Instantly Lead Data Governance

Overview

Map and constrain personal-data movement across lead ingestion, campaigns, webhooks, exports, logs, and deletion. Record assumptions, evidence, approval state, and rollback ownership so another operator can reproduce the result.

Prerequisites

• The target repository, Instantly workspace, environment, and accountable owner
• Current security, privacy, compliance, capacity, and change-control requirements
• An approved API v2 key only when a bounded live verification is necessary

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Instantly documentation and package metadata. Use Write or Edit only when implementation was requested and exact target files are known; never write credentials, lead data, email content, or unrestricted environment output.

Current Contract

• Lead payload values may be scalar values; nested arrays are not a safe assumed contract.
• Webhook payloads can contain lead and full reply/email content.
• Deletion and export behavior must be tied to customer policy and signed terms, not generic assumptions.

Authentication

Use an API v2 key as Authorization: Bearer <key> against https://api.instantly.ai/api/v2. Grant only the endpoint-specific scopes needed, inject the key from an approved server-side secret manager, and never print, persist, commit, or place it in a URL. Treat key creation, rotation, revocation, member changes, workspace delegation, and production access as owner-approved actions.

Instructions

1. Classify every input field, purpose, legal basis, retention owner, and downstream destination.
2. Map create, list, patch, export, webhook, and delete paths with exact scopes.
3. Minimize payloads and apply blocklist, consent, suppression, and deduplication controls before import.
4. Redact email bodies, reply text, API keys, and personal identifiers from logs and evidence.
5. Test access, correction, suppression, export, and deletion with synthetic records.
6. Require privacy and data-owner approval before production retention or deletion changes.

Approval Boundaries

Do not create, rotate, reveal, or revoke keys; invite or remove members; delegate across workspaces; connect sending accounts; create or activate campaigns; import or delete leads; change suppression or retention; register, patch, resume, or delete webhooks; alter plans or paid capacity; transmit diagnostics; or perform another production mutation without explicit approval from the accountable owner. Keep diagnosis read-only unless implementation was requested.

Output

Return the workspace-safe scope, files and contracts inspected, exact API v2 routes and required scopes, evidence collected, validation result, sensitive fields redacted, remaining risk, accountable owner, approval state, and rollback or next action.

Error Handling

Examples

Use a compact handoff that makes scope, mutation authority, and evidence reviewable.

Input:

dataset=synthetic-leads; fields=email,first_name; retention=policy-bound

Expected handoff:

flow=mapped; minimization=pass; production-change=awaiting-owner

Resources

• Skill-specific official documentation
• Instantly API v2 documentation
• Instantly API v2 OpenAPI document