Contract Changelog

v1.3

2026-07-09 · current — openapi/vendors-v1.3.json

Authentication is OAuth2 client-credentials against Microsoft Entra ID. The long-lived Archer-issued bearer token and its 90-day rotation cycle are replaced by short-lived JWTs fetched via the standard daemon flow. Tokens must carry the Leads.Post app role.
vendor_mismatch returns 403, not 400 — it's an authorization failure, not a payload problem.
Environment hosts are api-{env}.archerdmc.com: api-test, api-qa, and api (production). A live test environment is available today.
The receipt lead_id is a UUID string. The 202 body returns an opaque UUID, stable across retries; the disposition feed's archer_lead_id carries the same UUID.
The normalized envelope is the default integration path. Vendor-native formats remain available by arrangement.
schema_version is "1.3"; payloads on 1.0–1.2 remain accepted indefinitely.
Money guidance unchanged on the wire: cost.payout and friends remain decimal dollars in major currency units (13.00, not 1300), up to 4 decimal places accepted.

v1.2

2026-06-09 · superseded

Added the SmartFi HMAC-signed JSON path, the batch endpoint (POST /v1/leads/batch), and per-LOB attribute refinements.

Version pinning policy. This portal publishes one pinned OpenAPI artifact per contract version (currently openapi/vendors-v1.3.json). The artifact is regenerated from the deployed API code on every docs publish, but the contract only changes with a version bump announced here. Minor versions are additive — a 1.x integration never breaks. A future 2.0 would ship on a separate endpoint path (/v2/leads) with its own artifact. Questions: integrations@archerdmc.com.