Instantly Bounded First Request

Instantly Bounded First Request

Overview

Prove a new Instantly integration with the smallest safe request and a redacted evidence handoff. Record assumptions, evidence, approval state, and rollback ownership so another operator can reproduce the result.

Prerequisites

• The target repository, Instantly workspace, environment, and accountable owner
• Current security, privacy, compliance, capacity, and change-control requirements
• An approved API v2 key only when a bounded live verification is necessary

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Instantly documentation and package metadata. Use Write or Edit only when implementation was requested and exact target files are known; never write credentials, lead data, email content, or unrestricted environment output.

Current Contract

• The API v2 base URL is https://api.instantly.ai/api/v2.
• Authorization uses an API v2 key as a Bearer token.
• A 401, 403, or 429 must fail the smoke test rather than trigger mutation or broad retries.

Authentication

Use an API v2 key as Authorization: Bearer <key> against https://api.instantly.ai/api/v2. Grant only the endpoint-specific scopes needed, inject the key from an approved server-side secret manager, and never print, persist, commit, or place it in a URL. Treat key creation, rotation, revocation, member changes, workspace delegation, and production access as owner-approved actions.

Instructions

1. Confirm the target workspace and create a read-only key with accounts:read or campaigns:read.
2. Store the key in a server-side environment variable and never print it.
3. Send one list request with a limit no greater than five.
4. Validate HTTP status and expected collection/pagination fields.
5. Capture latency, status, route template, and redacted item count.
6. Stop after the proof; do not create, patch, activate, or delete resources.

Approval Boundaries

Do not create, rotate, reveal, or revoke keys; invite or remove members; delegate across workspaces; connect sending accounts; create or activate campaigns; import or delete leads; change suppression or retention; register, patch, resume, or delete webhooks; alter plans or paid capacity; transmit diagnostics; or perform another production mutation without explicit approval from the accountable owner. Keep diagnosis read-only unless implementation was requested.

Output