Automatic REST API and webhooks

03How it works

How it works step by step.

1. 1

   How the automatic API works

   The API has no per-entity code. A single set of generic routes serves every entity known to the system. When an administrator adds an entity, field or relationship—or when a new module is deployed—the API, validation and documentation exist immediately, scoped to that company and the caller’s permissions.

   Read in detail

   Three checks determine whether an entity is accessible: the API flag on the entity, the module enabled for the company, and the caller’s permissions including the API key policy. A hidden entity responds with “not found” and does not even reveal that it exists. The password vault and user preferences are not accessible via the API. Both a signed-in browser session and a header token work under the same rules and audit logging as the application.

2. 2

   What the API can do

   Every entity supports listing, detail retrieval, creation, full or partial updates and soft deletion. Partial updates support optimistic locking by record version, preventing two concurrent edits from overwriting each other. You can also query the entity description (fields, relationships, actions), fetch a list of IDs for a filtered set (up to 500) and export records (up to 1,000).

   Read in detail

   In bulk, you can create up to 100 records, update up to 500 and delete up to 100; a combined batch of creates, updates and deletes runs in a single transaction. Aggregations return sums, averages and other metrics or counts grouped by field. The API also handles relationships (attach, detach, sync), related-record panels, change history, audit logs, attachments, single-record and selection actions, record conversions with preview, value picklists and global search.

   Managed statuses can only be changed through actions.

3. 3

   Queries and filters

   Filters can be written in several ways: bracket notation, OR groups, a nested tree, shorthand expressions such as amount>=10000, JSON or a saved filter. Full-text search, sorting, pagination (20 by default, up to 200 records per page), field selection and eager loading of related records are all supported.

   Read in detail

   Operators cover comparisons, contains, starts with, ranges, empty values, multi-value selection, date presets such as this month or last 30 days, and links to the current user or their team. The API rejects unknown fields, fields without read permission or disallowed operators, so filters cannot be used to probe data the caller is not allowed to see.

4. 4

   Documentation, authentication and rate limits

   The OpenAPI 3.1.2 specification is generated at runtime from metadata and from the caller’s perspective: entities and operations the caller is not allowed to use are omitted. Administrators can browse it in the administration panel using the Scalar viewer. Validation and documentation share the same definitions, so they never drift apart on covered routes.

   Read in detail

   You obtain a token by signing in (including a second-factor code if enabled) or by signing with an SSH key for command-line agents. Users manage API keys and MCP tokens in their profile. The rate limit is 240 requests per minute per company and user; after 10 failed token attempts per minute, the IP address is throttled. Every token-authenticated call is recorded in the access log.

5. 5

   Webhooks

   An outbound webhook is an action in an Automation workflow. It is triggered when a record is changed or deleted, on a schedule, manually or by a domain event. It sends a POST, PUT or PATCH request with custom headers and a body template. The target URL is checked against SSRF protection, redirects are disabled and the timeout is 30 seconds. Requests are unsigned; failed calls are logged and retried only for atomic workflows or actions configured to stop on error.

   Read in detail

   An incoming webhook receives data at a dedicated endpoint protected by a shared secret in the header. It is processed by a handler registered by the module, such as capturing CRM leads, call recordings, or Mattermost push events. Every call is logged along with its result.