Agency work uses nested client routes. A valid agency API key alone is not enough — the agency must also have an active grant for the target client account.
/clients/{clientId}/lead-magnets
/clients/{clientId}/leads
/clients/{clientId}/activityGET /clients (scope clients:read) to list accessible clients
Use the returned user_id as clientId
Call nested routes with the scopes those endpoints require
If a call returns 403, check both the API key scope and the agency-client grant.
Do not use account table IDs, API key IDs, key hashes, or private database fields as clientId.
Docs: https://app.leadpanther.ai/docs/agency-mode