API & Webhooks

Integrate EasyCRM into your systems via REST API.

Public REST API v1 with 31 permission scopes, Sanctum bearer token authentication, and a rate limit of 1,000 requests per minute. Outbound webhooks with HMAC-SHA256 signing notify you of every relevant event in the CRM.

Get started free View pricing

REST API v1

31 permission scopes – exactly what the integration needs

The EasyCRM REST API v1 covers all core CRM domains: contacts, leads, opportunities, activities, sales (products, quotations, orders), inbox conversations, call logs, reports, pipelines, custom fields, sales teams, and delta sync. Every API token issued via the token manager carries explicit permission scopes – for example `read:contacts`, `write:opportunities`, `read:reports`, or `write:calls`. This ensures a third-party integration only has access to what it genuinely needs. The rate limit is 1,000 requests per minute with a burst limit of 60 requests per 5 seconds. API access is available on the Standard and Pro plans. Authentication uses a Sanctum bearer token in the `Authorization: Bearer <token>` header.

31 named permission scopes (read/write per domain)
Sanctum bearer token authentication
Rate limit: 1,000 req/min, burst 60 req/5 s
Cursor-based and offset pagination for list endpoints
Delta sync endpoint for offline mobile clients

REST API v1

GET /api/v1/contacts

Authorization: Bearer <token>

// Scopes: read:contacts

// Rate limit: 1 000 req/min

POST /api/v1/opportunities

// Scope: write:opportunities

read:contacts write:leads read:reports write:calls manage:webhooks +26 ďalších

Outbound webhooks

11 HMAC-signed events with DLQ and manual redelivery

EasyCRM sends HTTP POST notifications to your endpoint URL for every relevant event. Each webhook request is signed with HMAC-SHA256 using your subscription's secret key – verify the signature in the `X-EasyCRM-Signature` header and you can be certain the event came from EasyCRM. Eleven event types are available: `lead_created`, `lead_converted`, `opportunity_stage_changed`, `deal_won`, `deal_lost`, `contact_created`, `contact_updated`, `call_logged`, `message_received`, `quotation_sent`, and `order_created`. If your endpoint is temporarily unavailable, EasyCRM queues the event for redelivery. On the Pro plan you can view failed events in the dead letter queue (DLQ) and trigger manual redelivery from the settings UI. SSRF protection blocks private and local IP ranges.

11 webhook event types covering the full CRM lifecycle
HMAC-SHA256 signature on every event – verifiable on your side
Delivery log with HTTP status and response body
Dead letter queue (DLQ) with manual redelivery (Pro)
SSRF protection – private IP addresses are blocked

11 webhook udalostí

lead_created

opportunity_stage_changed

deal_won

call_logged

message_received

order_created

+ 5 ďalších udalostí...

X-EasyCRM-Signature – HMAC-SHA256

Plugin framework

Extend EasyCRM with your own plugins

EasyCRM provides a declarative plugin framework for advanced integrations. A plugin is defined by a JSON manifest that describes permission scopes, webhook event subscriptions, and UI slots where the plugin appears. Installation goes through an OAuth consent flow directly in the organisation's admin panel. In the SaaS environment plugins are isolated (no in-process PHP); in a self-hosted installation in-process loading is available for maximum flexibility. The plugin framework is available on the Pro plan. If you manage multiple client organisations or are building a product integration on top of EasyCRM, the plugin manifest is the right approach – define once, deploy to each organisation independently.

Declarative JSON manifest plugin framework
OAuth consent flow for plugin installation in an organisation
Per-plugin permission scopes and webhook event subscriptions
UI slots – render custom content inside the CRM interface
In-process PHP loading in self-hosted mode

plugin.manifest.json

{

"name": "My Integration",

"scopes": ["read:contacts", "write:leads"],

"events": ["deal_won", "lead_created"],

"ui_slots": ["contact.sidebar"]

}

Manifest OAuth Inštalácia

OpenAPI spec – auto-generovaný cez Scramble

What you gain

EasyCRM as a building block for your systems

Complete API covering contacts, sales, inbox, and reports
Precise permission scopes – integrations get only what they need
HMAC-signed webhooks – secure and verifiable
DLQ and manual redelivery – no event is lost (Pro)
Plugin framework for repeatable deployment of custom extensions
Auto-generated OpenAPI spec – typed client for your tech stack

Works with

Mobile app All integrations Pricing and plans

FAQ

Developer questions

: REST API access is available from the Standard plan. Webhooks and the plugin framework are available on the Pro plan. The Free plan lets you try EasyCRM without API access.
: The standard rate limit is 1,000 requests per minute. For short burst traffic a burst limit of 60 requests per 5 seconds applies. When the limit is exceeded the API responds with HTTP 429 and a `Retry-After` header.
: Every webhook request includes an `X-EasyCRM-Signature` header containing an HMAC-SHA256 signature of the request body. Verify it using the secret key of your webhook subscription – the process is the same as with Meta or Stripe webhooks.
: EasyCRM retries delivery with exponential back-off. If all retries are exhausted, the event lands in the dead letter queue (DLQ). On the Pro plan you can view undelivered events in settings and manually trigger redelivery.
: Yes. EasyCRM auto-generates an OpenAPI spec via Scramble. The spec can be used to generate typed API clients for your tech stack – the EasyCRM mobile app uses it to generate a Dart client.
: Yes. You can programmatically create contacts, leads, opportunities, and other records via the API. Batch operations are available through the sync endpoint. File-based import (CSV, Excel) is not available – the API is the correct path for automated data loading.

Connect EasyCRM to your tools via REST API

Create a free account View pricing