> ## Documentation Index > Fetch the complete documentation index at: https://docs.nextlevelmca.com/llms.txt > Use this file to discover all available pages before exploring further. # Look up people > Find contacts and owners. `phone` is the unknown-inbound lookup: any format is normalised to E.164 digits and matched against every stored phone the same way. `email` matches exactly (case-insensitive), `business_id` lists a business’s people, `search` matches name / email / phone fragments. Without filters, lists everyone newest first. `dob` is returned only to admin / manager credentials; SSNs are always masked. ## OpenAPI ````yaml /openapi/public-v1.json get /v1/people openapi: 3.0.0 info: title: NextLevel MCA Public API description: >- REST API for the NextLevel MCA deal platform. Objects flow Businesses → People → Deals → Submissions → Offers → Advances. **Authentication.** Send `Authorization: Bearer ` with an API key (`nlmca_live_…`, created in Settings → Developers) or an OAuth access token. Keys are scoped to one location. **Conventions.** JSON only. Cursor pagination (`limit` ≤ 100, `cursor` from `meta.next_cursor`). Every success is `{ data, meta }`; every error is `{ error: { type, message, code, param, request_id } }`. POST endpoints accept `Idempotency-Key` (24h replay). Rate limit 300 requests/min per credential (`X-RateLimit-*` headers). **Scopes.** Keys with no scopes have all of them. Otherwise: - `businesses:read` — Read businesses and their notes, tasks and activity - `businesses:write` — Create and update businesses, notes and tasks - `people:read` — Read people (contacts and owners) - `people:write` — Create and update people - `deals:read` — Read deals, submissions and the pipeline - `deals:write` — Create and update deals, move stages - `documents:read` — Read documents and statement analysis - `documents:write` — Upload documents and request documents from merchants - `lenders:read` — Read lenders, criteria and lender matches - `lenders:write` — Create and update lenders and criteria - `submissions:write` — Submit deals to lenders and withdraw submissions - `offers:read` — Read offers - `offers:write` — Log and update offers, set the primary offer - `advances:read` — Read funded advances and renewal flags - `advances:write` — Update advances - `portal:send` — Generate and send merchant portal links - `webhooks:manage` — Manage webhook subscriptions version: '1.0' contact: {} servers: - url: https://api.nextlevelmca.com description: Production security: - bearer: [] tags: - name: Businesses description: Merchant businesses and their notes, tasks and activity - name: People description: Contacts and owners. Phone lookups normalise to E.164. - name: Deals description: Deals, stage moves, renewals and the pipeline - name: Documents description: Documents, presigned uploads, document requests and statement analysis - name: Lenders description: Lenders and their criteria - name: Lender matches description: Criteria-driven lender matching for a deal - name: Submissions description: Sending deals to lenders - name: Offers description: Lender offers and the primary offer - name: Advances description: Funded advances and renewal readiness - name: Merchant portal description: Magic links for the merchant portal - name: Webhooks description: Outbound event subscriptions paths: /v1/people: get: tags: - People summary: Look up people description: >- Find contacts and owners. `phone` is the unknown-inbound lookup: any format is normalised to E.164 digits and matched against every stored phone the same way. `email` matches exactly (case-insensitive), `business_id` lists a business’s people, `search` matches name / email / phone fragments. Without filters, lists everyone newest first. `dob` is returned only to admin / manager credentials; SSNs are always masked. operationId: people_list parameters: - name: limit required: false in: query description: Page size (1–100). schema: minimum: 1 maximum: 100 default: 25 type: number - name: cursor required: false in: query description: Opaque cursor from a previous response’s `meta.next_cursor`. schema: type: string - name: phone required: false in: query description: >- Phone to look up (the unknown-inbound-caller lookup). Any format; normalised to E.164 digits before matching (10 US digits get a leading 1), and compared against every stored phone normalised the same way. schema: example: +1 (555) 123-4567 type: string - name: email required: false in: query description: Exact email, case-insensitive. schema: type: string - name: business_id required: false in: query description: Only people associated with this business. schema: type: string - name: search required: false in: query description: >- Fragment matched against first name, last name, email and (4+ digits) phone. schema: type: string responses: '200': description: OK content: application/json: schema: type: object required: - data - meta properties: data: type: array items: $ref: '#/components/schemas/PersonDto' meta: $ref: '#/components/schemas/ListMetaDto' '400': description: Validation failed. `error.param` names the field. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '401': description: Missing, invalid, expired or revoked credential. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '403': description: Credential lacks the scope, or the role lacks the permission. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '429': description: Rate limit exceeded. See `X-RateLimit-*` and `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' security: - bearer: [] components: schemas: PersonDto: type: object properties: id: type: string description: Person id. first_name: type: string description: First name. last_name: type: string nullable: true description: Last name. full_name: type: string description: First and last name joined, for display. email: type: string nullable: true phone: type: string nullable: true description: Phone as stored (any format). Lookups normalise to E.164. address: type: string nullable: true city: type: string nullable: true state: type: string nullable: true zip: type: string nullable: true dob: type: string nullable: true description: >- Date of birth `YYYY-MM-DD`. Only returned to admin / manager credentials; null for everyone else. ssn_masked: type: string nullable: true description: >- Masked SSN, e.g. `***-**-6789`, or null when none is on file. The full number is never returned. credit_score: type: string nullable: true description: Credit score or range as text. ghl_contact_id: type: string nullable: true description: Id of the mirrored CRM contact, when linked. Read-only. status: type: string nullable: true enum: - active - inactive description: '`active` or `inactive`.' created_at: type: string description: ISO 8601 UTC. updated_at: type: string description: ISO 8601 UTC. required: - id - first_name - last_name - full_name - email - phone - address - city - state - zip - dob - ssn_masked - credit_score - ghl_contact_id - status - created_at - updated_at ListMetaDto: type: object properties: next_cursor: type: string nullable: true description: Pass as `?cursor=` to fetch the next page. `null` on the last page. has_more: type: boolean required: - next_cursor - has_more ErrorEnvelopeDto: type: object properties: error: $ref: '#/components/schemas/PublicErrorDto' required: - error PublicErrorDto: type: object properties: type: type: string enum: - validation_error - authentication_error - permission_error - not_found - conflict - rate_limit_error - api_error message: type: string description: Human-readable explanation, safe to show to an operator or an agent. code: type: string description: >- Stable machine-readable code, e.g. `missing_scope`, `duplicate_business`. param: type: string description: Request field the error refers to, when applicable. request_id: type: string description: Echo of the `X-Request-Id` header. Quote it when contacting support. required: - type - message - request_id securitySchemes: bearer: scheme: bearer bearerFormat: API key or JWT type: http description: API key (`nlmca_live_…`) or OAuth access token ```` ## Related topics - [MCP server](/mcp/overview.md) - [Building an AI-first workflow](/guides/ai-first-workflow.md) - [Create a deal task](/api-reference/deals/create-a-deal-task.md)