API docs

Read and update your CRM from your own tools, and hear about changes with webhooks. Every example uses https://crm.example.com and the made-up token ccrm_your_token_here: use your CRM's address and your own token.

Getting started

Make a personal access token in your CRM profile, under AI assistants and API. Send it on every request as a bearer token. A token acts as you, in the workspace you made it in: it sees the same companies and locations you do, with your role, and nothing more.

A read only token can list and read. A read and write token can also add and change contacts, consent, tags, deals and tasks, and manage webhooks if you're an agency admin or a company owner.

The API never sends email, text messages or social posts to anyone. There are no send endpoints.

This reference is also an OpenAPI 3.1 document at /api/v1/openapi.json, which needs no token.

curl https://crm.example.com/api/v1/locations \
  -H "Authorization: Bearer ccrm_your_token_here"

Responses and pages

One record comes back as { "data": { ... } }. Lists come back as { "data": [ ... ], "next_cursor": "..." }, in the order each list describes. Pass next_cursor as the cursor parameter to get the next page; it is null on the last page. limit sets the page size, up to 200 (50 if you leave it out).

Ids are uuids. Times are ISO 8601 in UTC. Money is whole CAD cents. Keys are snake_case. Request bodies are JSON, and fields the API doesn't know are refused rather than ignored.

To keep a copy in sync, list contacts with updated_since set a minute or two before your last sync started, and page through.

Errors

Errors come back as { "error": { "code": "...", "message": "..." } }, with details for validation errors. The message is written for people; the code is for your program.

Codes: unauthorized (401), read_only_token, forbidden, two_factor_required (403), not_found (404), invalid_request, invalid_json, invalid_cursor, invalid_url, consent_evidence_missing, consent_backdating (400), duplicate_contact, consent_on_record, webhook_paused, too_many_webhooks, conflict (409), payload_too_large (413), rate_limited (429) and internal_error (500).

Rate limits

Each token can make 300 requests a minute. Past that, requests get 429 with a Retry-After header saying how many seconds to wait. Requests with a missing or wrong token are limited to 20 a minute from each IP address, and that address then waits before even a good token works.

Request bodies can be up to 256 KB.

AI and API access policy

Each company's owners decide what tokens can see about its people, in the company's AI and API access settings. It applies to every token, because the CRM can't tell an AI assistant from any other app. Contacts outside the policy, and everything linked to them, are simply not there: lists leave them out and asking for one by id gets 404.

Details the policy holds back come back as the text [hidden by policy] in place of the value: email, phone, town and consent addresses, or custom fields. Notes and messages, deals and orders, and form answers can be held back as a whole. When a company turns personal tokens off, its people's tokens get 403 tokens_off until it's turned back on.

Every request that returns or changes people's records is logged for the company's owners, with the token's name.

Webhooks

Agency admins and company owners can have the CRM post events to an https address: in Settings, or with /webhooks below. Each event is a POST with a JSON body: { "id", "type", "created_at", "company_id", "data" }. data is the record, shaped as the API returns it. The id is the same for every webhook that gets the event, so you can drop repeats.

Answer with any 2xx status within 10 seconds. Anything else, including a redirect, counts as a failure. Failures are tried again after 1, 3, 9, 27 and 81 minutes, then about 4 hours and 12 hours: 8 tries in all, over about 18 hours. After 5 failures in a row the webhook is marked as failing in Settings until a delivery gets through.

Every delivery is signed. The ccrm-signature header looks like t=1760500000,v1=5257a869..., where v1 is the hex HMAC-SHA256 of the time, a full stop and the raw body, keyed with your signing secret (all of it, including whsec_). Check it against the raw body before you parse it, and refuse deliveries more than 5 minutes old. Other headers: ccrm-event, ccrm-event-id and ccrm-delivery.

Events: contact.created (a contact is added), contact.updated (a contact's details or tags change), consent.recorded (consent is recorded), consent.withdrawn (someone unsubscribes), form.submitted (a form is submitted), deal.created (a deal is added), deal.moved (a deal moves stage), task.completed (a task is done), appointment.booked (an appointment is booked), appointment.updated (an appointment is moved, confirmed, cancelled or marked done), order.paid (an order is paid at a checkout). contact.updated data also lists the changed fields in changed. The test button sends webhook.test.

// Node: check a delivery before trusting it.
import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, header, rawBody) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 || "", "hex");
  return given.length === expected.length && timingSafeEqual(given, expected);
}

Locations

The business locations your token can see.

GET `/api/v1/locations`

List the locations your token can see

Token access: read only or read and write.

Returns 200 A page of Location

curl "https://crm.example.com/api/v1/locations" \
  -H "Authorization: Bearer ccrm_your_token_here"

Contacts

People at a location. Consent fields are read only; record consent with the consent endpoint.

GET `/api/v1/contacts`

List contacts, most recently changed first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No	Only this location
`tag`	query	string	No	A tag. Trimmed and stored in lower case.. 1 to 50 characters
`email`	query	string	No	Only contacts with this email address (any case). up to 254 characters
`updated_since`	query	string (date-time)	No	Only contacts changed at or after this time (ISO 8601)
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Contact

curl "https://crm.example.com/api/v1/contacts?updated_since=2026-10-01T00:00:00Z&limit=50" \
  -H "Authorization: Bearer ccrm_your_token_here"

POST `/api/v1/contacts`

Add a contact

Records no consent and sends nothing. If a contact at that location already has the email, you get 409 duplicate_contact with existing_id.

Token access: read and write.

Body (JSON)

Field	Type	Required	About
`location_id`	string (uuid)	Yes
`full_name`	string	Yes	1 to 200 characters.
`email`	string (email), or null	No	Up to 254 characters.
`phone`	string, or null	No	At least 10 digits. Stored as +1 and the number. Up to 40 characters.
`tags`	array of string	No	Up to 20 items.

Returns 201 Contact

curl -X POST "https://crm.example.com/api/v1/contacts" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "location_id": "8d2f4b6a-1c3e-4a5b-9d7f-0e1a2b3c4d5e",
  "full_name": "Avery Example",
  "email": "avery@example.com",
  "phone": "250-555-0142",
  "tags": [
    "newsletter"
  ]
}'

GET `/api/v1/contacts/{id}`

Get one contact, with what the consent check decides right now

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Returns 200 ContactDetail

curl "https://crm.example.com/api/v1/contacts/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b" \
  -H "Authorization: Bearer ccrm_your_token_here"

PATCH `/api/v1/contacts/{id}`

Change a contact's name, email or phone

Consent can't be changed here. Changing an email or phone that has consent on record is refused with 409 consent_on_record.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Body (JSON)

Field	Type	Required	About
`full_name`	string	No	1 to 200 characters.
`email`	string (email), or null	No	Up to 254 characters.
`phone`	string, or null	No	Up to 40 characters.

Returns 200 Contact

curl -X PATCH "https://crm.example.com/api/v1/contacts/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "full_name": "Avery Example-Smith"
}'

Consent

Record consent or an unsubscribe for a contact, with the evidence CASL needs.

POST `/api/v1/contacts/{id}/consent`

Record consent or an unsubscribe

Dated when the CRM receives it; recorded_at can't be set. Express consent needs wording and evidence.method (and evidence.page_url for web_form). Implied consent needs evidence.reference. Withdrawals are always accepted.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Body (JSON)

Field	Type	Required	About
`channel`	one of `email`, `sms`, `dm`	Yes
`type`	one of `express`, `implied_purchase`, `implied_inquiry`, `implied_donation`, `implied_volunteer`, `implied_membership`, `withdrawn`	Yes	withdrawn records an unsubscribe; implied_donation, implied_volunteer and implied_membership are for charities and nonprofits only.
`wording`	string	No	The exact words the person agreed to. Needed for express consent. 1 to 2000 characters.
`evidence`	object	No

Returns 201 ConsentRecord

curl -X POST "https://crm.example.com/api/v1/contacts/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/consent" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "channel": "email",
  "type": "express",
  "wording": "Yes, send me news and offers from Harbour Light Bakery. I can unsubscribe at any time.",
  "evidence": {
    "method": "web_form",
    "page_url": "https://www.example.ca/newsletter",
    "ip": "203.0.113.24",
    "reference": "signup-1042"
  }
}'

Field	Type	Required	About
`tags`	array of string	Yes	Up to 20 items.

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The contact's id
`tag`	path	string	Yes	A tag. Trimmed and stored in lower case.. 1 to 50 characters

Forms

Website forms and what people sent through them.

GET `/api/v1/forms`

List forms, newest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No	Only this location
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Form

curl "https://crm.example.com/api/v1/forms" \
  -H "Authorization: Bearer ccrm_your_token_here"

GET `/api/v1/forms/{id}/submissions`

List one form's submissions, newest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id
`created_since`	query	string (date-time)	No	Only submissions sent at or after this time (ISO 8601)
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Submission

curl "https://crm.example.com/api/v1/forms/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/submissions" \
  -H "Authorization: Bearer ccrm_your_token_here"

Pipeline

Pipelines, their stages, and deals in CAD.

GET `/api/v1/pipelines`

List pipelines and their stages

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No	Only this location

Returns 200 A page of Pipeline

curl "https://crm.example.com/api/v1/pipelines" \
  -H "Authorization: Bearer ccrm_your_token_here"

GET `/api/v1/deals`

List deals, newest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No
`pipeline_id`	query	string (uuid)	No
`stage_id`	query	string (uuid)	No
`contact_id`	query	string (uuid)	No
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Deal

curl "https://crm.example.com/api/v1/deals" \
  -H "Authorization: Bearer ccrm_your_token_here"

POST `/api/v1/deals`

Add a deal

Goes in the first open stage unless you give stage_id. Owned by you unless you give owner_membership_id (null for nobody).

Token access: read and write.

Body (JSON)

Field	Type	Required	About
`pipeline_id`	string (uuid)	Yes
`stage_id`	string (uuid)	No
`name`	string	Yes	1 to 200 characters.
`value_cents`	integer	No	Value in CAD cents. 0 to 100000000000.
`contact_id`	string (uuid), or null	No
`owner_membership_id`	string (uuid), or null	No

Returns 201 Deal

curl -X POST "https://crm.example.com/api/v1/deals" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "pipeline_id": "5a7c9e1b-3d5f-4a6b-8c0d-2e4f6a8b0c1d",
  "name": "Kitchen refresh quote",
  "value_cents": 1250000
}'

POST `/api/v1/deals/{id}/move`

Move a deal to another stage of its pipeline

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Body (JSON)

Field	Type	Required	About
`stage_id`	string (uuid)	Yes

Returns 200 Deal

curl -X POST "https://crm.example.com/api/v1/deals/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/move" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "stage_id": "9b1d3f5a-7c9e-4b0d-8f2a-4c6e8a0b2d4f"
}'

Tasks

To-dos at a location.

GET `/api/v1/tasks`

List tasks, newest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No
`status`	query	one of `open`, `done`	No
`assignee_membership_id`	query	string (uuid)	No
`contact_id`	query	string (uuid)	No
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Task

curl "https://crm.example.com/api/v1/tasks?status=open" \
  -H "Authorization: Bearer ccrm_your_token_here"

POST `/api/v1/tasks`

Add a task

Assigned to you unless you give assignee_membership_id (null for nobody). The assignee must work at the location.

Token access: read and write.

Body (JSON)

Field	Type	Required	About
`location_id`	string (uuid)	Yes
`title`	string	Yes	1 to 300 characters.
`notes`	string	No	Up to 5000 characters.
`due_on`	string, or null	No	A date, like 2026-10-15.
`assignee_membership_id`	string (uuid), or null	No
`contact_id`	string (uuid), or null	No

Returns 201 Task

curl -X POST "https://crm.example.com/api/v1/tasks" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "location_id": "8d2f4b6a-1c3e-4a5b-9d7f-0e1a2b3c4d5e",
  "title": "Call back about the quote",
  "due_on": "2026-10-20"
}'

POST `/api/v1/tasks/{id}/complete`

Mark a task done

Staff can complete their own tasks only, as in the CRM.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Returns 200 Task

curl -X POST "https://crm.example.com/api/v1/tasks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/complete" \
  -H "Authorization: Bearer ccrm_your_token_here"

Appointments

Bookings on each location's calendar, soonest first. Read only.

GET `/api/v1/appointments`

List appointments, soonest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No
`from`	query	string (date-time)	No	Starting at or after this time. Defaults to now.
`to`	query	string (date-time)	No	Starting before this time
`status`	query	one of `booked`, `confirmed`, `done`, `no_show`, `cancelled`	No
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Appointment

curl "https://crm.example.com/api/v1/appointments?status=booked" \
  -H "Authorization: Bearer ccrm_your_token_here"

Events

Events and who registered. Read only.

GET `/api/v1/events`

List events, latest start first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`location_id`	query	string (uuid)	No
`status`	query	one of `draft`, `open`, `closed`, `cancelled`	No
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Event

curl "https://crm.example.com/api/v1/events" \
  -H "Authorization: Bearer ccrm_your_token_here"

GET `/api/v1/events/{id}/registrations`

List one event's registrations, newest first

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id
`status`	query	one of `going`, `waitlist`, `cancelled`	No
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Registration

curl "https://crm.example.com/api/v1/events/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/registrations" \
  -H "Authorization: Bearer ccrm_your_token_here"

Webhooks

Where the CRM posts events. Agency admins and company owners only.

GET `/api/v1/webhooks`

List webhooks

Agency admins and company owners only.

Token access: read only or read and write.

Returns 200 A page of Webhook

curl "https://crm.example.com/api/v1/webhooks" \
  -H "Authorization: Bearer ccrm_your_token_here"

POST `/api/v1/webhooks`

Add a webhook

The answer includes the signing secret, this once only. The address must be https and must not point to a private or local network. Agency admins and company owners only.

Token access: read and write.

Body (JSON)

Field	Type	Required	About
`url`	string	Yes	Where to post events. https only. 1 to 2000 characters.
`events`	array of one of `contact.created`, `contact.updated`, `consent.recorded`, `consent.withdrawn`, `form.submitted`, `deal.created`, `deal.moved`, `task.completed`, `appointment.booked`, `appointment.updated`, `order.paid`	Yes	Events to send: contact.created, contact.updated, consent.recorded, consent.withdrawn, form.submitted, deal.created, deal.moved, task.completed, appointment.booked, appointment.updated, order.paid. Up to 11 items.
`description`	string, or null	No	A note to tell webhooks apart. Up to 200 characters.
`company_id`	string (uuid), or null	No	Agency admins: one company, or null for every company. Owners: always their own company.

Returns 201 NewWebhook

curl -X POST "https://crm.example.com/api/v1/webhooks" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://hooks.example.com/crm",
  "events": [
    "contact.created",
    "form.submitted"
  ],
  "description": "New leads to our booking tool"
}'

GET `/api/v1/webhooks/{id}`

Get one webhook

Agency admins and company owners only.

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Returns 200 Webhook

curl "https://crm.example.com/api/v1/webhooks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b" \
  -H "Authorization: Bearer ccrm_your_token_here"

PATCH `/api/v1/webhooks/{id}`

Change, pause or resume a webhook

Agency admins and company owners only.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Body (JSON)

Field	Type	Required	About
`url`	string	No	1 to 2000 characters.
`events`	array of one of `contact.created`, `contact.updated`, `consent.recorded`, `consent.withdrawn`, `form.submitted`, `deal.created`, `deal.moved`, `task.completed`, `appointment.booked`, `appointment.updated`, `order.paid`	No	Events to send: contact.created, contact.updated, consent.recorded, consent.withdrawn, form.submitted, deal.created, deal.moved, task.completed, appointment.booked, appointment.updated, order.paid. Up to 11 items.
`description`	string, or null	No	A note to tell webhooks apart. Up to 200 characters.
`active`	boolean	No	false pauses deliveries; true resumes them and clears a failing streak.

Returns 200 Webhook

curl -X PATCH "https://crm.example.com/api/v1/webhooks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b" \
  -H "Authorization: Bearer ccrm_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{
  "active": false
}'

DELETE `/api/v1/webhooks/{id}`

Delete a webhook

Deliveries still waiting are cancelled. Past deliveries are kept as history. Agency admins and company owners only.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Returns 200 object

curl -X DELETE "https://crm.example.com/api/v1/webhooks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b" \
  -H "Authorization: Bearer ccrm_your_token_here"

GET `/api/v1/webhooks/{id}/deliveries`

List a webhook's deliveries, newest first

Agency admins and company owners only.

Token access: read only or read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id
`limit`	query	integer	No	How many to return. 1 to 200, default 50
`cursor`	query	string	No	next_cursor from the previous page. up to 200 characters

Returns 200 A page of Delivery

curl "https://crm.example.com/api/v1/webhooks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/deliveries" \
  -H "Authorization: Bearer ccrm_your_token_here"

POST `/api/v1/webhooks/{id}/test`

Send a test event

Queues a webhook.test delivery, sent and retried like any other. Agency admins and company owners only.

Token access: read and write.

Parameters

Name	In	Type	Required	About
`id`	path	string (uuid)	Yes	The record's id

Returns 202 Delivery

curl -X POST "https://crm.example.com/api/v1/webhooks/3f1c5a7e-2b4d-4e6f-8a1b-9c0d1e2f3a4b/test" \
  -H "Authorization: Bearer ccrm_your_token_here"

Webhook events

Each event's data is the record shown, as the API returns it. See Webhooks for the signature and retries.

Event	When	data
`contact.created`	A contact is added	Contact
`contact.updated`	A contact's details or tags change	Contact
`consent.recorded`	Consent is recorded	ConsentRecord
`consent.withdrawn`	Someone unsubscribes	ConsentRecord
`form.submitted`	A form is submitted	Submission
`deal.created`	A deal is added	Deal
`deal.moved`	A deal moves stage	Deal
`task.completed`	A task is done	Task
`appointment.booked`	An appointment is booked	Appointment
`appointment.updated`	An appointment is moved, confirmed, cancelled or marked done	Appointment
`order.paid`	An order is paid at a checkout	object

Records

Location

Field	Type	Always there	About
`id`	string (uuid)	Yes
`name`	string	Yes
`company_id`	string (uuid)	Yes
`company_name`	string	Yes
`business_name`	string, or null	Yes
`province`	string, or null	Yes	Two-letter province or territory code.
`timezone`	string	Yes
`regulated_retail`	boolean	Yes	Cannabis or liquor: marketing only to age-verified contacts.
`sender_missing`	array of string	Yes	Sender details still needed before marketing can go out.
`created_at`	string (date-time)	Yes

Contact

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`full_name`	string	Yes
`email`	string, or null	Yes
`phone`	string, or null	Yes	E.164, like +12505550123.
`age_verified`	boolean	Yes	Read only. Set in the CRM.
`tags`	array of string	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

ContactDetail

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`full_name`	string	Yes
`email`	string, or null	Yes
`phone`	string, or null	Yes	E.164, like +12505550123.
`age_verified`	boolean	Yes	Read only. Set in the CRM.
`tags`	array of string	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes
`consent`	object	Yes	Read only. What the consent check decides right now, per channel.

ConsentRecord

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`contact_id`	string (uuid)	Yes
`channel`	one of `email`, `sms`, `dm`	Yes
`type`	one of `express`, `implied_purchase`, `implied_inquiry`, `implied_donation`, `implied_volunteer`, `implied_membership`, `withdrawn`	Yes
`recorded_at`	string (date-time)	Yes	Always the moment the CRM received it.
`source`	string	Yes
`wording`	string, or null	Yes
`created_at`	string (date-time)	Yes

Tag

Field	Type	Always there	About
`tag`	string	Yes
`contacts`	integer	Yes	How many contacts you can see have it.

Form

Field	Type	Always there
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`name`	string	Yes
`status`	one of `active`, `paused`	Yes
`consent_enabled`	boolean	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

Submission

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`form_id`	string (uuid)	Yes
`contact_id`	string (uuid), or null	Yes
`answers`	object of string	Yes	Field id to answer.
`consent_given`	boolean	Yes
`page_url`	string, or null	Yes
`referrer`	string, or null	Yes
`utm`	object of string	Yes
`created_at`	string (date-time)	Yes

Pipeline

Field	Type	Always there
`id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`name`	string	Yes
`stages`	array of object	Yes
`created_at`	string (date-time)	Yes

Deal

Field	Type	Always there
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`pipeline_id`	string (uuid)	Yes
`stage_id`	string (uuid)	Yes
`name`	string	Yes
`value_cents`	integer	Yes
`currency`	`CAD`	Yes
`contact_id`	string (uuid), or null	Yes
`owner_membership_id`	string (uuid), or null	Yes
`stage_entered_at`	string (date-time)	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

Task

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`title`	string	Yes
`notes`	string, or null	Yes
`due_on`	string, or null	Yes	A date, like 2026-10-15.
`status`	one of `open`, `done`	Yes
`kind`	one of `todo`, `social_post`	Yes
`assignee_membership_id`	string (uuid), or null	Yes
`contact_id`	string (uuid), or null	Yes
`done_at`	string (date-time), or null	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

Appointment

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`type_id`	string (uuid)	Yes
`type_name`	string	Yes
`contact_id`	string (uuid)	Yes
`staff_membership_id`	string (uuid), or null	Yes
`starts_at`	string (date-time)	Yes
`ends_at`	string (date-time)	Yes
`time_zone`	string	Yes	The location's time zone, like America/Vancouver.
`buffer_minutes`	integer	Yes
`price_cents`	integer, or null	Yes
`currency`	`CAD`	Yes
`deposit_required`	boolean	Yes
`status`	one of `booked`, `confirmed`, `done`, `no_show`, `cancelled`	Yes
`notes`	string, or null	Yes
`source`	one of `staff`, `booking_page`	Yes
`created_at`	string (date-time)	Yes

Event

Field	Type	Always there
`id`	string (uuid)	Yes
`company_id`	string (uuid)	Yes
`location_id`	string (uuid)	Yes
`title`	string	Yes
`description`	string, or null	Yes
`venue`	string, or null	Yes
`starts_at`	string (date-time)	Yes
`ends_at`	string (date-time), or null	Yes
`capacity`	integer, or null	Yes
`status`	one of `draft`, `open`, `closed`, `cancelled`	Yes
`going`	integer	Yes
`waitlist`	integer	Yes
`checked_in`	integer	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

Registration

Field	Type	Always there
`id`	string (uuid)	Yes
`event_id`	string (uuid)	Yes
`contact_id`	string (uuid)	Yes
`full_name`	string	Yes
`status`	one of `going`, `waitlist`, `cancelled`	Yes
`source`	one of `public_form`, `staff`	Yes
`checked_in_at`	string (date-time), or null	Yes
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

Webhook

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid), or null	Yes	null: every company in the agency.
`description`	string, or null	Yes
`url`	string	Yes
`events`	array of string	Yes
`active`	boolean	Yes
`healthy`	boolean	Yes
`failure_count`	integer	Yes	Failed attempts in a row.
`unhealthy_since`	string (date-time), or null	Yes
`last_success_at`	string (date-time), or null	Yes
`last_failure_at`	string (date-time), or null	Yes
`secret_prefix`	string	Yes	The first characters of the signing secret.
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes

NewWebhook

Field	Type	Always there	About
`id`	string (uuid)	Yes
`company_id`	string (uuid), or null	Yes	null: every company in the agency.
`description`	string, or null	Yes
`url`	string	Yes
`events`	array of string	Yes
`active`	boolean	Yes
`healthy`	boolean	Yes
`failure_count`	integer	Yes	Failed attempts in a row.
`unhealthy_since`	string (date-time), or null	Yes
`last_success_at`	string (date-time), or null	Yes
`last_failure_at`	string (date-time), or null	Yes
`secret_prefix`	string	Yes	The first characters of the signing secret.
`created_at`	string (date-time)	Yes
`updated_at`	string (date-time)	Yes
`secret`	string	Yes	The signing secret. Shown only this once.

Delivery

Field	Type	Always there
`id`	string (uuid)	Yes
`endpoint_id`	string (uuid)	Yes
`event_id`	string (uuid)	Yes
`event`	string	Yes
`status`	one of `pending`, `delivered`, `failed`, `cancelled`	Yes
`attempts`	integer	Yes
`next_attempt_at`	string (date-time), or null	Yes
`last_attempt_at`	string (date-time), or null	Yes
`last_status_code`	integer, or null	Yes
`last_error`	string, or null	Yes
`delivered_at`	string (date-time), or null	Yes
`created_at`	string (date-time)	Yes

Built for the Mighty Small™. Made in Canada.

API docs

Getting started

Responses and pages

Errors

Rate limits

Consent (CASL)

AI and API access policy

Webhooks

Locations

GET /api/v1/locations

Contacts

GET /api/v1/contacts

Parameters

POST /api/v1/contacts

Body (JSON)

GET /api/v1/contacts/{id}

Parameters

PATCH /api/v1/contacts/{id}

Parameters

Body (JSON)

Consent

POST /api/v1/contacts/{id}/consent

Parameters

Body (JSON)

Tags

GET /api/v1/tags

Parameters

POST /api/v1/contacts/{id}/tags

Parameters

Body (JSON)

DELETE /api/v1/contacts/{id}/tags/{tag}

Parameters

Forms

GET /api/v1/forms

Parameters

GET /api/v1/forms/{id}/submissions

Parameters

Pipeline

GET /api/v1/pipelines

Parameters

GET /api/v1/deals

Parameters

POST /api/v1/deals

Body (JSON)

POST /api/v1/deals/{id}/move

Parameters

Body (JSON)

Tasks

GET /api/v1/tasks

Parameters

POST /api/v1/tasks

Body (JSON)

POST /api/v1/tasks/{id}/complete

Parameters

Appointments

GET /api/v1/appointments

Parameters

Events

GET /api/v1/events

Parameters

GET /api/v1/events/{id}/registrations

Parameters

Webhooks

GET /api/v1/webhooks

POST /api/v1/webhooks

Body (JSON)

GET /api/v1/webhooks/{id}

Parameters

PATCH /api/v1/webhooks/{id}

Parameters

Body (JSON)

DELETE /api/v1/webhooks/{id}

Parameters

GET /api/v1/webhooks/{id}/deliveries

Parameters

POST /api/v1/webhooks/{id}/test

Parameters

Webhook events

Records

Location

GET `/api/v1/locations`

GET `/api/v1/contacts`

POST `/api/v1/contacts`

GET `/api/v1/contacts/{id}`

PATCH `/api/v1/contacts/{id}`

POST `/api/v1/contacts/{id}/consent`

GET `/api/v1/tags`

POST `/api/v1/contacts/{id}/tags`

DELETE `/api/v1/contacts/{id}/tags/{tag}`

GET `/api/v1/forms`

GET `/api/v1/forms/{id}/submissions`

GET `/api/v1/pipelines`

GET `/api/v1/deals`

POST `/api/v1/deals`

POST `/api/v1/deals/{id}/move`

GET `/api/v1/tasks`

POST `/api/v1/tasks`

POST `/api/v1/tasks/{id}/complete`

GET `/api/v1/appointments`

GET `/api/v1/events`

GET `/api/v1/events/{id}/registrations`

GET `/api/v1/webhooks`

POST `/api/v1/webhooks`

GET `/api/v1/webhooks/{id}`

PATCH `/api/v1/webhooks/{id}`

DELETE `/api/v1/webhooks/{id}`

GET `/api/v1/webhooks/{id}/deliveries`

POST `/api/v1/webhooks/{id}/test`