Generated from documentation/api/crm-v1.md.

RevenuePilot CRM API v1

Overview

The CRM API uses bearer-token authentication and workspace scoping.

Base

/api/crm/v1

Endpoints

GET /status
GET /schema
GET /deals
GET /leads
GET /rate-limits

Authentication

Create an API client from the Enterprise Hub, then send:

Authorization: Bearer <token>

Rate Limiting

Each API client has an hourly request limit. Responses expose:

X-RateLimit-Limit
X-RateLimit-Remaining

Workspace Isolation

If the token belongs to a workspace-scoped API client, responses are limited to CRM records whose companies belong to that workspace.

Schemas

Use GET /schema for the current payload contract and webhook-signing notes.

Request Example

curl -H "Authorization: Bearer <token>" \
  -H "Accept: application/json" \
  https://crm.example.com/api/crm/v1/deals

Client Safety

Store tokens outside source control and rotate them after staff or integration changes.
Treat 401 as an authentication failure and 403 as a scope or permission failure.
Respect rate-limit headers and use bounded exponential backoff for retryable failures.
Log the request identifier and status, but never log bearer tokens or sensitive CRM payloads.
Use a dedicated client per integration so access and revocation remain auditable.

Integration Check

Call /status, inspect /schema, request a small page of workspace-scoped records, and verify an out-of-scope record is not returned before enabling writes or scheduled sync.