Integrate EasyCRM into your systems via REST API.
REST API v1 with granular permission scopes and bearer token authentication. Outbound webhooks with HMAC-SHA256 signing notify you of selected events in the CRM.
Granular permission scopes – exactly what the integration needs
The EasyCRM REST API v1 covers contacts, leads, opportunities, activities, sales (products, quotations, orders), inbox conversations, call logs, reports, pipelines, custom fields, sales teams and delta sync. Every API token carries explicit permission scopes – for example `read:contacts`, `write:opportunities`, `read:reports` or `write:calls` – so a third-party integration only has access to what it needs. You obtain a token through `POST /api/v1/auth/token` and send it in the `Authorization: Bearer <token>` header. The request limit applies per token and depends on the plan: Standard 10 requests per minute, Pro up to 1,000, plus a burst limit of 60 requests per 5 seconds. API access is available from the Standard plan.
- Named permission scopes (read/write per domain)
- Bearer token authentication
- Per-plan request limit and a burst limit of 60 req/5 s
- Pagination for list endpoints
- Delta sync endpoint (GET /api/v1/sync/changes)
HMAC-signed events with redelivery
EasyCRM sends HTTP POST notifications to your endpoint URL for selected events. Each webhook request is signed with HMAC-SHA256 using your subscription's secret key – verify the signature in the `X-EasyCRM-Signature` header (format `sha256=...`), sent together with an `X-EasyCRM-Timestamp` header. Six events are sent: `lead.converted`, `opportunity.stage_changed`, `deal.won`, `deal.lost`, `call.logged` and `message.received`. If your endpoint does not respond, EasyCRM retries delivery up to 5 times with increasing delays; after that the event lands in the dead letter queue (DLQ), from where you can manually redeliver it in settings. SSRF protection blocks private and local IP ranges. Webhooks are available on the Pro plan.
- Six webhook event types
- HMAC-SHA256 signature on every event – verifiable on your side
- Delivery log with HTTP status and response body
- Retries and a DLQ with manual redelivery
- SSRF protection – private IP addresses are blocked
Extend EasyCRM with your own plugins
EasyCRM provides a declarative plugin framework for integrations. A plugin is defined by a JSON manifest that describes the permission scopes it requests, the webhook events it subscribes to and the places in the interface where it appears. During installation the organisation administrator sees a consent screen listing the requested scopes, events and placements. Once approved, EasyCRM issues the plugin a token with those scopes and creates its webhook subscription. The plugin framework is available on the Pro plan.
- Declarative JSON manifest
- Consent screen showing the requested scopes at install time
- Per-plugin permission scopes and webhook event subscriptions
- Placements in the CRM interface for plugin content
EasyCRM as a building block for your systems
- API covering contacts, sales, inbox and reports
- Precise permission scopes – integrations get only what they need
- HMAC-signed webhooks – verifiable on your side
- Retries and manual redelivery from the DLQ
- Plugin framework for custom extensions (Pro)
Developer questions
Connect EasyCRM to your tools via REST API
Sign up and try the API. API access is available from the Standard plan.