Submit a client inquiry from the public marketing site
POST/public/client-inquiries
Anonymous form entry point for the ZFA-direct channel. Creates (or finds by phone/email hash) a Client record with channelSource='client_self_service', opens a new ClientInquiry in status='new', and queues a magic-link to the supplied email. Rate-limited to 5 requests per 5 minutes per IP.
Request
Responses
- 201
- 400
- 409
- 422
- 429
- 500
Inquiry accepted; magic-link queued if email supplied.
At least one of email or phone must be supplied.
The request conflicts with the current state of the target resource — a duplicate unique field on registration, an idempotency-key replay with a different payload, or a webhook eventId that has already been processed. error.code may be CONFLICT or IDEMPOTENCY_CONFLICT depending on the cause.
The request is syntactically valid but violates a business invariant — a referral state transition not permitted from the current status, a wallet withdrawal exceeding the available balance, or a POP being confirmed before it has been ZFA-verified. error.code is one of INVALID_TRANSITION, INVARIANT_VIOLATION, or a domain-specific value; error.message explains the invariant.
Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.
Response Headers
Seconds to wait before retrying.
Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.