NoxCRM API
The NoxCRM REST API lets you capture leads, manage contacts, update pipelines, and connect external systems. This page describes the authentication boundary and endpoint surface. The raw OpenAPI document is the integration source of truth.
Contract boundary
- Title: NoxCRM API
- Version: 1.0.0
- Authentication: bearer authentication is the contract default; operations that override security are explicitly public in the OpenAPI document.
- Base path: each server includes
/api/v1; operation paths below are relative to that versioned base. A listed production server is not proof that a deployment is live.
Authentication
Authenticate requests with a personal access token sent as a bearer token in the Authorization header. Create and revoke tokens from your account; a token is scoped to your workspace. Do not put tokens in URLs or client-side code.
Getting an API token
- Sign in to your NoxCRM workspace.
- Open your account settings and create a personal access token.
- Copy the token once — it is shown only at creation time.
- Send it as
Authorization: Bearer <token>on every request. - Revoke tokens that are no longer used.
Endpoint surface
The full endpoint list is generated from the canonical OpenAPI document. Key areas include:
| Area | Example operations |
|---|---|
| Authentication | POST /auth/login, POST /auth/otp/request, POST /auth/passkeys, POST /auth/refresh |
| Contacts | GET /contacts, POST /contacts, search and filtering, custom field values |
| Leads and pipelines | Lead and deal records, stage movement, lost reasons, pipeline metrics |
| Tasks | POST /tasks, task queue create/list/update |
| Forms | Public form rendering and submissions |
| Workflows | Publish, manual run, test, enable, disable, DLQ, and replay |
| Webhooks | Endpoints, deliveries, test, and replay |
| Automation | Blueprints, blueprint installations, agency clients |
For the complete, always-current table of operations, open the NoxCRM API reference in the developer documentation.
Webhooks
NoxCRM supports webhook endpoints with deliveries, test, and replay. Configure an endpoint in the workspace, choose the events you want to receive, and use the replay tool to re-send a failed delivery after fixing the receiver.
Rate limits and errors
Read the OpenAPI document for per-operation details. Handle 4xx responses as client errors and 5xx as server errors; implement idempotency where the operation can be repeated safely.
Verification
This page describes the checked-in contract, not proof that a particular deployment is live. Before integrating, confirm the deployed API version and test against the environment you will use in production.