Internal LOS apply endpoint for inbound sync

Shipped

July 10, 2026 at 2:02 AM UTC

Author

Kamo

Commit

c9ac442

POST **************** {leadUid, provider, loXmlFields} — server-to-server (no session/rights). Constant-time X-Internal-Auth check against the cluster internal-auth secret; missing/wrong header -> 403 before any lookup or mutation. Maps LO-XML via LoXmlFieldMapper.loXmlToLead and applies MeridianLink-wins via LeadService.applyLosPatch (which emits the realtime LEAD_UPDATED). Called by the DaemonService inbound poller.