Submit an inquiry

POST/api/v1/inquiries

scope inquiries:writeIdempotent

Records an inquiry — this is the endpoint to point a website contact form at. At least one of email or phone is required. Send any extra form fields in metadata; they are shown in the inbox and included in the CSV export. If the sender is on the account’s blocklist the inquiry is refused with 422 unprocessable and reason: "sender_blocked". Call it from your own server, not from browser JavaScript: an API key in a public page is readable by anyone who views the source. Send an Idempotency-Key header so a retry after a network blip does not create a second lead.

Body

application/json

Name	Type	Description
`name`required	`string`	Who sent it
`email`optional	`string (email) \| null`
`phone`optional	`string \| null`
`company`optional	`string \| null`
`topic`optional	`string`	Your own category — free text. Becomes a filter in the inbox.Default: `general`
`message`required	`string`	What they wrote
`source`optional	`string \| null`	Which form this came from, e.g. "Pricing page"
`source_path`optional	`string \| null`	The page path the form was on
`metadata`optional	`map<string, string \| number \| boolean \| null>`	Any additional form fields, verbatim: flat key/value pairs. Nested objects and arrays are rejected — join a multi-select into a string yourself.

Request

curl -X POST "https://your-crm.example.com/api/v1/inquiries" \
  -H "Authorization: Bearer $RAABTA_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6f1c2a9e-3b4d-4c5e-8f7a-9b0c1d2e3f4a" \
  -d '{
    "name": "Ayesha Khan",
    "email": "ayesha@example.com",
    "phone": "+971501234567",
    "company": "Khan Trading LLC",
    "topic": "Quote request",
    "message": "Do you cover Jumeirah? Looking for a quote for two units.",
    "source": "Pricing page",
    "source_path": "/pricing",
    "metadata": {
      "Budget": "AED 10,000–25,000",
      "Preferred contact": "WhatsApp",
      "Units": 2
    }
  }'

Response · 201 Created

{
  "data": {
    "id": "a3f1c2d4-5e6b-4f78-9a0b-1c2d3e4f5a6b",
    "status": "new",
    "topic": "Quote request",
    "name": "Ayesha Khan",
    "email": "ayesha@example.com",
    "phone": "+971501234567",
    "company": "Khan Trading LLC",
    "message": "Do you cover Jumeirah? Looking for a quote for two units.",
    "source": "Pricing page",
    "source_path": "/pricing",
    "metadata": {
      "Budget": "AED 10,000–25,000",
      "Preferred contact": "WhatsApp",
      "Units": 2
    },
    "first_touched_at": null,
    "created_at": "2026-09-02T10:05:00.000Z",
    "updated_at": "2026-09-02T10:05:00.000Z"
  }
}

Response

Wrapped in { data: … }

Name	Type	Description
`id`required	`string (uuid)`	UUID
`status`required	`string (enum)`	Where the inquiry sits in triage`newin_progressclosedspam`
`topic`required	`string`	Your own category for the inquiry — free text, e.g. "Billing"
`name`required	`string`	Who sent it
`email`required	`string \| null`	Sender email, lowercased; null if the form collected only a phone
`phone`required	`string \| null`	Sender phone; null if the form collected only an email
`company`required	`string \| null`	Sender company, when the form asks
`message`required	`string`	What they wrote
`source`required	`string \| null`	Which form this came from, e.g. "Pricing page"
`source_path`required	`string \| null`	The page path the form was on
`metadata`required	`map<string, string \| number \| boolean \| null>`	Any additional form fields, verbatim — flat key/value pairs. Shown in the inbox and included in the CSV export.
`first_touched_at`required	`string (date-time) \| null`	When someone first acted on it; null while untouched
`created_at`required	`string (date-time)`	ISO 8601 timestamp
`updated_at`required	`string (date-time)`	ISO 8601 timestamp

Errors

Status	Code	When
400	`bad_request`	The request could not be parsed: malformed JSON, an invalid cursor, or a query parameter of the wrong shape.
400	`validation_error`	The body or query failed validation. `details` lists each failing field with a `path` and a `message`.
401	`unauthorized`	No usable API key: the Authorization header is missing or malformed, or the key is unknown, revoked or expired. The three are deliberately indistinguishable.
403	`forbidden`	The key is valid but lacks the scope this endpoint requires, or the request came from an address outside the key’s IP allowlist. The message says which.
403	`account_suspended`	The account this key belongs to is suspended. Rotating the key will not help; contact support.
409	`conflict`	The request conflicts with current state: a duplicate phone number on create, an invalid state transition, or an idempotent request that is still in flight.
422	`unprocessable`	The request was well-formed but cannot be carried out. `reason` is a stable string saying why (for example `outside_window` or `stage_not_in_pipeline`).
429	`rate_limited`	The per-key budget, or the per-IP budget for failed authentication, is exhausted. Honour `Retry-After` before retrying.
500	`internal`	Something failed on our side. Safe to retry with the same Idempotency-Key; quote `request_id` if it persists.