API documentation

API keys

Send the key in a header: X-CRM-API-Key: crm_sec_…

Some clients — agent builders especially — make you pick the header name from a fixed list. Any of these work and mean the same thing: x-api-key, api-key, apikey, or Authorization: Bearer crm_sec_…

Endpoints

Rate limiting

Webhook signature (verification at destination)

# How to verify on your server that the request comes from CRM:
# Header: X-CRM-Signature: sha256=<hex>
# Secret: the one returned by POST /api/crm/webhooks (whs_...)

import hmac, hashlib

def verify(body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Predefined segments

curl examples

Examples use crmcity.app, the domain CRM City is served from — copy one and it runs as written. If your CRM is served from your own domain, swap the host: all endpoints live under https://<your-domain>/api/crm.

# Smoke test
curl https://crmcity.app/api/crm/me \
  -H "X-CRM-API-Key: crm_sec_xxx..."

# Upsert contact (dedupe by email)
curl https://crmcity.app/api/crm/contacts \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"email":"ion@example.com","first_name":"Ion","phone":"+40712345678"}'

# Create an invitation — share its invite_url yourself; the email part is refused
# until your own email account can be connected
curl https://crmcity.app/api/crm/invitations \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "invitee_email":"vasile@example.com",
    "invitee_name":"Vasile",
    "target_type":"general",
    "target_label":"Sunday meeting",
    "message":"Come at 10:00 to the church.",
    "send":false
  }'

# Create company
curl https://crmcity.app/api/crm/companies \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"name":"Firma SRL","type":"client","city":"Cluj-Napoca"}'

# Create product
curl https://crmcity.app/api/crm/products \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"name":"Abonament Pro","sku":"PRO-1","price":49.99,"currency":"GBP"}'

# Place order (contact by email — created if missing; product by sku)
curl https://crmcity.app/api/crm/orders \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "email":"ion@example.com",
    "first_name":"Ion",
    "items":[{"sku":"PRO-1","quantity":2}]
  }'

# Enroll contact in a course (by email)
curl https://crmcity.app/api/crm/courses/COURSE_ID/enrollments \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"email":"ion@example.com","first_name":"Ion"}'

# Mark completion (the key flow for external course platforms)
curl https://crmcity.app/api/crm/enrollments/ENROLLMENT_ID \
  -X PATCH \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"status":"completed"}'

# Issue the certificate (response contains a public verification_url)
curl https://crmcity.app/api/crm/certificates \
  -X POST \
  -H "X-CRM-API-Key: crm_sec_xxx..." \
  -H "Content-Type: application/json" \
  -d '{"enrollment_id":"ENROLLMENT_ID"}'

# Paid invoices (read-only)
curl "https://crmcity.app/api/crm/invoices?status=paid" \
  -H "X-CRM-API-Key: crm_sec_xxx..."

# Bookings for the next 7 days (read-only)
curl "https://crmcity.app/api/crm/bookings?from=2026-07-02T00:00:00Z&to=2026-07-09T00:00:00Z" \
  -H "X-CRM-API-Key: crm_sec_xxx..."

Standard errors

{ "error": "code_string", "message": "Human-readable.", "field": "optional" }