DEFIANT LAW LEAD INTAKE API — INTEGRATION CHECKLIST

[ ] Production SAS endpoint received through a secure channel
[ ] Endpoint stored as a protected server-side secret
[ ] Content-Type set to application/json
[ ] Required fields mapped: firstName, lastName, phone, email, state
[ ] externalLeadId is unique and stable
[ ] State values limited to AZ, CA, NM, NV, TX
[ ] submittedAt uses ISO 8601 UTC format
[ ] Client timeout is at least 90 seconds
[ ] Rate does not exceed 100 requests per minute
[ ] Exponential retries configured for 429, 500, 502, 503, and 504
[ ] No retries configured for 400, 409, and 422
[ ] SAS endpoint is not logged or exposed in client-side code
[ ] Test lead submitted and Intake ID confirmed