API Reference

Base URL

https://www.pouncefirst.com/api

All API endpoints require authentication unless noted.

Authentication

Public form endpoints do not require an API token. Account and billing endpoints use your signed-in browser session.

Webhook Endpoints

These endpoints receive events from external providers.

Email Provider Callbacks

GET /api/auth/email/google/connect
GET /api/auth/email/google/callback
GET /api/auth/email/microsoft/connect
GET /api/auth/email/microsoft/callback

Routes reserved for mailbox-based email connections. In the account UI, Google and Outlook are marked unavailable while Resend (recommended), the Pounce sender, and SMTP are available.

Google redirect URL: https://www.pouncefirst.com/api/auth/email/google/callback

Microsoft redirect URL: https://www.pouncefirst.com/api/auth/email/microsoft/callback

Stripe Webhook

POST /api/stripe/webhook

Receives Stripe events for subscription management. Handles checkout completion, plan changes, and cancellations.

Form Endpoints

Submit Form

POST /api/forms/{form-slug}/submit

Submit a lead through a specific form. Accepts application/json or application/x-www-form-urlencoded.

Request body:

{
  "name": "Jane Smith",
  "email": "jane@example.com",
  "message": "I'm interested in your services"
}

Custom fields are included by their field name.

Form Embed Script

GET /forms/{form-slug}/embed.js

Returns a JavaScript snippet that renders the form with your configured styling.

Usage:

<div id="pounce-form"></div>
<script src="https://www.pouncefirst.com/forms/contact/embed.js"></script>

Form Embed HTML

GET /forms/{form-slug}/render

Returns the form as a standalone HTML page (for iframe embedding).

Account Endpoints

Account endpoints require session authentication.

Account Summary

GET /api/auth/account

Returns plan, usage, forms, recent leads, business profile, and email sender status.

Account Update

PATCH /api/auth/account

Updates business profile, selected form settings, and outbound email settings. Secret fields such as Resend API keys and SMTP passwords are write-only.

Create Form

POST /api/auth/account

Creates another hosted form when your plan includes more forms.

Partial response:

{
  "success": true,
  "profile": {},
  "emailSettings": {
    "provider": "resend",
    "resendConfigured": true
  }
}

Rate Limits

Endpoint	Limit
Form submissions	5/minute per IP
Signup	5/hour per IP
Login	10/15 minutes per IP
Checkout	5/minute per IP

Rate-limited requests receive a 429 Too Many Requests response with a Retry-After header.