Build on the routing fabric.

curl -X POST https://connex.is/api/v1/leads/ingest \
  -H "X-API-Key: $CONNEXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sector": "mortgages",
    "first_name": "James",
    "last_name": "Patel",
    "email": "j.patel@example.co.uk",
    "phone": "+447712345678",
    "postcode": "SW1A 1AA",
    "consent_token": "ct_abc123",
    "consent_at": "2026-02-09T07:42:18Z",
    "ip": "203.0.113.42",
    "extra_fields": { "property_value_gbp": 350000, "deposit_gbp": 70000 }
  }'

import fetch from "node-fetch";

const res = await fetch("https://connex.is/api/v1/leads/ingest", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.CONNEXIS_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    sector: "mortgages",
    first_name: "James",
    last_name: "Patel",
    email: "j.patel@example.co.uk",
    phone: "+447712345678",
    postcode: "SW1A 1AA",
    consent_token: "ct_abc123",
    consent_at: new Date().toISOString(),
    extra_fields: { property_value_gbp: 350000, deposit_gbp: 70000 },
  }),
});

const result = await res.json();
console.log(result);

import os, requests

r = requests.post(
    "https://connex.is/api/v1/leads/ingest",
    headers={"X-API-Key": os.environ["CONNEXIS_API_KEY"]},
    json={
        "sector": "mortgages",
        "first_name": "James",
        "last_name":  "Patel",
        "email":      "j.patel@example.co.uk",
        "phone":      "+447712345678",
        "postcode":   "SW1A 1AA",
        "consent_token": "ct_abc123",
        "consent_at":    "2026-02-09T07:42:18Z",
        "extra_fields": {"property_value_gbp": 350000, "deposit_gbp": 70000},
    },
    timeout=10,
)
r.raise_for_status()
print(r.json())

import crypto from "node:crypto";

// Verify an inbound Connexis webhook (Stripe-style HMAC).
function verifyConnexisSignature(secret, rawBody, header, toleranceSec = 300) {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map(kv => kv.split("=")));
  if (!parts.t || !parts.v1) return false;
  // Reject anything older than tolerance — defeats replays
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(parts.t)) > toleranceSec) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

import hmac, hashlib, time

def verify_connexis_signature(secret: str, raw_body: bytes, header: str, tolerance_sec: int = 300) -> bool:
    """Verify Connexis webhook signature (Stripe-style)."""
    if not header:
        return False
    parts = dict(kv.split("=", 1) for kv in header.split(",") if "=" in kv)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        return False
    if abs(int(time.time()) - int(t)) > tolerance_sec:
        return False  # stale or replay
    signing_input = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signing_input, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)