> ## Documentation Index > Fetch the complete documentation index at: https://docs.fundor.io/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Fundor Partner API. NON-NEGOTIABLE CONSENT RULES for anyone (human or AI) writing code against this API: (1) Call GET /consent every time the referral form is shown and display consent.text EXACTLY, next to a checkbox that starts UNCHECKED. (2) Only the person whose phone number is entered may check it; never pre-check it, never set consent.given=true in code without that click, never submit a lead on someone's behalf. (3) POST /leads must include consent.given=true, consent.version, the single-use consent.token, consent.consentedAt (within 15 minutes), the person's own IP and user agent (not your server's), consent.phone equal to contact.phone, and your consent.recordId. Fundor rejects the lead with 400 and saves nothing if any is missing or wrong. Do not 'fix' a consent error by filling in values; fix the form. (4) Keep consent records for 5 years. (5) Keep API keys on your server only. (6) Show the 'Powered by Fundor' badge on every screen that uses Fundor. # Create or link a Fundor account > Creates a Fundor account attributed to you. The person can later sign in at fundor.io with an email code sent to this address (no password). If a Fundor account already uses this email, nothing is created and no account data is returned: you get `202 link_pending` with an `approvalUrl`. The account becomes usable by you only after its owner approves. Requires the `users` scope. ## OpenAPI ````yaml /openapi.json post /users openapi: 3.1.0 info: title: Fundor Partner API version: 1.0.0 description: >- Send sign-ups, teams, applications and referrals (leads) into Fundor from your own app. Every record is attributed to your partner account. **Read the Consent requirements page before you build: a lead without full consent evidence is rejected and never saved.** contact: name: Fundor partnerships email: taylor@fundor.io servers: - url: https://www.fundor.io/api/v1 description: Production security: - apiKey: [] tags: - name: Consent & services - name: Users - name: Teams - name: Leads - name: Applications paths: /users: post: tags: - Users summary: Create or link a Fundor account description: >- Creates a Fundor account attributed to you. The person can later sign in at fundor.io with an email code sent to this address (no password). If a Fundor account already uses this email, nothing is created and no account data is returned: you get `202 link_pending` with an `approvalUrl`. The account becomes usable by you only after its owner approves. Requires the `users` scope. operationId: createUser requestBody: required: true content: application/json: schema: type: object required: - externalRef - email - firstName - lastName properties: externalRef: type: string minLength: 1 maxLength: 200 pattern: ^[\w.:@-]+$ description: >- Your own ID for this record (letters, numbers, `. _ : @ -`). Required. Sending the same externalRef again never creates a second record; Fundor returns the first one. email: type: string format: email firstName: type: string maxLength: 100 lastName: type: string maxLength: 100 phone: type: string description: Optional 10-digit US number. example: externalRef: vai-user-48213 email: jordan@example.com firstName: Jordan lastName: Lee phone: 555-201-0000 responses: '200': description: >- Already created or linked for this externalRef/email. Nothing new was created. content: application/json: schema: $ref: '#/components/schemas/User' '201': description: Account created. content: application/json: schema: $ref: '#/components/schemas/User' example: status: created userId: 5d1c… email: jordan@example.com signInUrl: https://www.fundor.io/sign-in duplicate: false '202': description: >- An account with this email exists. Its owner must approve at `approvalUrl`. content: application/json: schema: $ref: '#/components/schemas/LinkPending' '400': description: >- Invalid request. `error.field` names the field to fix. Possible `error.code` values: `invalid_request`, `missing_field`, `invalid_json`, `body_too_large`. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- Missing, unknown or revoked API key. Possible `error.code` values: `missing_api_key`, `invalid_api_key`, `revoked_api_key`. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Partner suspended, current agreement not signed, missing scope, or the record isn't yours. Possible `error.code` values: `partner_suspended`, `agreement_required`, `insufficient_scope`, `forbidden`. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- externalRef already used for a different email, or a sign-in exists for this email without a finished account. Possible `error.code` values: `external_ref_conflict`, `account_exists_unfinished`. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Over this key's per-minute rate limit. Possible `error.code` values: `rate_limited`. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: >- Unexpected error. Safe to retry with the same externalRef. Possible `error.code` values: `server_error`. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: User: type: object properties: status: type: string enum: - created - linked userId: type: string format: uuid email: type: string signInUrl: type: string format: uri duplicate: type: boolean LinkPending: type: object properties: status: type: string const: link_pending linkRequestId: type: string format: uuid approvalUrl: type: string format: uri description: >- Send the person here (button or link in your app). They sign in to Fundor as themselves and approve or decline. Safe to show: only the account owner can approve. approvalEmailSent: type: boolean description: Whether Fundor also emailed the approval link. expiresAt: type: string format: date-time Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string description: Stable machine-readable code. message: type: string description: Human-readable explanation. May change. field: type: string description: >- The request field at fault, when there is one (e.g. `consent.ip`). requiredVersion: type: string description: >- Only on `agreement_required`: the agreement version Fundor needs on file. example: error: code: consent_required message: consent.ip is required. Fundor will reject the lead without it. field: consent.ip securitySchemes: apiKey: type: http scheme: bearer bearerFormat: fnd_live_… description: >- Your partner API key, sent as `Authorization: Bearer fnd_live_…`. Keys are issued by Fundor on request. Keep them on your server; never ship one in a mobile or browser app. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.