API keys and the API reference

The TicAte CRM API lets other software read and write your CRM: your website, an accounting system, a reporting tool or something a developer builds for you. Each piece of software gets its own API key. You manage keys under Settings → API (in the AI & integrations group).

Only owners and admins can make and revoke keys. The API comes with some plans only; if yours does not include it, making a key says which plan does.

What the API page shows

• Base URL: the address calls go to. It is your own workspace's address.
• API reference: opens the full reference.
• Rate limits: how many calls a key, a signed-in person, and sign-ins per internet address may make in a set time.
• Requests: calls made with your keys over the last 14 days.
• Keys: every key with its scope, the role it acts as, who made it, when it was last used and how many requests it has made.

Make a key

1. Open Settings and choose API.
2. Under Keys, click New key.
3. In What is this key for?, give it a name you will recognise, such as "Website form" or "Zapier".
4. Choose the Scope:
   • Read — can only look: for reports and dashboards.
   • Write — can create and change: for anything that adds or updates records.
5. Choose Acts as: the role the key works with, such as Agent or Manager. You cannot pick a role above your own.
6. Click Make key.
7. Copy the key straight away, give it to whoever needs it, and click I've copied it.

Choose Read unless the software really needs to make changes, and the lowest role that does the job.

What a key can do

• A key works as the person who made it, with the role chosen under Acts as. Records it creates belong to that person.
• It can never do more than its maker's current role. If their role is lowered, the key is lowered too. If they are dismissed, the key stops working.
• A Read key can only look. Anything else is refused.
• A key can only use the parts of the API listed in the reference.

Revoke a key

Click the bin on the key's row and confirm. Anything using it stops working at once. Revoked keys stay in the list, greyed out, so you can see what they did.

The API reference

Click API reference on the API page, or go to /docs/api on your workspace's address. It covers getting started, authentication, rate limits, errors, filtering, and every endpoint with its fields and a ready-to-copy example. The reference opens without signing in, so you can send the link to a developer.

Calls send the key in the Authorization header, as Bearer followed by the key. To find the name of a field to send or read, see Settings → Field codes and its API path column. See Field codes.