API & webhooks
Everything in the UI, reachable by token.
A REST API scoped to one subaccount per token, and outgoing webhooks signed with HMAC and retried with discipline. Built for the agency that would rather write code than click.
01The REST API
One surface, honest verbs.
Everything lives under /v1 with the same auth, pagination, filtering and errors. What you can do to a resource is deliberate — money is read-only by design.
01 / Endpoints
CRUD where it's safe, verbs where it counts
Contacts, records, tags and webhook endpoints are fully writable. Documents can be sent and voided but never fabricated over the API, bookings can be cancelled, and payments are read-only — the ledger is not an API playground.
02 / Tokens
Scoped twice, on purpose
A token belongs to one subaccount and carries explicit abilities — and the request only succeeds if the membership behind the token holds the same permission. IP allowlists take CIDR ranges; expiry dates are optional and enforced.
03 / Filtering
Query like the UI does
The same filter engine that powers the app: twelve operators on standard fields, a cf_ prefix that reaches any custom field, and tag set operators. Lists paginate to 100 per page with link headers.
02Outgoing webhooks
Signed, retried, honest.
04 / 17 events
Subscribe to exactly enough
Contacts, documents, signatures, payments, forms, bookings and records all emit events. Per-endpoint conditions narrow deliveries — contact.created only when source is “website” — and custom payload templates shape the body for whatever is listening.
05 / HMAC signatures
Prove it came from us
Every delivery carries a signature over the timestamp and raw body, keyed by the endpoint's secret — shown once at creation, stored encrypted. The docs ship timing-safe verification snippets in PHP, Node and Python.
06 / Retries
Backoff with a memory
Failed deliveries retry on an exponential ladder; client errors don't retry at all. Each attempt is logged with response status, body and duration, and an endpoint that fails ten times in a row pauses itself until you re-enable it — which resets the count.
Private and reserved IP ranges are rejected, and resolved IPs are pinned to defeat DNS rebinding.
60 requests/minute by default, per-token overrides, and X-RateLimit headers on every response.
A token cannot read another subaccount's data — even inside the same agency.
Every call needs the token ability and the matching role permission on the membership behind it.
“The verification snippet came in three languages. Somebody there has been on our side of this.”
Build on it.
Tokens, events and delivery logs live in settings — the first call is one curl away.
Flat price. No usage charges. Ever.