# Call your CRM from your own code

> Call your CRM from your own code over HTTPS and JSON, with a public OpenAPI spec and 27 signed webhook events. Every plan from Cadet.

Canonical: https://workspace369.com/features/api/
Last updated: 2026-11-04

The Builder API is plain HTTPS and JSON at mcp.workspace369.com/v1, authenticated with a personal access token. POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Its OpenAPI spec is public at /v1/openapi.json. Webhooks push 27 events to your endpoint, signed with HMAC-SHA256. Both come with every plan from Cadet; a trial gets access once a card is saved.

14-day free trial. Card required. After the trial: from $29/month. Renews automatically every month until you cancel. Cancel anytime in Settings → Billing.

[Request a demo](https://workspace369.com/contact-sales/)

Every plan from Cadet; a trial gets access once a card is saved.

01

8 resources with 32 operations, plus POST /v1/tools/{name} for any MCP tool your token's scopes allow.

02

Sending an invoice, proposal, contract or message returns 202 and waits for approval in the app.

03

27 signed webhook events, with up to 6 delivery attempts.

## What is a CRM API?

A CRM API lets your own code read and update CRM records over the internet instead of through the app. Workspace369's Builder API is plain HTTPS and JSON at mcp.workspace369.com/v1, authenticated with a personal access token. POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Sending an invoice, proposal, contract or message returns a 202 and waits for approval in the Workspace369 app, unless the token's Send without asking is on. Signed webhooks push 27 events to your endpoint when work changes.

Product reference

Reviewed November 4, 2026 by the Workspace369 Product Team. Availability can vary by plan, region, and workspace configuration.

[Read the Builder API documentation](https://docs.workspace369.com/v/2026.3/build-with-ai/call-workspace369-over-http-builder-api/)

## Plain HTTP, real answers, clear refusals.

Every tool is an HTTP call: POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Pick a call to see what comes back.

- Authenticate with a personal access token: Authorization: Bearer mcp\_pat\_…
- 8 resources with 32 operations, plus POST /v1/tools/{name} for any MCP tool your token's scopes allow
- One error shape for every refusal, with a code your code can branch on

[Open the OpenAPI spec](https://mcp.workspace369.com/v1/openapi.json)[Read the Builder API guide](https://docs.workspace369.com/v/2026.3/build-with-ai/call-workspace369-over-http-builder-api/)

Request

**GET** /v1/clients?query=acme&limit=5

Authorization: Bearer mcp\_pat\_••••

Response

200 OK

```
{
  "clients": [
    { "id": "cl_93Fa", "name": "Acme Co",
      "email": "billing@acme.test", "lifecycle_stage": "client" }
  ]
}
```

Reads come straight back. Results page with a cursor.

## One error shape, codes you can branch on.

Every refusal returns { "error": { "code", "message", "details" } } with a status your code can act on.

**Builder API error codes**

| Code | Status | What it means |
| --- | --- | --- |
| unauthorized | 401 | The personal access token is missing or invalid. |
| usage\_exhausted | 402 | The workspace has used its monthly AI usage. Top up and retry. |
| plan\_required | 403 | The workspace has no plan yet. The response carries an upgrade link. |
| insufficient\_scope | 403 | The token lacks a scope. details.required\_scope names it. |
| payload\_too\_large | 413 | The request body is over 1 MB. |
| rate\_limited | 429 | Over the limit. Wait for the Retry-After header, then retry. |

**Call it from your code** Start a free trial, save a card, create a personal access token and make your first call.

## Pick the events. Verify every delivery.

In Settings, under Data, choose Webhooks and New webhook, pick from 27 events, and copy the signing secret once. Every delivery is a signed JSON POST.

Signed

X-Webhook-Signature is an HMAC-SHA256 of the raw body plus X-Webhook-Timestamp, made with your signing secret. Rotate the secret any time.

Retried

Answer with a 2xx within 10 seconds. Otherwise the delivery is retried up to 5 more times, 6 attempts in all, with the same X-Webhook-Id. Deliveries are logged for 30 days.

Safe to repeat

Deliveries can arrive out of order or more than once, so skip any X-Webhook-Id you have already handled. Webhook deliveries use no AI usage.

[Read the webhooks reference](https://docs.workspace369.com/v/2026.3/build-with-ai/webhooks-reference/)

What your endpoint receives

## Pick the events you need.

27 events come in 8 families. Subscribe to the ones you need, up to 50 webhooks per workspace. Managing webhooks takes the Manage webhooks permission.

**Webhook events by family**

| Family | Events |
| --- | --- |
| Time entries | time\_entry.created, time\_entry.updated, time\_entry.deleted |
| Timesheets | timesheet.submitted, timesheet.approved, timesheet.rejected |
| Invoices | invoice.created, invoice.paid, invoice.status\_changed |
| Proposals | proposal.sent, proposal.accepted, proposal.declined |
| Contracts | contract.sent, contract.recipient\_completed, contract.completed, contract.declined, contract.voided, contract.expired |
| Bookings | booking.created, booking.rescheduled, booking.cancelled, booking.no\_show |
| Requests | lead.created, lead.converted, lead.archived |
| Clients | client.created, client.stage\_changed |

## Send email from code, and connect your automation tools.

The Email API is a send-only endpoint with its own workspace key. The Workspace369 app for Zapier (beta; join with the invite link on the Zapier page) starts Zaps from them, and Make and n8n listen for the same signed webhooks.

- [**Email API**POST /v1/email/messages sends transactional email with a workspace key, separate from your personal access tokens.](https://workspace369.com/blog/transactional-email-api-for-small-business/)
- [**Zapier, Make and n8n**Join the Workspace369 app for Zapier (beta) with the invite link, or start Zapier, Make and n8n automations from the signed webhooks above and call the Builder API from their HTTP steps.](https://workspace369.com/integrations/zapier/)
- [**Call from your server**A walk-through of calling Workspace369 from your own server and drafting invoices.](https://workspace369.com/integrations/api-workflows/)

## Tokens with limits you choose, and nothing hidden.

Once an admin turns on AI connections, you can create a personal access token in Settings, under AI. It carries only the scopes and the expiry they pick, and the workspace can see and stop it.

Never more than its creator

Every call is checked live against the member's role, so a token can't do what its creator can't.

Every call is logged

The call log records the app, member, tool, scope, outcome and AI usage. It keeps field names, never the values.

Admins can revoke any token

Workspace admins see every member's tokens. A revoked token stops working immediately.

A steady pace

Up to 120 calls a minute per token and 600 per workspace, shared with MCP, with a 1 MB request body. Over the limit you get a 429 with Retry-After.

## The API and webhooks on every plan, from Cadet.

The Builder API at mcp.workspace369.com/v1 and signed webhooks come with every plan from Cadet. A trial gets access once a card is saved. Each successful call uses the same AI usage as the matching MCP call.

[Compare plans](https://workspace369.com/pricing/)

tools on the server

127

webhook events

27

calls a minute per token

120

| Plans | **Cadet**$29/mo | **Voyager**$74/mo | **Specialist**$149/mo | **Commander**$299/mo | **Enterprise**$699/mo |  |
| --- | --- | --- | --- | --- | --- | --- |
| Builder API | Every plan | Included | Included | Included | Included | Included |
| Webhooks | Every plan | Included | Included | Included | Included | Included |
| AI connections (MCP) | Every plan | Included | Included | Included | Included | Included |

Failed or refused calls use no AI usage.

## Builder API and Webhooks questions

**Which plans include the Builder API?**

Every plan from Cadet, and a free trial gets access once a card is saved in Billing. An owner or admin must have switched on Allow AI connections in Settings, under AI. Webhooks come with every plan from Cadet too.

**Does the free trial include the API?**

Yes, once a card is saved. The 14-day trial then has the Builder API and webhooks like any plan.

**How do I authenticate?**

Create a personal access token in Settings, under AI, with Create token. Choose its permissions and expiry (30 days, 90 days, 1 year or none), copy it once, and send it as Authorization: Bearer mcp\_pat\_... on every request. Each call is checked against the creating member's live permissions as well as the token's scopes.

**Where is the OpenAPI spec?**

It is public, with no token needed, at /v1/openapi.json on the same host. It is built from the live tool registry, so it matches what the server accepts.

**How do I verify a webhook?**

Each delivery carries X-Webhook-Signature, X-Webhook-Timestamp and X-Webhook-Id. The signature is a hex HMAC-SHA256 of the raw request body followed by the timestamp, made with your signing secret. Answer with a 2xx within 10 seconds; failed deliveries are retried up to 5 more times, and X-Webhook-Id stays the same on every retry.

**Do API calls use AI usage?**

Yes. Each successful call uses the same AI usage as the matching MCP call, from the plan's monthly allowance. Failed or refused calls use none, and webhook deliveries use none.

**Should I use the API or MCP?**

Use the Builder API when your own code or a script makes the calls. Use the MCP server when an AI app such as Claude or ChatGPT makes them. Both run the same tools with the same permissions, approvals, rate limits and audit log.

## Related features

These features connect directly with this workflow in day-to-day client work.

[MCP Server Run your CRM from Claude, ChatGPT or Cursor, with sends held for your approval. *Explore feature*](https://workspace369.com/features/mcp/)[Workspace AI Chat, drafting, translation, and knowledge search inside the workspace. *Explore feature*](https://workspace369.com/features/ai-chat/)[Workflow Automations Email, SMS, tasks, reminders, and team notifications with test runs and logs. *Explore feature*](https://workspace369.com/features/automation/)

## Point your code at a workspace where sends wait for a yes by default.

Start a trial, save a card, create a personal access token in Settings, and make your first call.

[Request a demo](https://workspace369.com/contact-sales/)

[See pricing](https://workspace369.com/pricing/)

[Request a demo](https://workspace369.com/contact-sales/)

14 days free · card required · then $29/mo · cancel anytime