Call your CRM from your own code

The Builder API is plain HTTPS and JSON at mcp.workspace369.com/v1, authenticated with a personal access token. POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Its OpenAPI spec is public at /v1/openapi.json. Webhooks push 27 events to your endpoint, signed with HMAC-SHA256. Both come with every plan from Cadet; a trial gets access once a card is saved.

Start free trial

14-day free trial. Card required. After the trial: from $29/month. Renews automatically every month until you cancel. Cancel anytime in Settings → Billing.

Request a demo

Every plan from Cadet; a trial gets access once a card is saved.

AI/AI connectionsAI/AI connections/Approvals

Personal access tokensTokens for scripts or AI agents that connect over MCP without the browser sign-in.

A token grants the permissions you pick to any client that presents it. Treat it like a password: it's shown only once, when you create it.Create token

Your tokens

No tokens yetCreate one to connect a script or agent.

Access

Allow AI connectionsWhen on, members can connect AI apps to this workspace.

Personal access tokensTokens for scripts or AI agents that connect over MCP without the browser sign-in.

A token grants the permissions you pick to any client that presents it. Treat it like a password: it's shown only once, when you create it.Create token

Your tokens

Invoice syncnever used · expires Jan 21, 20274 permissionsRevoke

Send without askingInvoices, emails, texts and contracts wait for your approval.

Access

Allow AI connectionsWhen on, members can connect AI apps to this workspace.

Approvals

My requestsEveryone

Waiting for you

Send invoice #INV-1042 for Juniper Bakery by emailA personal access token · 2 min agoWaiting

Email the proposal Spring menu refresh to the clientA personal access token · 14 min agoWaiting

Recent

Send invoice #INV-1038 for Orchard Dental by emailApproved by you · yesterdayDone

Send invoice #INV-1031 for Harbour Yoga by emailDeclined by you · 3 days agoDeclined

Approvals

My requestsEveryone

Waiting for you

Email the proposal Spring menu refresh to the clientA personal access token · 14 min agoWaiting

Recent

Send invoice #INV-1042 for Juniper Bakery by emailApproved by you · just nowDone

Send invoice #INV-1038 for Orchard Dental by emailApproved by you · yesterdayDone

Send invoice #INV-1031 for Harbour Yoga by emailDeclined by you · 3 days agoDeclined

1 request approved

Create personal access tokenScoped to your current workspace. The token is shown once.

Invoice sync

Permissions4 selected

workspace:readclients:readclients:writeinvoices:readinvoices:writeproposals:readproposals:writecontracts:readcontracts:writecontracts:sendprojects:readprojects:writetasks:readtasks:writecalendar:readcalendar:writenotes:readnotes:writetime_entries:readtime_entries:writeproducts:readproducts:writereminders:readreminders:writeinbox:readinbox:sendteam:readteam:writerequests:readrequests:writeautomations:readautomations:write

Automation triggers

Lets Zapier, Make and n8n start your automations when something happens.

webhooks:manage

Expiry

30 days90 days1 yearNo expiry

Create tokenCancel

AI connections

Personal access tokens

A token grants the permissions you pick to any client that presents it. Treat it like a password: it's shown only once, when you create it.Create token

Your tokens

No tokens yetCreate one to connect a script or agent.

Access

Allow AI connectionsWhen on, members can connect AI apps to this workspace.

AI connections

Personal access tokens

A token grants the permissions you pick to any client that presents it. Treat it like a password: it's shown only once, when you create it.Create token

Your tokens

Invoice syncnever used · expires Jan 21, 20274 permissions

Send without askingInvoices, emails, texts and contracts wait for your approval.

Access

Allow AI connectionsWhen on, members can connect AI apps to this workspace.

Approvals

My requestsEveryone

Waiting for you

Send invoice #INV-1042 for Juniper Bakery by emailA personal access token · 2 min agoWaiting

Email the proposal Spring menu refresh to the clientA personal access token · 14 min agoWaiting

Recent

Send invoice #INV-1038 for Orchard Dental by emailApproved by you · yesterdayDone

Send invoice #INV-1031 for Harbour Yoga by emailDeclined by you · 3 days agoDeclined

Approvals

My requestsEveryone

Waiting for you

Email the proposal Spring menu refresh to the clientA personal access token · 14 min agoWaiting

Recent

Send invoice #INV-1042 for Juniper Bakery by emailApproved by you · just nowDone

Send invoice #INV-1038 for Orchard Dental by emailApproved by you · yesterdayDone

Send invoice #INV-1031 for Harbour Yoga by emailDeclined by you · 3 days agoDeclined

Create personal access tokenScoped to your current workspace. The token is shown once.

Invoice sync

Permissions4 selected

Create tokenCancel

01: 8 resources with 32 operations, plus POST /v1/tools/{name} for any MCP tool your token's scopes allow.
02: Sending an invoice, proposal, contract or message returns 202 and waits for approval in the app.
03: 27 signed webhook events, with up to 6 delivery attempts.

What is a CRM API?

A CRM API lets your own code read and update CRM records over the internet instead of through the app. Workspace369's Builder API is plain HTTPS and JSON at mcp.workspace369.com/v1, authenticated with a personal access token. POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Sending an invoice, proposal, contract or message returns a 202 and waits for approval in the Workspace369 app, unless the token's Send without asking is on. Signed webhooks push 27 events to your endpoint when work changes.

Product reference

Reviewed November 4, 2026 by the Workspace369 Product Team. Availability can vary by plan, region, and workspace configuration.

Read the Builder API documentation

Plain HTTP, real answers, clear refusals.

Every tool is an HTTP call: POST /v1/tools/{name} runs any MCP tool your token's scopes allow, and REST shortcuts cover clients, proposals, invoices, contracts, projects, tasks, requests and calendar events. Pick a call to see what comes back.

Authenticate with a personal access token: Authorization: Bearer mcp_pat_…
8 resources with 32 operations, plus POST /v1/tools/{name} for any MCP tool your token's scopes allow
One error shape for every refusal, with a code your code can branch on

Open the OpenAPI spec Read the Builder API guide

Request

GET /v1/clients?query=acme&limit=5

Authorization: Bearer mcp_pat_••••

Response

200 OK

{
  "clients": [
    { "id": "cl_93Fa", "name": "Acme Co",
      "email": "billing@acme.test", "lifecycle_stage": "client" }
  ]
}

Reads come straight back. Results page with a cursor.

Request

POST /v1/invoices/inv_7Qm2/send

Authorization: Bearer mcp_pat_••••

Response

202 Accepted

{
  "held_for_approval": true,
  "approval_id": "apr_K81x",
  "approval_url": "https://app.workspace369.com/settings/approvals/apr_K81x",
  "approval_expires_at": "2026-10-21T16:00:00Z"
}

Held for approval: nothing is sent until a person approves it in the app, unless the token has Send without asking turned on. The request expires after an hour.

One error shape, codes you can branch on.

Every refusal returns { "error": { "code", "message", "details" } } with a status your code can act on.

Builder API error codes
Code	Status	What it means
unauthorized	401	The personal access token is missing or invalid.
usage_exhausted	402	The workspace has used its monthly AI usage. Top up and retry.
plan_required	403	The workspace has no plan yet. The response carries an upgrade link.
insufficient_scope	403	The token lacks a scope. details.required_scope names it.
payload_too_large	413	The request body is over 1 MB.
rate_limited	429	Over the limit. Wait for the Retry-After header, then retry.

Pick the events. Verify every delivery.

In Settings, under Data, choose Webhooks and New webhook, pick from 27 events, and copy the signing secret once. Every delivery is a signed JSON POST.

Signed: X-Webhook-Signature is an HMAC-SHA256 of the raw body plus X-Webhook-Timestamp, made with your signing secret. Rotate the secret any time.
Retried: Answer with a 2xx within 10 seconds. Otherwise the delivery is retried up to 5 more times, 6 attempts in all, with the same X-Webhook-Id. Deliveries are logged for 30 days.
Safe to repeat: Deliveries can arrive out of order or more than once, so skip any X-Webhook-Id you have already handled. Webhook deliveries use no AI usage.

Read the webhooks reference

New webhookCreate webhook

Endpoint

Endpoint URLhttps://api.northwind.test/hooks/w369ActivePause to stop deliveries without deleting the webhook.

Events4 selected

Choose which events this endpoint receives.

Time entriesCreatedUpdatedDeleted

TimesheetsSubmittedApprovedRejected

InvoicesCreatedPaidPaidStatus changed

ProposalsSentAcceptedAcceptedDeclined

ContractsSentRecipient completedCompletedCompletedDeclinedVoidedExpired

BookingsCreatedRescheduledCancelledNo show

ClientsCreatedStage changed

RequestsCreatedCreatedConvertedArchived

What your endpoint receives

POST /hooks/w369

X-Webhook-Id: 7c41e0b9…

X-Webhook-Timestamp: 1792594800000

X-Webhook-Signature: 5d2a9f3c…

"event_type": "invoice.paid",
"entity_id": "inv_7Qm2",
"data": { "invoice_status": "Paid", "balance_due": 0 }

200 OK

Pick the events you need.

27 events come in 8 families. Subscribe to the ones you need, up to 50 webhooks per workspace. Managing webhooks takes the Manage webhooks permission.

Webhook events by family
Family	Events
Time entries	time_entry.created, time_entry.updated, time_entry.deleted
Timesheets	timesheet.submitted, timesheet.approved, timesheet.rejected
Invoices	invoice.created, invoice.paid, invoice.status_changed
Proposals	proposal.sent, proposal.accepted, proposal.declined
Contracts	contract.sent, contract.recipient_completed, contract.completed, contract.declined, contract.voided, contract.expired
Bookings	booking.created, booking.rescheduled, booking.cancelled, booking.no_show
Requests	lead.created, lead.converted, lead.archived
Clients	client.created, client.stage_changed

Send email from code, and connect your automation tools.

The Email API is a send-only endpoint with its own workspace key. The Workspace369 app for Zapier (beta; join with the invite link on the Zapier page) starts Zaps from them, and Make and n8n listen for the same signed webhooks.

Create personal access token

Scoped to your current workspace. The token is shown once.

Invoice sync

Permissions4 selected

workspace:readworkspace:readclients:readclients:readclients:writeinvoices:readinvoices:readinvoices:writeinvoices:writeproposals:readproposals:writecontracts:readcontracts:writecontracts:sendprojects:readprojects:write

Expiry

30 days90 days90 days1 yearNo expiry

CancelCreate token

Token created

Copy this now. You won't be able to see it again.

mcp_pat_••••••••••••••••Copy token

Tokens with limits you choose, and nothing hidden.

Once an admin turns on AI connections, you can create a personal access token in Settings, under AI. It carries only the scopes and the expiry they pick, and the workspace can see and stop it.

Never more than its creator: Every call is checked live against the member's role, so a token can't do what its creator can't.
Every call is logged: The call log records the app, member, tool, scope, outcome and AI usage. It keeps field names, never the values.
Admins can revoke any token: Workspace admins see every member's tokens. A revoked token stops working immediately.
A steady pace: Up to 120 calls a minute per token and 600 per workspace, shared with MCP, with a 1 MB request body. Over the limit you get a 429 with Retry-After.

The API and webhooks on every plan, from Cadet.

The Builder API at mcp.workspace369.com/v1 and signed webhooks come with every plan from Cadet. A trial gets access once a card is saved. Each successful call uses the same AI usage as the matching MCP call.

Compare plans

tools on the server: 127
webhook events: 27
calls a minute per token: 120

Plans	Cadet$29/mo	Voyager$74/mo	Specialist$149/mo	Commander$299/mo	Enterprise$699/mo
Builder API	Every plan	Included	Included	Included	Included	Included
Webhooks	Every plan	Included	Included	Included	Included	Included
AI connections (MCP)	Every plan	Included	Included	Included	Included	Included

Failed or refused calls use no AI usage.

Builder API and Webhooks questions

Which plans include the Builder API?

Every plan from Cadet, and a free trial gets access once a card is saved in Billing. An owner or admin must have switched on Allow AI connections in Settings, under AI. Webhooks come with every plan from Cadet too.#

Does the free trial include the API?

Yes, once a card is saved. The 14-day trial then has the Builder API and webhooks like any plan.#

How do I authenticate?

Create a personal access token in Settings, under AI, with Create token. Choose its permissions and expiry (30 days, 90 days, 1 year or none), copy it once, and send it as Authorization: Bearer mcp_pat_... on every request. Each call is checked against the creating member's live permissions as well as the token's scopes.#

Where is the OpenAPI spec?

It is public, with no token needed, at /v1/openapi.json on the same host. It is built from the live tool registry, so it matches what the server accepts.#

How do I verify a webhook?

Each delivery carries X-Webhook-Signature, X-Webhook-Timestamp and X-Webhook-Id. The signature is a hex HMAC-SHA256 of the raw request body followed by the timestamp, made with your signing secret. Answer with a 2xx within 10 seconds; failed deliveries are retried up to 5 more times, and X-Webhook-Id stays the same on every retry.#

Do API calls use AI usage?

Yes. Each successful call uses the same AI usage as the matching MCP call, from the plan's monthly allowance. Failed or refused calls use none, and webhook deliveries use none.#

Should I use the API or MCP?

Use the Builder API when your own code or a script makes the calls. Use the MCP server when an AI app such as Claude or ChatGPT makes them. Both run the same tools with the same permissions, approvals, rate limits and audit log.#

Point your code at a workspace where sends wait for a yes by default.

Start a trial, save a card, create a personal access token in Settings, and make your first call.

Start free trial Request a demo

14-day free trial. Card required. After the trial: from $29/month. Renews automatically every month until you cancel. Cancel anytime in Settings → Billing.

See pricing

Start free trial Request a demo

14 days free · card required · then $29/mo · cancel anytime