Pick a CRM with a bad API and you'll feel the pain three months later, when your ops person asks for a Slack alert on hot leads and you realise the only path is a $200/mo Zapier subscription. Your CRM is only as flexible as its API. Webhooks, rate limits, SDKs, OpenAPI specs, paginate-or-die: the boring developer details are what decide whether you ship integrations in an afternoon or pay an agency for two weeks.

I've shipped integrations on top of more than a dozen CRM APIs over the last three years. This article is the honest scorecard for the nine CRMs whose APIs I'd actually build on in 2026, ranked by what matters when you're the one writing the curl request. Every claim is checked against the vendor's official docs page. Receipts at the bottom of each section.

If you only read one image, read this one. 👇

Nine stat cards, one per CRM. Base URL, rate limit, webhook story, SDK landscape, plus the one feature most teams forget to check: does the API return your LinkedIn, Telegram and WhatsApp conversations?

Six things that make a CRM API worth building on 🛠️

These are the criteria I'm scoring against. None of them are about marketing. All of them are about what happens when you actually open Postman or VS Code.

1. Public, versioned REST or GraphQL docs. If the docs require a sales call, it's not a developer API, it's a marketing surface.

2. OAuth and API key both supported. OAuth for end-user apps, API keys for scripts and internal tools. If you only get one, you'll outgrow it.

3. Documented rate limits. "Reasonable use" isn't a rate limit, it's a lawsuit waiting to happen at 3am. You want a number to plan against.

4. Webhook subscriptions. Push beats poll. Without webhooks, every integration becomes a cron job hammering /list.

5. Real SDKs or a clean OpenAPI spec. Either a maintained client library, or an OpenAPI file you can generate one from.

6. Coverage of the actual sales workflow. Records, tasks, notes, fields, custom objects. Bonus points if conversations across every channel salespeople use show up in the API too. That last one is rare. We'll get to it.

#1 Breakcold: the API that returns your whole inbox in one call 🏆

Bias warning: I co-founded Breakcold. So skip my superlatives, just read the endpoint names. They speak for themselves.

Breakcold's REST API exposes 49 documented endpoints across workspaces, CRM metadata (object types, fields, field options, record views), records, tasks, notes and a multichannel inbox. Everything is generated from one OpenAPI contract, so what you can do in the product, you can do over HTTP. Base URL: https://http.us.breakcold.com/api/v1 (or http.eu.breakcold.com for the EU region).

The thing nobody else has: a single endpoint that returns email + LinkedIn + Telegram + WhatsApp conversations on a record. GET /records/{id}/conversations. That's the API equivalent of having your whole inbox in your CRM. The first time you build a workflow on top of it, you stop wondering why every other "AI sales CRM" article talks about email and only email.

One call, four channels. The response is a flat list of conversation objects, each with its own channel field. Same shape across email, LinkedIn, Telegram and WhatsApp, so your code stays clean.

Hello, world (sort of)

Auth is a Bearer header. API keys live in Settings → API keys in the Breakcold app, you pick scopes at creation time, and the full key is shown once. After that it's a one-liner:

Cursor pagination on every list endpoint (limit 1-100, plus a cursor string in the response). Timestamps are Unix epoch milliseconds. The 6 scopes (records:read/write, crm:metadata:read/write, tasks:read/write, notes:read/write, inbox:read, inbox:views:read/write) map to the same OAuth scopes our MCP server uses, so anything you build on REST also works the moment you swap to an MCP client.

The endpoint highlight reel 🌟

• GET /records/{id}/conversations ← the killer one. Returns email + LinkedIn + Telegram + WhatsApp threads attached to a contact, on one call.

• POST /crm/objects + POST /crm/fields: define new object types (Properties, Loans, Patients, Vehicles, anything) and their fields programmatically. Compete head-to-head with Attio on this.

• POST /records with a fields map keyed by slug: create a person/company/deal/custom-object without touching the UI.

• PATCH /records/{id}: field-level updates, so external systems can sync one field at a time without read-then-write race conditions.

• POST /crm/record-views: define a saved Smart View (table, kanban, list) from your dashboard tool. Looker/Retool/Metabase can spawn matching views inside Breakcold so the ops team has the same filter as the dashboard.

• POST /records/{id}/tasks + POST /tasks/{id}/complete: full task lifecycle, including assignees.

Rate limit: 120 requests per minute per route per organization. Predictable, easy to plan against. The REST API does not consume Breakcold AI tokens, those are reserved for AI actions and waterfall enrichment.

Real integrations our customers ship on top of this 🔧

• 📥 Pipe Lemlist / HeyReach / Instantly / Smartlead replies into Breakcold as new records. Lead-gen agencies do this on day one. The reply email is created with POST /records, then the conversation gets attached on the next sync.

• 📢 Slack alert on a hot LinkedIn DM. A polling job (or webhook receiver, see below) on /records/{id}/conversations filters for "channel": "linkedin" in the last 60 seconds, posts to Slack with the prospect name and snippet.

• 📈 Retool dashboard for the founder. Records list with search + workspace ID, group by stage, count by week. Custom dashboards in 20 minutes.

• 🧹 Friday afternoon CRM hygiene script. List archived records, restore the ones touched in the last 14 days, push any deal that's been idle 30+ days to a "stalled" stage with PATCH /records/{id}.

• 🧪 Migration tooling. Read your old CRM, map fields, push everything into Breakcold via POST /records with the right objectTypeSlug. The agencies that switch from HubSpot or Folk to Breakcold script this themselves.

• 🛠️ Clay enrichment loop. Steven Brady runs Clay → Breakcold via the API and closes deals across LinkedIn, WhatsApp, Telegram and email. Receipt below.

Steven Brady on LinkedIn: $17,250 MRR closed in 4 months running deals across LinkedIn, WhatsApp, Telegram and Email through Breakcold, with Clay piped in via API. Exactly the kind of stack the API was built for.

Two honest caveats ⚠️

No bulk-record endpoint yet (one POST per record), and the public REST docs don't expose a webhook subscription endpoint at the moment. Inside the product we ship a Webhook Sender + Webhook Receiver pair that handles real-time push for most teams (KB article: Webhook Sender / Webhook Receiver). If you need a subscription API for events, it's on the roadmap, ping us.

📚 Docs: docs.breakcold.com/api/authentication · machine-readable index at docs.breakcold.com/llms.txt.

Start your 14-day Breakcold trial →

#2 HubSpot: the API with the biggest CRM-object catalogue 🟠

HubSpot's API at api.hubapi.com is the most extensive object catalogue on this list. Contacts, companies, deals, tickets, line items, products, quotes, invoices, subscriptions, segments, plus calls/emails/meetings/notes/tasks on the engagement side, plus marketing surfaces (campaigns, landing pages, blog posts) read-only. They've also moved to date-based versioning (e.g. 2026-03), so endpoints look like /crm/objects/2026-03/contacts.

Auth: OAuth 2.0 for multi-account apps (required if you'll be installed on more than 10 accounts), or static "Private App" access tokens for single-account use. Both use the Bearer header. Webhooks are well-handled but reorganized into a v4 Journal API (currently beta) with separate scopes for journal read, subscriptions, and snapshots. Rate limits are 100 req/s on journal, 50 r/s on subscriptions, 10 r/s on snapshots.

Build this: sync contacts to a Postgres warehouse for SQL reporting, send a Slack notification on deal stage changes via webhook subscriptions, enrich incoming form submissions before they land in HubSpot.

The hole: no native LinkedIn / Telegram / WhatsApp conversations in the API. Engagement objects cover email/calls/meetings/notes. If your team sells on social, the AI you build on top sees half the picture.

📚 Docs: developers.hubspot.com

#3 Pipedrive: the most predictable rate-limit model 📊

Pipedrive's API at api.pipedrive.com/v1 is the OG sales-pipeline API and it shows in the maturity. 60+ endpoints: deals, persons, organizations, activities, products, leads, projects, tasks, notes, plus deal-fields/person-fields metadata. OpenAPI 3 specs are public for both v1 and v2. Official SDKs for Node.js and PHP.

The rate-limit model is the most interesting one in this list: token-based with a daily budget calculated as 30,000 base tokens × plan multiplier × seats (+ top-ups), plus burst limits of 20-120 requests per 2 seconds depending on plan. OAuth apps get 4× the burst limit. Each operation has a token cost (get = 2, list = 20, update = 10, search = 40). Once your budget runs out you get 429s until midnight server time.

Webhooks v2 are excellent: REST subscription, 40 webhooks per user, supports create/change/delete or * wildcards across activity, deal, lead, note, person, organization, pipeline, product, stage, user, board, phase, project, task. Retries at 3, 30 and 150 seconds, 10 failed first attempts triggers a 30-minute ban.

Build this: sync deal stages to Looker via webhook → BigQuery, push lead form submissions in, build a custom mobile dashboard for field reps.

The hole: AI features are paid add-ons, conversations are email-only on the API side. Plus the parent company change post-2020 has slowed the pace.

📚 Docs: developers.pipedrive.com

#4 Attio: the modern data-model API for ops-heavy teams ⚫

Attio's API at api.attio.com/v2 is the cleanest modern REST API on this list. OpenAPI spec is public, auth supports OAuth 2.0 and API keys (both with scopes), and they expose a SDK Toolkit on top of docs.attio.com/sdk. Rate limits are crisp: 100 read requests per second, 25 write requests per second, with a complexity-scored list endpoint that 429s on high-fanout queries.

Webhooks are HMAC-signed (SHA-256), at-least-once delivery with idempotency keys, up to 10 retry attempts over ~3 days with exponential backoff, 25 req/s per target URL, server-side filtering by payload property. This is the most production-ready webhook implementation in the article.

Build this: internal tooling on top of Attio's custom objects, deep ETL pipelines into a warehouse, dashboards on lists/notes/comments.

The hole: the API mirrors Attio's positioning, which is the new Salesforce for ops-heavy startups. No native LinkedIn / Telegram / WhatsApp in scope on the conversations side. Meetings + transcripts are in, IM channels are out.

📚 Docs: docs.attio.com/rest-api/overview

#5 Salesforce: the enterprise REST API ecosystem 🔵

Salesforce's REST API is the deepest and most complex on this list. Endpoint pattern is https://<instance>.salesforce.com/services/data/v<version>/sobjects/... and you authenticate via OAuth 2.0 with refresh tokens. Coverage isn't even worth listing: anything addressable in Salesforce as an SObject is addressable over the API, including custom objects, Apex Invocable Actions, Flows, Named Queries, Data 360 SQL, Tableau analytics. Platform Events + the Streaming API handle real-time push.

Daily rate limits are tiered per edition (15,000 calls/day on the lower end, climbing into the hundreds of thousands for higher editions, plus extra calls per licensed user). Concurrency is capped per org. There's a documented playbook for every operation, but the surface is large enough that "Salesforce admin" is a job title.

Build this: the answer is "literally anything Salesforce permits." Realistically: middleware between Salesforce and downstream systems (data warehouse, marketing automation, ERP), Apex callouts to internal microservices, custom UIs on top of SObjects.

The hole: brutal learning curve. If your team is under 10 people, you'll spend more on the integrator than on the seats. And the same email-only ceiling on conversations applies.

📚 Docs: developer.salesforce.com

A real DM. A team built half a CRM on Cursor + Zapier during a hackathon, then realised the productive path was just using the actual CRM with the actual API. The size of the CRM-API ecosystem is exactly why "build your own" rarely works past v1.

#6 Zoho CRM: the credit-based heavyweight 🔴

Zoho CRM's V8 API is the most mature of the "traditional SMB" CRM APIs after HubSpot, organized into six categories: Metadata, Core (CRUD), Composite (up to 5 calls in one request), Bulk, Notification, and Query (SQL-style SELECT). Auth is OAuth 2.0, base URL is www.zohoapis.com/crm/v8/. Six official SDKs: Java, Python, Node, PHP, .NET, Ruby.

The rate-limit model is credit-based, calculated as 50,000 base credits + a per-user multiplier × seats, capped per edition (100k credits on Standard, 3M on Professional, 5M on Enterprise, unlimited on Ultimate). Concurrency is also capped: 5 concurrent calls on Free up to 25 on Ultimate, with a separate 10-call shared limit on resource-intensive operations like Convert Lead and Bulk Write.

Build this: bulk imports for migrations (Bulk API is genuinely good), composite calls to batch reads, SQL-style cohort queries via the Query API, real-time syncs via Notification API.

The hole: the UX of the docs is dense and the credit-cost table is its own subgenre of pain. Same email-only conversation ceiling.

📚 Docs: zoho.com/crm/developer/docs/api/v8

#7 Close: the call-heavy CRM API with a clean scope model 🟢

Close's REST API at api.close.com/api/v1 covers leads, contacts, opportunities, activities (calls, emails, SMS, meetings, notes, tasks), workflows, sequences, custom objects, plus programmatic email/SMS sending. Auth is API keys for scripts or OAuth 2.0 for user-facing apps. Webhooks come with a 30-day event log, which is genuinely useful when you need to replay events into a downstream system that went down for a week.

Community-maintained client libraries exist in Python, Node.js, Ruby, PHP and Go. The scope model on the MCP side (read / write_safe / write_destructive) is reflected in how you'd structure API keys in practice too.

Build this: programmatic call dispositions, bulk SMS workflows, AI dialer integrations, reporting dashboards on call activity by SDR.

The hole: rate limits aren't documented as crisply as Pipedrive's or Attio's, and the API is calling-CRM-shaped (excellent if your motion is phone, less of a fit if it's social).

📚 Docs: developer.close.com

#8 Folk: the modern minimalist API ⚪

Folk's API at api.folk.app is the cleanest "small modern CRM" API on this list. OpenAPI spec is published (current schema: 2025-06-09), auth is API key via Bearer header, webhook subscriptions are exposed in the REST API (you can subscribe to workspace events). The endpoint catalogue covers people, companies, deals, notes/interactions, reminders, and webhooks.

Rate limit is 600 requests per minute per user across all endpoints, response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) let you back off cleanly. They even document a Typeform-via-n8n example integration. As a developer experience, it's quite good for the surface area Folk covers.

Build this: Typeform → Folk pipelines, simple enrichment workflows, lightweight contact dashboards.

The hole: the surface area matches Folk's product positioning, which is a contact-first relationship CRM for solopreneurs. No native LinkedIn / Telegram / WhatsApp conversation endpoints despite the "folk MCP" marketing. If you're building anything that needs to read IM data, look elsewhere.

📚 Docs: developer.folk.app

#9 Monday: the GraphQL CRM API for the work-OS crowd 🟣

Monday's API at api.monday.com/v2 is the only GraphQL-first option on this list. You write a query with the fields you want, you get exactly those fields back. The complexity-scoring model is the most distinctive thing about it: each call has a complexity score (capped at 5,000,000 per query) and your daily budget is plan-tiered (1,000 calls/day on Free/Standard, 10,000 on Pro, 25,000 on Enterprise). Queries per minute go 1,000 / 2,500 / 5,000 by plan, concurrent requests are capped at 40 / 100 / 250. JavaScript and Python SDKs are official.

Webhook support is integrated into the GraphQL surface, so you subscribe to board/item events via the same API you query. Auth supports OAuth, API token and shortLivedToken (for guest users).

Worth noting: Monday is a Work OS that ships a CRM product. So this is the CRM API for teams who already run project management, marketing ops, dev tickets and sales pipelines on Monday boards.

Build this: custom item-creation flows from forms, board-level dashboards in Retool, sync items between boards programmatically.

The hole: conversations aren't a first-class Monday concept, the API reflects that. Email/calls/IM channels live in plugins, not the core API.

📚 Docs: developer.monday.com

Five real recipes you can ship this week 🧪

If the article above is the menu, this is the cookbook. Real things small teams build, with the exact endpoints I'd use on Breakcold first since that's where the multichannel data is. Adapt to other CRMs by swapping the conversation source out (and accepting you only see email).

Recipe 1: "Slack me when a hot LinkedIn DM lands." Poll GET /records/{id}/conversations for known accounts every 60s, filter "channel": "linkedin" + lastMessageAtMs > now - 60s, post to Slack webhook with prospect name + snippet. ~30 lines of Node. Try replicating this on HubSpot or Pipedrive, you'll need to add Surfe or LeadJet.

Recipe 2: "Auto-archive cold leads." Nightly cron: list records in a "prospecting" view via GET /crm/record-views + GET /records, find any with lastMessageAtMs < now - 60d, POST /records/{id}/archive. Free up the funnel without sales reps having to do it. Smart Views are part of this story.

Recipe 3: "Pipe Lemlist replies into Breakcold." Lemlist webhook → your serverless endpoint → POST /records (creates the person if not there), then POST /records/{id}/tasks to assign a follow-up to the right SDR. This is the bread-and-butter integration lead-gen agencies build on day one.

Jon Mulhall, 20 years in sales: lead in Breakcold → BetterContact → first call → demo machine. "It's literally never been this easy." Workflows like this are what the API + multichannel inbox enable.

Recipe 4: "Retool dashboard for the founder." Two queries: GET /records?objectTypeSlug=deal&search= for deal volume by week, GET /records/{id}/conversations sampled across stages for activity heatmap. 20 minutes to build, replaces "what's the state of the pipeline" Slack messages forever.

Recipe 5: "Migrate from your old CRM." Read source CRM (HubSpot/Pipedrive/Folk export), map field names with a JSON config, push to Breakcold via POST /crm/objects (create matching custom object types) + POST /crm/fields (create matching custom fields) + POST /records in a loop. The agencies that migrate clients onto Breakcold ship this in an afternoon.

Thijs at Salesbaas: $100k closed for himself, $150-200k for clients. Agencies build on top of the Breakcold API to deliver done-with-you and done-for-you sales operations. The API is what makes that scalable.

The honest verdict 🎯

Eight of the nine CRMs in this article ship developer APIs that are mature, documented, well-supported, and exactly the same shape they've been for years: read your contacts, read your deals, read your emails, fire webhooks on changes. None of that is wrong. It's table stakes for a 2026 CRM API.

Where the gap shows up is the moment your team starts selling on LinkedIn DMs, in WhatsApp groups, on Telegram, on calls, in meetings, the way modern salespeople actually do. Breakcold is the only API where one endpoint returns conversations across email + LinkedIn + Telegram + WhatsApp on the same record. If you're building anything that needs the full picture, that's the only API that gives it to you in HTTP.

Even a +$100M ARR company is building on the Breakcold API for their cold outbound. The thing they expanded? Seats. Because the API let them ship faster than building it themselves.

If you're a developer, GTM engineer, or agency owner picking what to build on next, ask the vendor exactly this: "Can your API return my LinkedIn / Telegram / WhatsApp conversations on a single endpoint?" One vendor in this article says yes today. ⚡

📚 Breakcold API documentation · Start your 14-day Breakcold trial →