Obriym CRM

2 of the 42 tools listed anonymously say in their own descriptions that they need an account or a key (create_company, select_workspace), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: search_leads, get_lead, search_deals, get_deal, list_orders, get_order, search_products, get_product, get_dashboard_overview, get_report, search_contacts, get_contact, search_companies, get_company, list_activities, get_activity, list_customers, get_customer, get_workspace_info, create_lead, update_lead, create_deal, create_activity, update_order_status, create_contact, update_contact, create_company, update_company, complete_activity, convert_lead, assign_lead, transition_deal, create_order, add_order_item, update_order_item, remove_order_item, list_pipeline_stages, configure_pipeline, list_lead_sources, set_lead_sources, list_workspaces, select_workspace.