REST, webhooks, MCP.

Who am I — identity, tier, credits, XP, streak, token scopes

Works with ANY valid token (no scope required). Cheap; MCP clients call it for context.

curl https://app.dealarena.io/api/v1/me \
  -H "Authorization: Bearer da_live_…"

List/search prospects

curl https://app.dealarena.io/api/v1/prospects \
  -H "Authorization: Bearer da_live_…"

Create a prospect

curl -X POST https://app.dealarena.io/api/v1/prospects \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Bulk-create up to 100 prospects

Per-item results — failed rows are reported by index, valid rows are still created. Awards no XP (parity with CSV import).

curl -X POST https://app.dealarena.io/api/v1/prospects/bulk \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Get one prospect

curl https://app.dealarena.io/api/v1/prospects/{pid} \
  -H "Authorization: Bearer da_live_…"

Update prospect fields

curl -X PUT https://app.dealarena.io/api/v1/prospects/{pid} \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Move a prospect to the Trash (soft delete)

Sets `deleted_at` — the prospect lands in the in-app Trash (/database/trash), restores cleanly, and is hard-purged only by the 30-day worker. No API code path hard-deletes.

curl -X DELETE https://app.dealarena.io/api/v1/prospects/{pid} \
  -H "Authorization: Bearer da_live_…"

Move a prospect through the pipeline

Same validation, XP award, activity log, and webhook emission as the UI kanban drag. Honors the tenant's custom pipeline stage keys; an invalid key returns `validation_failed` naming the valid keys.

curl -X PATCH https://app.dealarena.io/api/v1/prospects/{pid}/stage \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

List deals (prospects in deal-stage statuses)

curl https://app.dealarena.io/api/v1/deals \
  -H "Authorization: Bearer da_live_…"

Get one deal

curl https://app.dealarena.io/api/v1/deals/{pid} \
  -H "Authorization: Bearer da_live_…"

Update deal fields

curl -X PUT https://app.dealarena.io/api/v1/deals/{pid} \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Log an activity (call / meeting / note / email)

Writes the identical `activity_log` row shape the UI writes, so profile feeds and the connected-call filter pick API rows up. Awards no XP (UI parity).

curl -X POST https://app.dealarena.io/api/v1/activities \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

List my tasks

User-scoped (the token owner's tasks). The in-app list view is workspace-shared; this endpoint is deliberately "my tasks".

curl https://app.dealarena.io/api/v1/tasks \
  -H "Authorization: Bearer da_live_…"

Create a task

Awards the same `task_added` XP as the UI.

curl -X POST https://app.dealarena.io/api/v1/tasks \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Complete (or reopen) a task

`{"done": true}` completes; XP (`task_completed`) fires only on the open→completed transition — idempotent replays award nothing.

curl -X PATCH https://app.dealarena.io/api/v1/tasks/{task_id} \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Pipeline summary — per-stage counts, TCV totals, deltas, stale callouts

curl https://app.dealarena.io/api/v1/pipeline/summary \
  -H "Authorization: Bearer da_live_…"

Draft outreach for a prospect (1 credit)

Charges exactly 1 credit through the same meter as the UI — token traffic gets zero discount. At zero credits returns 402 `credits_exhausted` and burns nothing. Output capped at 300 tokens.

curl -X POST https://app.dealarena.io/api/v1/outreach/draft \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

List/search companies (accounts)

curl https://app.dealarena.io/api/v1/companies \
  -H "Authorization: Bearer da_live_…"

Get one company + its linked prospects

curl https://app.dealarena.io/api/v1/companies/{account_id} \
  -H "Authorization: Bearer da_live_…"

The Sauce — market/news signals + Daily Sauce Leads

`feed=market` (SEC/Polymarket events) · `feed=news` (GNews mentions) · `feed=leads` (latest Daily Sauce Leads snapshot).

curl https://app.dealarena.io/api/v1/sauce \
  -H "Authorization: Bearer da_live_…"

List my sequences

curl https://app.dealarena.io/api/v1/sequences \
  -H "Authorization: Bearer da_live_…"

Enroll a prospect in a sequence

Identical to in-app enrollment — tier gate (free tier is refused), solo cap, start-node resolution, executor signal, and the `sequence.enrolled` trigger. Re-enrolling an active enrollment returns `reused true`.

curl -X POST https://app.dealarena.io/api/v1/sequences/{sid}/enroll \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Ask an agent (launch allowlist — legion, 5 credits)

BDM Legion is the first agent behind this endpoint. `context` may pin a `member_id`, `prospect_id`, or one of Legion's task types (research | draft_email | follow_up | objection_handling | call_prep); otherwise your first active member free-runs the prompt. An unknown agent returns `validation_failed` naming the available agents.

curl -X POST https://app.dealarena.io/api/v1/agents/ask \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

List Legion members

curl https://app.dealarena.io/api/v1/legion \
  -H "Authorization: Bearer da_live_…"

Get one Legion member

curl https://app.dealarena.io/api/v1/legion/{mid} \
  -H "Authorization: Bearer da_live_…"

List webhook subscriptions

curl https://app.dealarena.io/api/v1/webhooks \
  -H "Authorization: Bearer da_live_…"

Create a webhook subscription

The signing `secret` is returned once at creation. Deliveries are signed `X-DealArena-Signature: t=...,v1=...` (HMAC-SHA256). The `url` must be `https://` on a publicly routable host. Private, loopback, link-local and cloud-metadata addresses are rejected at registration and again at delivery time, so a hostname that later resolves to one of them is dropped rather than delivered. Redirects are not followed — respond `2xx` at the URL you register.

curl -X POST https://app.dealarena.io/api/v1/webhooks \
  -H "Authorization: Bearer da_live_…" \
  -H "Content-Type: application/json"

Revoke a webhook subscription

curl -X DELETE https://app.dealarena.io/api/v1/webhooks/{wid} \
  -H "Authorization: Bearer da_live_…"