# CM

> CM runs content marketing for a connected app: it publishes the blog,
> captures leads from it, and reports conversions to ad platforms.

A connected app registers once on this origin, then captures leads and
reports conversions on any brand domain — including the subscriber's
own site, because the subscribe form posts there. CM posts events
outward as they happen and stops. It does not run an inbox, book
appointments, or collect reviews.

## Calling CM

- `POST /api/v1/connected-apps` — Register a connected app
- `POST /cm/conversions` — Report a conversion
- `POST /blog/subscribe` — Capture a lead
- `GET /blog/subscribe/unsubscribe/{token}` — Unsubscribe a lead
- `GET /blog/lead-magnets/{slug}/download` — Download a lead magnet

Registration uses `Authorization: Bearer` with the platform key.
That key is issued out of band; this document does not create
operator accounts. Sign-in on the marketing site is Google OAuth,
not an API call.

Conversion postbacks authenticate in the body (`capi_token` or
`ref`), not a header. Lead capture is unauthenticated: the app is
resolved from the form fields.

## Being called by CM

Signed outbound webhooks. Verify `X-Webhook-Signature` (hex
HMAC-SHA256 of the raw body, keyed with the app's
`webhook_secret`) before trusting the payload. Deduplicate on
`delivery_id`.

- `lead.captured` — Someone asked to hear from the app
- `blog_post_publish` — A post was published to the app's blog
- `blog_post_delete` — A post was unpublished

## What this brief is not

- The operator dashboard, Google OAuth, first-party analytics
  beacons, and the inbound publisher receiver at `/webhooks/blog`
  are not the public contract.
- There is no HTML `/docs` explorer. The contract is
  [openapi.json](https://cm-bot.io/openapi.json).
- Pricing is not published here.

If a path or event is absent from the OpenAPI document, CM does
not offer it as a public integration.

## Links

- [OpenAPI 3.1 specification](https://cm-bot.io/openapi.json)
- [This brief](https://cm-bot.io/llms.txt)
- [Privacy](https://cm-bot.io/privacy)
- [Terms](https://cm-bot.io/terms)