> ## Documentation Index > Fetch the complete documentation index at: https://dev.gojiberry.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get all excluded contacts with pagination and search > Excluded contacts are people your agents must never import again. A contact is excluded when it is deleted (from the platform or with DELETE /v1/contact/{id}): its LinkedIn profile URL, LinkedIn member ID and email, when known, are kept in your excluded contacts. The Lead sources agents skip any lead matching one of them, and POST /v1/contact refuses to create it again (CONTACT_ALREADY_EXCLUDED). Use this route to find the exclusions of a person, then DELETE /v1/excluded-contact/{id} each of them to allow the person to be imported again. A person can be covered by several exclusions (for example one holding their profile URL and another their email), and stays blocked while any of them remains: pass every identifier you know (identifier, profileId, email) to find them all. When several filters are provided, an exclusion matching any of them is returned. Results are sorted from the most recent exclusion to the oldest. ## OpenAPI ````yaml GET /v1/excluded-contact openapi: 3.0.0 info: title: Gojiberry AI - External API description: >- # Gojiberry AI External API This API allows you to programmatically access your Gojiberry AI data and integrate it with your applications. ## How it works Gojiberry runs your outreach as a pipeline of three building blocks: 1. **Source agent — the lead finder.** A source agent continuously sources leads matching your targeting criteria (job titles, industries, locations, signals, ...) and scores them with AI. 2. **List — where the leads land.** Every source agent is linked to a list (`listId` is required when creating an agent): the leads it finds are imported as contacts into that list. Lists can also be filled by importing contacts yourself. 3. **Campaign — the outreach.** A campaign uses one or more lists as its lead source (`listIds` is required when creating a campaign) and runs its steps (LinkedIn invitations, messages, emails, ...) on the contacts of those lists, sending through your LinkedIn and/or email seats. Once activated, the campaign runs the outreach automatically on a daily basis. **Terminology.** In the Gojiberry platform, an **Agent** is a *campaign agent* — the campaign that performs the outreach. A **source agent** is the lead finder that sources the leads. The two are linked through a **list**: the source agent imports the leads it finds into the list, and the campaign agent reaches out to the contacts of that list. **Best practice: create a Full Cycle agent.** Always create the three resources in this order — first the list, then the source agent that fills it, then the campaign that reaches out to it. Together, the list + source agent + campaign agent form a **Full Cycle agent**: leads are sourced and outreached automatically, end to end. If you create a source agent without a campaign agent, it shows up as a **legacy agent** in the platform: it only sources leads and does **no outreach**. So it's best practice to always create all three. A typical setup through the API: ```text POST /v1/list # 1. create the list POST /v1/agent # 2. create the source agent (lead finder) linked to that list (listId) POST /v1/campaign # 3. create the campaign agent using that list as lead source (listIds) GET /v1/campaign/{id}/logs # 4. follow the outreach activity ``` ## Authentication All API requests require authentication using a Bearer token. To get your API key: 1. **Log in to your Gojiberry AI account** at [https://app.gojiberry.ai](https://app.gojiberry.ai) 2. **Navigate to Settings** → **API** section 3. **Click "Create API Key"** to generate a new token 4. **Copy the API key** when it's displayed (you won't be able to see it again) 5. **Use the token** in your requests by adding the header: `Authorization: Bearer YOUR_API_KEY` ## Impersonation (organization owners) If your API key belongs to the **owner of an organization**, you can perform any API call on behalf of another member of your organization by adding the `x-impersonate-user-id` header with the member's user ID: ```bash # Get the contacts of the organization member with user ID 123 curl -H "Authorization: Bearer YOUR_API_KEY" \ -H "x-impersonate-user-id: 123" \ https://ext.gojiberry.ai/v1/contact ``` When impersonating, the request behaves exactly as if it was made by that member: you read and write their data (contacts, campaigns, lists, unibox, etc.). Rules: - Your API key must belong to the **organization owner**; other members cannot impersonate. - The impersonated user must belong to the **same organization** as the API key user. - Requests that don't meet these rules are rejected with a `401 Unauthorized`. Tip: use `GET /v1/organization/members` to list the members of your organization and their user IDs, and `GET /v1/user/me` to verify which user the current request acts as. ## Rate Limits - **100 requests per minute** per account. Short bursts above this are tolerated. - **100,000 requests per day** per account. - Limits are shared by all API keys and AI app (MCP) connections of the same user, including calls made on behalf of organization members with `x-impersonate-user-id`. - Requests over a limit return `429 Too Many Requests` with a `Retry-After` header (in seconds). Wait that long before retrying. - Some endpoints have their own lower limit, stated in their description. ## Base URL - **Production**: `https://ext.gojiberry.ai` ## Endpoints ### Contacts - `GET /v1/contact` - Get all contacts with filtering and pagination - `GET /v1/contact/{id}` - Get a specific contact - `GET /v1/contact/health` - Health check endpoint ## Example Usage ```bash # Get all contacts curl -H "Authorization: Bearer YOUR_API_KEY" \ https://ext.gojiberry.ai/v1/contact # Get contacts with filtering curl -H "Authorization: Bearer YOUR_API_KEY" \ "https://ext.gojiberry.ai/v1/contact?search=john&agent=1&dateFrom=2024-01-01" # Get a specific contact curl -H "Authorization: Bearer YOUR_API_KEY" \ https://ext.gojiberry.ai/v1/contact/123 ``` ## Webhooks Gojiberry allows you to receive real-time notifications when new contacts are created or updated by configuring a webhook URL. ### How to Configure Webhooks 1. **Log in to your Gojiberry AI account** at [https://app.gojiberry.ai](https://app.gojiberry.ai) 2. **Navigate to the Integrations page** at [https://app.gojiberry.ai/integrations](https://app.gojiberry.ai/integrations) 3. **Add a Webhook integration** by clicking the Webhook option 4. **Enter your webhook URL** where you want to receive notifications 5. **Save the configuration** Once configured, Gojiberry will send POST requests to your webhook URL whenever: - A new contact is created - A contact is updated - Other relevant events occur in your account The webhook payload will include the full contact data in JSON format. Each webhook request includes a custom header `x-gojiberry-user-id` containing your user ID for verification purposes. ### Verifying Webhook Signatures (optional) You can optionally configure a signing secret on your Webhook integration. When a secret is set, every webhook request also includes: - `x-gojiberry-timestamp`: the Unix timestamp (in seconds) at which the request was sent - `x-gojiberry-signature`: `sha256=` followed by the hex-encoded HMAC-SHA256 of `{timestamp}.{rawBody}` computed with your signing secret To verify a request: 1. Read the raw request body as a string (do not re-serialize parsed JSON). 2. Concatenate the value of `x-gojiberry-timestamp`, a `.` character, and the raw body. 3. Compute the HMAC-SHA256 of that string using your signing secret, hex-encoded, and prefix it with `sha256=`. 4. Compare it to `x-gojiberry-signature` using a constant-time comparison. 5. Reject requests whose timestamp is too old (we recommend a 5 minute tolerance) to prevent replay attacks. Example in Node.js: ```js const crypto = require('crypto'); function verifyGojiberrySignature(rawBody, headers, secret) { const timestamp = headers['x-gojiberry-timestamp']; const signature = headers['x-gojiberry-signature']; if (!timestamp || !signature) return false; if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(timestamp + '.' + rawBody).digest('hex'); return expected.length === signature.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature)); } ``` If no signing secret is configured, these headers are not sent. ## Support For API support, please contact us at [hello@gojiberry.ai](mailto:hello@gojiberry.ai) version: '1.0' contact: {} servers: - url: https://ext.gojiberry.ai description: Production security: [] tags: [] paths: /v1/excluded-contact: get: tags: - Excluded Contacts summary: Get all excluded contacts with pagination and search description: >- Excluded contacts are people your agents must never import again. A contact is excluded when it is deleted (from the platform or with DELETE /v1/contact/{id}): its LinkedIn profile URL, LinkedIn member ID and email, when known, are kept in your excluded contacts. The Lead sources agents skip any lead matching one of them, and POST /v1/contact refuses to create it again (CONTACT_ALREADY_EXCLUDED). Use this route to find the exclusions of a person, then DELETE /v1/excluded-contact/{id} each of them to allow the person to be imported again. A person can be covered by several exclusions (for example one holding their profile URL and another their email), and stays blocked while any of them remains: pass every identifier you know (identifier, profileId, email) to find them all. When several filters are provided, an exclusion matching any of them is returned. Results are sorted from the most recent exclusion to the oldest. operationId: ExcludedContactExternalController_findMany parameters: - name: x-impersonate-user-id in: header description: >- ID of an organization member to act on behalf of. The API key user must be the owner of the organization and the target user must belong to the same organization. required: false schema: type: string - name: page required: false in: query description: Page number (starts from 1) schema: type: number - name: limit required: false in: query description: 'Number of excluded contacts per page (default: 20, maximum: 100)' schema: type: number - name: identifier required: false in: query description: >- LinkedIn public identifier of the person (eg. johndoe), or their full LinkedIn profile URL (eg. https://www.linkedin.com/in/johndoe). Matches exclusions with this LinkedIn profile URL. schema: type: string - name: profileId required: false in: query description: >- LinkedIn profile ID of the person (eg. ACoAABcwGZ0BPKyEbC2o13Qq7MhrAaD), or a profile URN containing it. Matches exclusions with the LinkedIn member ID behind this profile ID. schema: type: string - name: email required: false in: query description: >- Email address of the person. Matches exclusions with exactly this email. schema: type: string responses: '200': description: List of excluded contacts with pagination information content: application/json: schema: type: object properties: excludedContacts: type: array items: type: object properties: id: type: number description: >- Excluded contact ID (usable with DELETE /v1/excluded-contact/{id}) profileUrl: type: string nullable: true description: LinkedIn profile URL of the excluded person linkedinMemberId: type: number nullable: true description: >- Stable numeric LinkedIn member ID of the excluded person email: type: string nullable: true description: Email address of the excluded person createdAt: type: string format: date-time description: Date at which the person was excluded total: type: number description: Total number of excluded contacts matching the search page: type: number description: Current page number limit: type: number description: Number of excluded contacts per page totalPages: type: number description: Total number of pages '400': description: profileId is not a valid LinkedIn profile ID security: - bearer: [] components: securitySchemes: bearer: scheme: bearer bearerFormat: JWT type: http description: Enter API Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.