` and optional `client_secret`
- Clients are auto-installed in workspaces when the API feature is enabled
- Supports multiple authentication methods: `none` (public clients), `client_secret_post`, `client_secret_basic`
- Idempotent registration: If a client with the same name and redirect URIs already exists, the existing client is updated instead of creating a duplicate
- Returns RFC 7591 compliant registration response with client credentials and metadata

**Request Body**:
- `redirect_uris` (required): Array of redirect URIs for the client
- `client_name` (optional): Display name for the client (defaults to "Dynamically Registered Client")
- `client_uri` (optional): Homepage URL of the client application
- `logo_uri` (optional): Logo URL for the client
- `token_endpoint_auth_method` (optional): Authentication method (`none`, `client_secret_post`, or `client_secret_basic`, defaults to `none`)

**Response**:
- `client_id`: Unique client identifier (format: `dcr_<uuid>`)
- `client_secret`: Client secret (only returned for confidential clients, not for `none` auth method)
- `client_name`: Client display name
- `redirect_uris`: Array of allowed redirect URIs
- `token_endpoint_auth_method`: Authentication method used
- `grant_types`: Supported grant types (`authorization_code`, `refresh_token`)
- `response_types`: Supported response types (`code`)
- `client_id_issued_at`: Unix timestamp when client was created
- `client_secret_expires_at`: Expiration timestamp (0 means no expiration)
- `registration_client_uri`: URI for client registration management

**Discovery**:
The registration endpoint URL is available via OAuth 2.0 Authorization Server Metadata at `/api/.well-known/oauth-authorization-server` (see `registration_endpoint` field).

Imposter Mode (Testing/Debugging):
⚠️ **Permission Required**: `PublicApi.allowImposterMode`

Optional headers for testing and debugging (case-insensitive):
- `LT_IMPOSTER_USER_ID` / `lt_imposter_user_id`: Override authenticated user with specified user ID. User must exist and belong to the same workspace. Original token permissions are preserved.
- `LT_CUSTOM_NOW` / `lt_custom_now`: Override current time with custom date (ISO 8601 format). Useful for testing time-sensitive operations.

Rate limiting:
- Ingress sheds extreme per-IP floods before they reach API pods (about 100 requests/second per ingress replica).
- Every HTTP request that reaches the API also counts against a 60-second Redis window: 3000 requests per client IP and 1200 requests per access token or session.
- Application responses include `X-RateLimit-Limit` and `X-RateLimit-Remaining`. Excess application requests return HTTP 429 with `Retry-After` (seconds).
- Signup, login, and automation webhook routes keep additional tighter limits.

Mutation response projection:
- Create/update endpoints may declare a compact default response, usually identifiers and the primary display field.
- Use `fieldsToReturn=id,name,...` to request exact top-level response fields when the endpoint documents `x-lt-response-projection`.
- Use `responseShape=full` or header `LT-Response-Shape: full` to opt into the complete response object.
- Validation and error responses are never projected.

OpenAPI specification downloads:
- [JSON](https://leadtime.app/api/public/docs/json)
- [YAML](https://leadtime.app/api/public/docs/yaml)
- Load either specification into Scalar, Postman, Insomnia, or another OpenAPI client for interactive requests.

Example:
```
curl -X GET "https://api.example.com/api/public/account/info" \
  -H "Authorization: Bearer <token>" \
  -H "LT_IMPOSTER_USER_ID: user-123" \
  -H "LT_CUSTOM_NOW: 2024-01-15T10:00:00Z"
```

Base URL: https://leadtime.app/api/public

<ApiOverview source="api-reference" />

## account

<ApiTagOperations source="api-reference" tag="account" />

## administration

<ApiTagOperations source="api-reference" tag="administration" />

## agent-chats

<ApiTagOperations source="api-reference" tag="agent-chats" />

## agent-connectors

<ApiTagOperations source="api-reference" tag="agent-connectors" />

## agent-sessions

<ApiTagOperations source="api-reference" tag="agent-sessions" />

## agents

<ApiTagOperations source="api-reference" tag="agents" />

## attendance

<ApiTagOperations source="api-reference" tag="attendance" />

## automations

<ApiTagOperations source="api-reference" tag="automations" />

## billing

<ApiTagOperations source="api-reference" tag="billing" />

## contacts

<ApiTagOperations source="api-reference" tag="contacts" />

## employees

<ApiTagOperations source="api-reference" tag="employees" />

## help-center

<ApiTagOperations source="api-reference" tag="help-center" />

## helpdesk

<ApiTagOperations source="api-reference" tag="helpdesk" />

## holidays

<ApiTagOperations source="api-reference" tag="holidays" />

## imports-management

<ApiTagOperations source="api-reference" tag="imports-management" />

## insights

<ApiTagOperations source="api-reference" tag="insights" />

## object-types

<ApiTagOperations source="api-reference" tag="object-types" />

## objects

<ApiTagOperations source="api-reference" tag="objects" />

## organizations

<ApiTagOperations source="api-reference" tag="organizations" />

## projects

<ApiTagOperations source="api-reference" tag="projects" />

## sales

<ApiTagOperations source="api-reference" tag="sales" />

## support

<ApiTagOperations source="api-reference" tag="support" />

## tags

<ApiTagOperations source="api-reference" tag="tags" />

## tasks

<ApiTagOperations source="api-reference" tag="tasks" />

## teams

<ApiTagOperations source="api-reference" tag="teams" />

## time

<ApiTagOperations source="api-reference" tag="time" />

## timebookings

<ApiTagOperations source="api-reference" tag="timebookings" />

## vacations

<ApiTagOperations source="api-reference" tag="vacations" />

## workspace

<ApiTagOperations source="api-reference" tag="workspace" />