Hot Prospector API V1 Documentation

Quickstart

Use one POST URL and put the endpoint name in the Method field. Replace YOUR_API_UID and YOUR_API_KEY with the values from the logged-in Custom API settings page.

1. Call LoginUser to verify credentials.
2. Call FetchAllTags to confirm authenticated data access.

{
  "api_uId": "YOUR_API_UID",
  "api_key": "YOUR_API_KEY",
  "Method": "LoginUser"
}

{
  "response": "true",
  "message": "Successfully Authenticated"
}

{
  "api_uId": "YOUR_API_UID",
  "api_key": "YOUR_API_KEY",
  "Method": "FetchAllTags"
}

[
  {
    "response": "true",
    "message": "All Tags fetched successfully",
    "tags": [
      {
        "TagId": "401074",
        "TagTitle": "new fb lead",
        "TagStatus": "Active"
      }
    ]
  }
]

Authentication

The public API uses api_uId and api_key in the request body. Code discovery shows most V1 methods authenticate independently via custom_api_model->member_authentication, so LoginUser is useful for testing credentials but is not required before every other call if credentials are included.

Keys are shown on the Custom API settings page and can be regenerated there. Regeneration updates hp_member.api_key.

Conventions

• Base URL: https://app.hotprospector.com/glu/custom_api
• HTTP method: all V1 calls are documented as POST.
• Router pattern: the Method body field selects the endpoint.
• Case sensitivity: use exact method and parameter casing, including legacy spellings like AddcustomField, Un_SubscribeLead, and api_uId.
• Content type: recommended application/json. Code also accepts form/request fields and a Data wrapper containing JSON.
• Unknown fields: no global reject logic was found; endpoints generally read known keys.

Response Envelope

Most successful and failed endpoint responses use a JSON object or a one-item JSON array with legacy string booleans: "response": "true" or "response": "false". Some response keys contain spaces, such as "Added TagId".

Errors

Most endpoint failures return HTTP 200 with response: "false" and a human-readable message. Code discovery also found controller-level missing/invalid Method errors that are printed as PHP arrays rather than normalized JSON.

{
  "response": "false",
  "message": "Invalid (api_uId or api_key)"
}

{
  "response": "false",
  "message": "Invalid (login email or password)/(api_uId or api_key)"
}

Array
(
    [message] => Sorry you cannot access page, Please provide required details.
)

Array
(
    [message] => Service you are trying to access is not available or provided information is incorrect!
)

{
  "response": "false",
  "message": "Invalid or missing required parameter"
}

Rate Limits

No rate-limit, 429, or Retry-After behavior was found in the inspected Custom API controller/helper path.

Pagination

Pagination is endpoint-specific. Some log/list methods accept limit and offset, while many existing examples do not show pagination. There is no universal has_more/next_offset envelope in the discovered code.

FetchCallTranscripts also accepts a cursor field in the discovered implementation/examples. Treat it as endpoint-specific pagination state, not a global V1 convention.

{
  "api_uId": "YOUR_API_UID",
  "api_key": "YOUR_API_KEY",
  "Method": "FetchCallTranscripts",
  "limit": 50,
  "cursor": 0
}

Dates & Time Zones

Dates are accepted as strings and compared by PHP/database code. Many outputs use legacy formats like Y-m-d H:i:s. Some call-log paths default to or convert through America/Los_Angeles.

Enums & Units Reference

Observed coded values include Active, Inactive, Deleted, show, completed, inbound, outbound, Yes, No, ASC, DESC, Manager, Member, Submanager, and Reseller. Durations such as duration and call_duration should be treated as seconds unless the endpoint says otherwise.

Versioning & Changelog

This is a V1 documentation rewrite draft for the currently published public API scope. It preserves legacy Method values and response quirks for accuracy.

This page covers exactly the 36 unique published V1 Method values found in the current public docs export. The export contained 37 endpoint blocks because FetchUserCallLog appeared twice. Code discovery also found 142 additional non-V1 methods; those are intentionally excluded from this V1 public contract.