Prompts for coding agents

Task: sync my agency's ByDomu listings with my website.
- Server-side, read GET /v1/properties with a publishable key (portal:read is enough) and walk every page.
- Store the result in a cache (for example, 15 minutes) and serve the site from it, without calling ByDomu on every visit.
- For the detail page use GET /v1/properties/{id}.
- Only active, published listings come back: if one disappears from the list, remove it from the site.
- Show price, location, bedrooms, bathrooms, area, photos and agent using the field names in the spec.
- Handle 429 with Retry-After and log errors without printing the key.
Before writing code, tell me which files you will create or change.

ByDomu context (keep it as is):
- REST API v1: https://api.bydomu.com/v1. OpenAPI spec: https://api.bydomu.com/v1/openapi.json. Read it before writing code and use only the endpoints, parameters and fields it lists.
- Authentication: X-API-Key header (Authorization: Bearer is not accepted).
  · Publishable key domu_pk_live_…: may live in the browser; only works for portal:read, leads:write, booking:write, finder:write, events:write.
  · Secret key domu_sk_live_…: SERVER-SIDE ONLY, in an environment variable. Never put it in browser code, the repository or logs: from a browser the API returns 403 SECRET_KEY_IN_BROWSER.
- Limits: publishable 300 requests/min (60 writes); secret 60/min (30 writes). Read X-RateLimit-Remaining and, on 429 RATE_LIMITED, wait the seconds in Retry-After.
- Errors: { "error": { "code", "message" } }. 401 invalid key, 403 missing permission, 404 not found, 429 limit.
- Lists: page and pageSize (respect each endpoint's maximum) with meta.total / meta.totalPages.
- On writes send an Idempotency-Key so a retry never creates duplicates.

Task: build a contact form on my website that creates the lead in ByDomu.
- Use POST /v1/leads with a publishable key (leads:write). Never use a secret key in the browser.
- Fields: the POST /v1/leads body in the spec. firstName and phone are required; email, message, propertyId and interestedIn are optional. On a listing page, send its propertyId.
- Pass the URL's utm parameters to utmSource, utmMedium, utmCampaign and utmContent.
- Validate before sending and show the API's 400 errors in plain words.
- Send one Idempotency-Key per submission so a double click never duplicates the lead.
- When done, show a clear success message and keep the form keyboard accessible.

ByDomu context (keep it as is):
- REST API v1: https://api.bydomu.com/v1. OpenAPI spec: https://api.bydomu.com/v1/openapi.json. Read it before writing code and use only the endpoints, parameters and fields it lists.
- Authentication: X-API-Key header (Authorization: Bearer is not accepted).
  · Publishable key domu_pk_live_…: may live in the browser; only works for portal:read, leads:write, booking:write, finder:write, events:write.
  · Secret key domu_sk_live_…: SERVER-SIDE ONLY, in an environment variable. Never put it in browser code, the repository or logs: from a browser the API returns 403 SECRET_KEY_IN_BROWSER.
- Limits: publishable 300 requests/min (60 writes); secret 60/min (30 writes). Read X-RateLimit-Remaining and, on 429 RATE_LIMITED, wait the seconds in Retry-After.
- Errors: { "error": { "code", "message" } }. 401 invalid key, 403 missing permission, 404 not found, 429 limit.
- Lists: page and pageSize (respect each endpoint's maximum) with meta.total / meta.totalPages.
- On writes send an Idempotency-Key so a retry never creates duplicates.

Task: receive ByDomu webhooks on my server.
- Requirement: a secret key with the webhooks:write permission (ByDomu support approves it). It goes in a server environment variable.
- Create an HTTPS POST endpoint that reads the RAW body before parsing the JSON.
- Verify X-Domu-Signature (t=<timestamp>,v1=<hmac>): HMAC-SHA256 of "<timestamp>.<raw body>" with the subscription secret. Compare in constant time and reject timestamps older than 5 minutes.
- Reply 2xx in under 10 s and process in the background. ByDomu retries up to 5 times (0 s, 5 s, 30 s, 2 min and 10 min) on network errors, 429 or 5xx.
- Use each delivery's id field to drop duplicates; the type field is what matters.
- Write a script that reads the catalog with GET /v1/events and creates the subscription with POST /v1/webhooks (url, eventTypes, description). Store the returned secret (shown only once) in an environment variable.
- Events: deal.won and contact.* (exact types, object.* or * are accepted).

ByDomu context (keep it as is):
- REST API v1: https://api.bydomu.com/v1. OpenAPI spec: https://api.bydomu.com/v1/openapi.json. Read it before writing code and use only the endpoints, parameters and fields it lists.
- Authentication: X-API-Key header (Authorization: Bearer is not accepted).
  · Publishable key domu_pk_live_…: may live in the browser; only works for portal:read, leads:write, booking:write, finder:write, events:write.
  · Secret key domu_sk_live_…: SERVER-SIDE ONLY, in an environment variable. Never put it in browser code, the repository or logs: from a browser the API returns 403 SECRET_KEY_IN_BROWSER.
- Limits: publishable 300 requests/min (60 writes); secret 60/min (30 writes). Read X-RateLimit-Remaining and, on 429 RATE_LIMITED, wait the seconds in Retry-After.
- Errors: { "error": { "code", "message" } }. 401 invalid key, 403 missing permission, 404 not found, 429 limit.
- Lists: page and pageSize (respect each endpoint's maximum) with meta.total / meta.totalPages.
- On writes send an Idempotency-Key so a retry never creates duplicates.

Task: connect ByDomu to this client via MCP.
- Server: https://mcp.bydomu.com/mcp (Streamable HTTP, POST only). It is read-only.
- Authentication: Authorization: Bearer <secret key domu_sk_live_…> header. A publishable key returns 403. Read the key from the BYDOMU_API_KEY variable; don't write it into repository files.
- The key only needs read permissions: portal:read, contacts:read, appointments:read, deals:read and tasks:read (conversations:read only if I want a contact's messages).
- Configure it for the client: Claude Code with "claude mcp add --transport http bydomu https://mcp.bydomu.com/mcp --header ..."; Cursor in .cursor/mcp.json with url and headers; VS Code in .vscode/mcp.json with "servers" and "type": "http".
- Test the connection by calling the get_summary tool and tell me which plan and permissions it reports.
- Available tools: search_properties, get_property, search_contacts, get_contact, list_appointments, list_pipelines, list_deals, list_pending_tasks, get_summary.

ByDomu context (keep it as is):
- REST API v1: https://api.bydomu.com/v1. OpenAPI spec: https://api.bydomu.com/v1/openapi.json. Read it before writing code and use only the endpoints, parameters and fields it lists.
- Authentication: X-API-Key header (Authorization: Bearer is not accepted).
  · Publishable key domu_pk_live_…: may live in the browser; only works for portal:read, leads:write, booking:write, finder:write, events:write.
  · Secret key domu_sk_live_…: SERVER-SIDE ONLY, in an environment variable. Never put it in browser code, the repository or logs: from a browser the API returns 403 SECRET_KEY_IN_BROWSER.
- Limits: publishable 300 requests/min (60 writes); secret 60/min (30 writes). Read X-RateLimit-Remaining and, on 429 RATE_LIMITED, wait the seconds in Retry-After.
- Errors: { "error": { "code", "message" } }. 401 invalid key, 403 missing permission, 404 not found, 429 limit.
- Lists: page and pageSize (respect each endpoint's maximum) with meta.total / meta.totalPages.
- On writes send an Idempotency-Key so a retry never creates duplicates.

Task: build a report from my agency's deals in ByDomu.
- Server-side, with a read-only secret key (deals:read), read GET /v1/pipelines for the pipelines and their stages, and GET /v1/deals walking every page. Use the spec's filters (pipelineId, stageId, status, agentId, expectedCloseBefore…) instead of fetching everything.
- Compute: number and value of deals per stage, open deals expected to close this month and a per-agent summary.
- Store a daily snapshot to see the trend instead of fetching everything each time.
- The key never leaves the server: the frontend asks my backend for already aggregated data.
- Respect the 60 requests per minute limit of a secret key.

ByDomu context (keep it as is):
- REST API v1: https://api.bydomu.com/v1. OpenAPI spec: https://api.bydomu.com/v1/openapi.json. Read it before writing code and use only the endpoints, parameters and fields it lists.
- Authentication: X-API-Key header (Authorization: Bearer is not accepted).
  · Publishable key domu_pk_live_…: may live in the browser; only works for portal:read, leads:write, booking:write, finder:write, events:write.
  · Secret key domu_sk_live_…: SERVER-SIDE ONLY, in an environment variable. Never put it in browser code, the repository or logs: from a browser the API returns 403 SECRET_KEY_IN_BROWSER.
- Limits: publishable 300 requests/min (60 writes); secret 60/min (30 writes). Read X-RateLimit-Remaining and, on 429 RATE_LIMITED, wait the seconds in Retry-After.
- Errors: { "error": { "code", "message" } }. 401 invalid key, 403 missing permission, 404 not found, 429 limit.
- Lists: page and pageSize (respect each endpoint's maximum) with meta.total / meta.totalPages.
- On writes send an Idempotency-Key so a retry never creates duplicates.