A CRM developer API built for both integrations and AI assistants
CrmLeaf's developer platform gives you a token-authenticated REST API, webhooks with a delivery log, a certificate-secured public API for partner systems, and an MCP server so Claude, Cursor or VS Code can work with your CRM data inside your own permissions.
- ✓Free trial
- ✓No credit card
- ✓Free onboarding
AI agent? Bots are welcome. Agent instructionsllms.txt
REST API
$ curl https://api.example.com/api/v1/leads \
-H "Authorization: Bearer crmleaf_pat_••••7f3a"
200 OKread-only token · 30-day expiry
{
"data": [
{ "id": 2291, "name": "Priya Shah", "stage": "qualified" },
{ "id": 2290, "name": "Arjun Mehta", "stage": "new" }
],
"meta": { "page": 1, "total": 148 }
}AI assistant · MCP
Which leads came in this week?
12 new leads this week - 4 already qualified. Priya Shah is the highest-value.
No delete tools · audit-logged
What's inside
Six developer capabilities
REST API
Standard REST endpoints over api/v1, authenticated with tokens.
API Tokens & Scopes
Self-issued tokens, read-only or read-write, with a 30-day default expiry.
Webhooks
Outbound and inbound events with a delivery log, for direct integrations.
Public API (mTLS)
Certificate-secured endpoints built for partner and system integrations.
MCP Server
68 tools for AI assistants - sign in, work within your permissions, every write logged.
API Documentation
Setup guides, markdown pages, llms.txt and a docs MCP server for AI agents.
Capability 01
REST API
CrmLeaf's REST API exposes the platform's core objects over versioned endpoints (api/v1), authenticated with personal access tokens rather than session cookies. A token acts as the person who issued it, so every call is bound by that person's permissions. The REST API is an add-on module, enabled per account.
- Versioned endpoints (api/v1)
- Personal access tokens
- Add-on module
Built in
- REST endpoints over api/v1, authenticated with tokens
- Every call runs as the token's owner, within their permissions
- Enabled per account as an add-on module
Capability 02
API Tokens & Scopes
Personal access tokens are issued from Profile → Access Tokens, with a 30-day default validity and a choice of read-only or read-write, so an integration or assistant gets exactly the access it needs and nothing more. Each token is pinned to the company and organisation it was created in.
- Self-issued
- Read-only or read-write
- 30-day default expiry
- One workspace
Built in
- Self-issued personal access tokens with a 30-day default expiry
- Read-only or read-write per token, re-checked against your own permissions
- Used for REST API integrations, and for AI assistants that cannot sign in
Capability 03
Webhooks
The webhook engine gives you configurable outbound and inbound webhooks with a delivery log, for when you or a developer want a direct connection to CrmLeaf rather than a middleware service like Zapier. Every delivery is recorded, so you can tell whether an automation actually received the data.
- Outbound & inbound events
- Delivery log
- Add-on module
Built in
- Configurable outbound webhooks that send data to a URL you own when something happens in CrmLeaf
- Inbound webhooks that let an external system send data in
- A delivery log recording every attempt, so a missed automation is easy to diagnose
Capability 04
Public API (mTLS)
For partner and system integrations that need machine-to-machine access with stronger authentication than a bearer token, CrmLeaf offers a certificate-secured (mTLS) public API endpoint.
- Certificate authentication
- Built for partner systems
Built in
- mTLS certificate-authenticated endpoints for machine-to-machine access
- Aimed at partner and system integrations rather than ad-hoc scripting
- An add-on module, with certificate setup arranged with our team
Capability 05
MCP Server
CrmLeaf's MCP server, at https://mcp.crmleaf.com/mcp, exposes 68 tools and 25 reference resources so an AI assistant - Claude.ai, Claude Desktop, Claude Code, Cursor, VS Code or any remote MCP client - can read and update your deals, invoices, projects, tasks, time logs and more. You add the address and sign in with your account (OAuth 2.1), or use a personal access token. It calls CrmLeaf as you, so it is bound by the same workspace scoping and per-user permissions you already have; it has no delete tools by design, and every write is audited with field names, never values.
- 68 tools, 25 resources
- Sign in with OAuth 2.1
- No delete tools by design
- Every write audited
Built in
- 68 tools across 13 areas, bound by the same permissions as the person connecting
- Works with Claude.ai, Claude Desktop, Claude Code, Cursor, VS Code and any remote MCP client
- No delete tools, by design
- Audit trail records who acted, the token or connection, the action, the record and the field names - never the field values
Capability 06
API Documentation
Step-by-step guides for access tokens, AI assistants, webhooks and integrations live in the CrmLeaf help centre. Every page is also available as markdown at its .md URL, with an llms.txt index and a read-only docs MCP server, so AI agents can read the documentation directly.
- Help centre guides
- Markdown variants
- llms.txt
- Docs MCP server
Built in
- Guides for tokens, AI assistants, webhooks and integrations
- A markdown variant of every page, plus llms.txt and an agent skill file
One API, the same permissions as your team
Every developer surface - REST, webhooks, the public API and the MCP server - reads and writes through the same ownership-scoped permissions your team already has. Nothing here is a separate, less-audited path into your data.
See Roles & Permissions →Administration
Same roles, same ownership-scoped visibility
Integrations
40+ integrations, several webhook-driven
AI & Automation
Workflow Automation triggers alongside the API
Security
Writes through tokens and MCP are audited too
Common questions about CrmLeaf's developer platform
Start building on CrmLeaf
Generate a token, call the API, or point your AI assistant at the MCP server - all inside your free trial.