Connect your own systems

curl https://api.contactformoutreach.com/v1/me \  -H "Authorization: Bearer $API_KEY"

const res = await fetch("https://api.contactformoutreach.com/v1/me", {  headers: { Authorization: `Bearer ${process.env.API_KEY}` },});const me = await res.json();console.log(me);

Authorization: Bearer <your key>

# 1. Read what you are approving: the wording and a fingerprint of the listcurl https://api.contactformoutreach.com/v1/campaigns/$CAMPAIGN_ID/signoff \  -H "Authorization: Bearer $API_KEY"# 2. Approve it: send back the wording and list_hash you were givencurl -X POST https://api.contactformoutreach.com/v1/campaigns/$CAMPAIGN_ID/signoff \  -H "Authorization: Bearer $API_KEY" \  -H "Content-Type: application/json" \  -H "Idempotency-Key: signoff-$CAMPAIGN_ID-$LIST_HASH" \  -d '{"wording": "<the wording you showed>", "list_hash": "<list_hash>"}'# 3. Send it. The answer names the job that does the workcurl -X POST https://api.contactformoutreach.com/v1/campaigns/$CAMPAIGN_ID/send \  -H "Authorization: Bearer $API_KEY" \  -H "Idempotency-Key: send-$CAMPAIGN_ID"

const api = async (path, init = {}) => {  const res = await fetch(`https://api.contactformoutreach.com/v1${path}`, {    ...init,    headers: {      Authorization: `Bearer ${process.env.API_KEY}`,      "Content-Type": "application/json",      ...init.headers,    },  });  const body = await res.json();  if (!res.ok) throw new Error(`${body.error.message} (${body.error.request_id})`);  return body;};// 1. Read what you are approving: the wording and a fingerprint of the list.const signoff = await api(`/campaigns/${id}/signoff`);// 2. Approve exactly that list. Needs the sign_off scope.await api(`/campaigns/${id}/signoff`, {  method: "POST",  headers: { "Idempotency-Key": `signoff-${id}-${signoff.list_hash}` },  body: JSON.stringify({ wording: signoff.wording, list_hash: signoff.list_hash }),});// 3. Send. Needs the send scope. The answer names the job that does the work.const job = await api(`/campaigns/${id}/send`, {  method: "POST",  headers: { "Idempotency-Key": `send-${id}` },});

curl https://api.contactformoutreach.com/v1/campaigns \  -H "Authorization: Bearer $API_KEY" \  -H "Content-Type: application/json" \  -H "Idempotency-Key: 3f9b6c1e-2d4a-4c8e-9a71-5b0e2f6d8c13" \  -d '{    "name": "Dental clinics, Germany",    "keywords": ["dental clinic"],    "country": "DE",    "language": "de",    "send_enquiries": true  }'

// Make the key once per action and keep it, so a retry sends the same one.const idempotencyKey = crypto.randomUUID();const res = await fetch("https://api.contactformoutreach.com/v1/campaigns", {  method: "POST",  headers: {    Authorization: `Bearer ${process.env.API_KEY}`,    "Content-Type": "application/json",    "Idempotency-Key": idempotencyKey,  },  body: JSON.stringify({    name: "Dental clinics, Germany",    keywords: ["dental clinic"],    country: "DE",    language: "de",    send_enquiries: true,  }),});const { campaign_id } = await res.json();

curl "https://api.contactformoutreach.com/v1/campaigns?limit=50&offset=100" \  -H "Authorization: Bearer $API_KEY"

const all = [];for (let offset = 0; ; ) {  const res = await fetch(`https://api.contactformoutreach.com/v1/campaigns?limit=200&offset=${offset}`, {    headers: { Authorization: `Bearer ${process.env.API_KEY}` },  });  const { campaigns, page } = await res.json();  all.push(...campaigns);  offset += campaigns.length;  // A short page is the last one. total can be null, so do not rely on it.  if (campaigns.length < page.limit) break;}

{  "campaigns": [ ... ],  "page": { "limit": 50, "offset": 100, "total": 312 },  "request_id": "req_k3x9q2ab_7hd4pw"}

{  "error": {    "code": "FORBIDDEN",    "message": "This key is not allowed to do that.",    "status": 403,    "timestamp": "2026-10-09T10:30:00Z",    "request_id": "req_k3x9q2ab_7hd4pw"  }}

# -i shows the headers of the answercurl -i https://api.contactformoutreach.com/v1/me \  -H "Authorization: Bearer $API_KEY"# X-RateLimit-Limit: ...# X-RateLimit-Remaining: ...# X-RateLimit-Reset: ...

// Wait as long as Retry-After says, then send the same request again,// with the same Idempotency-Key, so the work is still done only once.async function call(url, init) {  for (;;) {    const res = await fetch(url, init);    if (res.status !== 429) return res;    const seconds = Number(res.headers.get("Retry-After")) || 1;    await new Promise((done) => setTimeout(done, seconds * 1000));  }}

curl https://api.contactformoutreach.com/v1/webhook-endpoints \  -H "Authorization: Bearer $API_KEY" \  -H "Content-Type: application/json" \  -H "Idempotency-Key: 0b7e7c52-crm-sync-endpoint" \  -d '{    "url": "https://example.com/hooks/outreach",    "event_types": ["campaign.discovered", "target.submitted", "response.recorded"],    "description": "CRM sync"  }'

const res = await fetch("https://api.contactformoutreach.com/v1/webhook-endpoints", {  method: "POST",  headers: {    Authorization: `Bearer ${process.env.API_KEY}`,    "Content-Type": "application/json",    "Idempotency-Key": crypto.randomUUID(),  },  body: JSON.stringify({    url: "https://example.com/hooks/outreach",    event_types: ["campaign.discovered", "target.submitted", "response.recorded"],    description: "CRM sync",  }),});// The signing secret is in this answer only. Store it now.const { id, secret } = await res.json();

{  "id": "8d2f6a90-3c1b-4e57-9f0a-6b2d1c7e4a53",  "type": "campaign.attested",  "timestamp": "2026-10-09T10:30:00Z",  "data": {    "object": "campaign",    "id": "123e4567-e89b-12d3-a456-426614174000",    "campaign_id": "123e4567-e89b-12d3-a456-426614174000",    "kind": null,    "state": "attested",    "previous_state": "discovered"  }}

import { createHmac, timingSafeEqual } from "node:crypto";// rawBody is the request body exactly as it arrived, before any JSON parsing.export function verify(rawBody, headers, secret) {  const id = headers["webhook-id"];  const timestamp = headers["webhook-timestamp"];  // Refuse events older than five minutes, so an old one cannot be replayed.  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;  const expected = createHmac("sha256", secret)    .update(`${id}.${timestamp}.${rawBody}`)    .digest();  // While an old secret still works, an event carries one signature per secret.  return (headers["webhook-signature"] || "").split(" ").some((entry) => {    const given = Buffer.from(entry.split(",")[1] || "", "base64");    return given.length === expected.length && timingSafeEqual(given, expected);  });}