Instantly Data Handling

Instantly Data Handling

Overview

Manage leads, lead lists, block lists, and regulatory compliance in Instantly API v2. Covers lead CRUD operations, list management, bulk import patterns, unsubscribe handling, GDPR right-to-deletion, CAN-SPAM compliance, and block list automation. Cold email has specific legal requirements — this skill ensures your integrations are compliant.

Prerequisites

• Completed instantly-install-auth setup
• API key with leads:all scope
• Understanding of CAN-SPAM / GDPR requirements for cold outreach

Instructions

Step 1: Lead List Management

import { InstantlyClient } from "./src/instantly/client";
const client = new InstantlyClient();

// Create a lead list (container for leads outside campaigns)
async function createLeadList(name: string) {
  const list = await client.request<{ id: string; name: string }>("/lead-lists", {
    method: "POST",
    body: JSON.stringify({
      name,
      has_enrichment_task: false,
    }),
  });
  console.log(`Created list: ${list.name} (${list.id})`);
  return list;
}

// List all lead lists
async function getLeadLists() {
  return client.request<Array<{
    id: string; name: string; timestamp_created: string;
  }>>("/lead-lists?limit=50");
}

// Delete a lead list
async function deleteLeadList(listId: string) {
  await client.request(`/lead-lists/${listId}`, { method: "DELETE" });
}

Step 2: Lead Import with Validation

interface LeadImport {
  email: string;
  first_name?: string;
  last_name?: string;
  company_name?: string;
  website?: string;
  phone?: string;
  custom_variables?: Record<string, string>;
}

async function importLeads(
  campaignId: string,
  leads: LeadImport[],
  options = { skipDuplicates: true, verifyEmails: true }
) {
  const results = { added: 0, skipped: 0, failed: 0, errors: [] as string[] };

  for (const lead of leads) {
    try {
      // Validate email format
      if (!lead.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(lead.email)) {
        results.failed++;
        results.errors.push(`Invalid email: ${lead.email}`);
        continue;
      }

      // Check against block list patterns
      const domain = lead.email.split("@")[1];
      if (BLOCKED_PATTERNS.some((p) => domain.includes(p))) {
        results.skipped++;
        continue;
      }

      await client.request("/leads", {
        method: "POST",
        body: JSON.stringify({
          campaign: campaignId,
          email: lead.email,
          first_name: lead.first_name,
          last_name: lead.last_name,
          company_name: lead.company_name,
          website: lead.website,
          phone: lead.phone,
          custom_variables: lead.custom_variables,
          skip_if_in_workspace: options.skipDuplicates,
          skip_if_in_campaign: true,
          verify_leads_on_import: options.verifyEmails,
        }),
      });
      results.added++;
    } catch (e: any) {
      results.failed++;
      results.errors.push(`${lead.email}: ${e.message}`);
    }
  }

  console.log(`Import: ${results.added} added, ${results.skipped} skipped, ${results.failed} failed`);
  return results;
}

// Role-based emails and internal domains to always skip
const BLOCKED_PATTERNS = [
  "noreply", "no-reply", "donotreply",
  "info@", "admin@", "support@", "help@", "abuse@",
  "postmaster@", "webmaster@", "hostmaster@",
];

Step 3: Lead Operations (Move, Update, Delete)

// Move leads between campaigns or lists
async function moveLeads(opts: {
  fromCampaign?: string;
  fromList?: string;
  toCampaign?: string;
  toList?: string;
  limit?: number;
}) {
  return client.request("/leads/move", {
    method: "POST",
    body: JSON.stringify({
      in_campaign: opts.fromCampaign,
      in_list: opts.fromList,
      to_campaign_id: opts.toCampaign,
      to_list_id: opts.toList,
      limit: opts.limit || 1000,
      check_duplicates: true,
    }),
  });
}

// Update lead interest status
async function updateLeadInterest(
  email: string,
  campaignId: string,
  status: "interested" | "not_interested" | "meeting_booked" | "closed"
) {
  const interestMap: Record<string, number> = {
    interested: 1,
    not_interested: -1,
    meeting_booked: 2,
    closed: 3,
  };

  await client.request("/leads/update-interest-status", {
    method: "POST",
    body: JSON.stringify({
      lead_email: email,
      campaign_id: campaignId,
      interest_value: interestMap[status],
    }),
  });
}

// Update lead data
async function updateLead(leadId: string, data: Partial<LeadImport>) {
  await client.request(`/leads/${leadId}`, {
    method: "PATCH",
    body: JSON.stringify(data),
  });
}

// Delete leads from a campaign (bulk)
async function deleteLeadsFromCampaign(campaignId: string, status?: number) {
  await client.request("/leads", {
    method: "DELETE",
    body: JSON.stringify({
      campaign_id: campaignId,
      status, // e.g., -1 for bounced only
    }),
  });
}

Step 4: Block List Management

// Add entries to workspace block list
async function addToBlockList(entries: string[]) {
  // Single entry
  for (const entry of entries) {
    await client.request("/block-lists-entries", {
      method: "POST",
      body: JSON.stringify({ bl_value: entry }), // email or domain
    });
  }

  // Or bulk add
  await client.request("/block-lists-entries/bulk-create", {
    method: "POST",
    body: JSON.stringify({ entries }),
  });
}

// Seed block list with standard entries
async function seedBlockList() {
  const standardBlocks = [
    // Your own domains
    "yourdomain.com",
    "yourcompany.com",
    // Competitor domains
    "competitor1.com",
    "competitor2.com",
    // ISP domains (not your target audience)
    "gmail.com",      // uncomment if B2B only
    "yahoo.com",
    "hotmail.com",
    "outlook.com",
    // Trap/spamtrap domains
    "spamtrap.com",
  ];

  await addToBlockList(standardBlocks);
  console.log(`Seeded block list with ${standardBlocks.length} entries`);
}

// List and audit block list
async function auditBlockList() {
  const entries = await client.request<Array<{
    id: string; bl_value: string;
  }>>("/block-lists-entries?limit=100");
  console.log(`Block list: ${entries.length} entries`);
  for (const e of entries) {
    console.log(`  ${e.bl_value}`);
  }
}

Step 5: GDPR / CAN-SPAM Compliance

// GDPR: Right to deletion — remove lead from everywhere
async function handleDeletionRequest(email: string) {
  console.log(`Processing GDPR deletion request for: ${email}`);

  // 1. Find all campaigns containing this lead
  const campaigns = await client.request<Array<{ id: string }>>(
    `/campaigns/search-by-contact?search=${encodeURIComponent(email)}`
  );

  // 2. Delete lead from each campaign
  for (const campaign of campaigns) {
    const leads = await client.leads.list({ campaign: campaign.id });
    const matchingLead = leads.find((l) => l.email === email);
    if (matchingLead) {
      await client.leads.delete(matchingLead.id);
      console.log(`  Deleted from campaign ${campaign.id}`);
    }
  }

  // 3. Add to workspace block list (prevent re-import)
  await addToBlockList([email]);
  console.log(`  Added to block list`);

  // 4. Log for compliance records
  console.log(`  Deletion complete. Log this for GDPR records.`);
}

// CAN-SPAM: Ensure unsubscribe is honored
async function handleUnsubscribe(email: string) {
  // 1. Add to block list (global across all campaigns)
  await addToBlockList([email]);

  // 2. Also add the domain if it's a business-wide request
  // const domain = email.split("@")[1];
  // await addToBlockList([domain]);

  console.log(`Unsubscribe processed: ${email} added to global block list`);
}

// Email verification before import
async function verifyEmail(email: string) {
  // Start verification
  await client.request("/email-verification", {
    method: "POST",
    body: JSON.stringify({
      email,
      webhook_url: "https://api.yourapp.com/webhooks/verification",
    }),
  });

  // Check status (may need to poll)
  const result = await client.request<{
    email: string; status: string; reason: string;
  }>(`/email-verification/${encodeURIComponent(email)}`);

  return result;
}

Key API Endpoints

Error Handling

Output

Return a handling receipt with source classification, consent basis, campaign/destination scope, policy revision, input/accepted/quarantined counts, suppression result, retention date, and deletion/rollback reference. Do not include recipient addresses, email copy, or sender credentials.

Examples

source=synthetic-recipient-fixture; class=internal-test; accepted=96; quarantined=4; consent=pass; suppression=pass; retention=24h; cleanup=verified is a compliant processing result.

Resources

• Instantly Lead API
• Instantly Block List API
• CAN-SPAM Requirements

Next Steps

For workspace access control, see instantly-enterprise-rbac.