GET /api/public/nexus/configReturns only the authenticated connection’s configuration, capabilities and limits. No raw events, contacts or keys.
Developer reference · Schema v1
Avexis AvLink API
Server-to-server collection for authorized product activity. Application keys never grant access to CRM records or investor data.
AvLink replaces the connector name only. Existing API URLs, the x-nexus-key header, SDK exports and saved connections remain unchanged. Do not replace a working key or change a sending app’s endpoint because of the rename. AvBroad remains separate marketing and lead generation.
Connection setup
- Use your existing connection unchanged. For a new customer-owned application, register it in Organization workspaces; administrator-managed connections use the AvLink Console. Save the one-time key only on the sending server.
- Record approved source rights in the Validation Lab and configure allowed origins, purposes, events and fields. New applications remain disabled until permissions are explicitly approved.
- Check configuration with GET /api/public/nexus/config using x-nexus-key, then forward only approved events from a server that verifies its caller and permissions. Organization-owned behavioral events require current application-submitted consent evidence first.
- Compare one authorized source action with its stored result. Repeat its event ID to verify duplicate suppression, then verify withdrawal, exclusions and application isolation before enabling a production feed. Never submit personal records.
Authentication & permissions
Send your product’s server-stored key in the x-nexus-key header over HTTPS. Each connection has its own source, allowed origins, purposes, events and fields. Collection starts disabled. Pause revokes use immediately; rotation replaces the old key; expiration stops both collection and configuration reads.
Permissions narrow the universal schema; they cannot add raw contact, tax, credit or health fields. Behavioral events require verified source-side consent. Operational events must be aggregate and separately enabled. AvBroad marketing delivery is not authorized by collection permissions.
Endpoints
POST /api/public/nexus/collectReceives { events: [...] }. Maximum 100 events and 262,144 bytes per request.
POST /api/public/nexus/collect?processing=asyncDurable processing. HTTP 202 reports queued, not accepted. Live permissions are checked again before storage; completed payloads are cleared. Processing starts within about one minute while work remains; transient failures retry up to three attempts.
POST /api/public/nexus/consentRequires x-nexus-key and { subject_ref, purpose, version, status, granted_at, expires_at }. Status: accepted or withdrawn. Lifetime: at most 180 days. Organization-owned behavioral collection requires current evidence for the same application, HMAC subject and purpose. Evidence is application-submitted, not independently verified. Withdrawal erases stored and queued subject events and blocks replay.
GET /api/public/enrichment/capabilitiesRequires an active, unexpired x-nexus-key. Returns disabled service definitions and activation requirements; no dataset is connected.
POST /api/public/enrichment/lookupRequires an active, unexpired x-nexus-key. Always returns 403 enrichment_not_authorized: identifiers are not read, stored or forwarded; no matches or charges. Collection keys never authorize lookups.
Production base: https://avexis-ai-venture-showcase.lovable.app
Example payload
{
"events": [
{
"event_id": "product-event-unique-id",
"event_name": "quote_requested",
"schema_version": 1,
"occurred_at": "2026-11-11T18:00:00Z",
"purpose": "analytics",
"consent_basis": "consent",
"origin": "job2q.web",
"properties": {
"industry": "construction",
"region": "US-OK"
},
"tracking": {
"mode": "behavioral",
"consent": "accepted",
"privacy_signal": false,
"traffic": "production"
}
}
]
}Event timestamps must be ISO UTC. Use a unique event ID per tenant. Repeating an ID counts as a duplicate, not another event. Never encode personal records in categorical fields.
Allowed vocabulary
Events: page_interest, inquiry_created, quote_requested, appointment_booked, bid_accepted, job_completed, transaction_completed.
Properties: industry, region, path, service_type, project_type, outcome, count. Paths must exclude query strings and personal identifiers. Individual connection allowlists may be smaller.
Purposes: analytics, market_intelligence. Region is coarse, for example US-OK. Operational events use contract, public_record or licensed basis and no subject reference.
Withdrawal & response handling
To withdraw, send a valid event envelope with tracking.consent set to withdrawn and the same tenant-scoped HMAC subject_ref. The API stores the withdrawal, removes subject events and blocks replays, even while collection is disabled. Never use an email or customer ID as the subject reference.
A successful batch returns accepted, duplicates and rejected (index and reason). HTTP 200 may contain rejected events: inspect every result. 400 means invalid JSON/batch, 401 invalid/paused/expired key, 413 oversized payload; 500/503 indicate unavailable storage or permission lookup. Retry server failures with backoff and the same event IDs; correct rejected inputs rather than retrying them indefinitely.
Product installation boundary
Each product must verify its own caller, tenant and real permissions before forwarding. Browser helpers use a same-origin relay without keys. Delegated access to a user’s private account requires a separately implemented OAuth integration; these keys are scoped machine credentials, not user sessions.
FileVault, Job2Q and PRVI installation and real source-feed verification remain required. No partner delivery, private-record read API or forecast is exposed by this connector.
Collection, configuration and consent share a limit of 60 authenticated requests per application per minute. HTTP 429 includes Retry-After: 60. Invalid credentials are denied before access; upstream denial-of-service protection still needs deployment verification.