> ## Documentation Index
> Fetch the complete documentation index at: https://crm-social.exuratech.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoint reference

> Operational summary of the routes available to the CRM backend.

## API base URL

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
https://social-api.example.com
```

All routes require:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer YOUR_CRM_API_KEY
```

## Identity

| Method | Path | Primary identifier |
| - | - | - |
| `POST` | `/api/v1/sso/start` | `external_reference` in the body. |
| `PATCH` | `/api/v1/users/password` | `external_reference` in the body. |

## Branches

| Method | Path | Primary identifier |
| - | - | - |
| `POST` | `/api/v1/branches/sync` | External branch `id` in the body. |

## Account webhook administration

These routes require a CRM API key with administrative scope.

| Method | Path | Purpose |
| - | - | - |
| `POST` | `/api/v1/integrations/crm/account-webhook` | Register the single account-event destination and receive its signing secret. |
| `GET` | `/api/v1/integrations/crm/account-webhook` | Retrieve the current destination without exposing the signing secret. |
| `PATCH` | `/api/v1/integrations/crm/account-webhook` | Update the name or URL, or set `ACTIVE`/`DISABLED`. |
| `POST` | `/api/v1/integrations/crm/account-webhook/rotate-secret` | Replace the HMAC signing secret and return it once. |
| `GET` | `/api/v1/integrations/crm/account-webhook/events` | List delivery attempts by status with cursor pagination. |
| `POST` | `/api/v1/integrations/crm/account-webhook/events/{event_db_id}/retry` | Requeue an event that is not already delivered. |

## Wallet

| Method | Path | Idempotency |
| - | - | - |
| `GET` | `/api/v1/wallet/external/account` | Not applicable. |
| `POST` | `/api/v1/wallet/external/deposit` | Required through `idempotency_key`. |
| `POST` | `/api/v1/wallet/external/withdrawal` | Required through `idempotency_key`. |

## Common values

| Field | Value or rule |
| - | - |
| `external_reference` | Unique, stable ID controlled by the CRM. |
| `branch_id` | External CRM branch ID; used in SSO after synchronization. |
| `wallet_code` | `PAMM_SOCIAL_USD` for this integration. |
| `currency` | `USD` for this integration. |
| `amount` | Positive decimal sent as a string. |
| `idempotency_key` | Unique per movement and reused for retries. |

## Recommended order

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
synchronize branches -> migration confirmed by ExuraCopy Support -> SSO with branch_id
                     -> wallet lookup -> deposit or withdrawal -> new lookup
                     -> register the account webhook -> receive social.account.created
```

## Outbound webhook

| Direction | Event | Identifier |
| - | - | - |
| ExuraCopy → CRM | `social.account.created` | `event_id` in the header and body. |

Register the receiver through `POST /api/v1/integrations/crm/account-webhook`. The `signing_secret` is returned only during registration or rotation and must be stored immediately. Only one destination is supported per environment; an additional registration returns `409`.

> [!NOTE]
>
> This reference describes the external integration contract. ExuraCopy's internal administration, ledger, and operational logic endpoints are outside the scope of this guide.

> [card] [Previous: Errors](https://crm-social.exuratech.com/reliability/errors.md)
>
> Return to error handling and recovery.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.