API reference
For developers - authenticate with an API key and call the Protocol REST API to build your own integrations.
Protocol has a REST API you can call from your own scripts, tools, and integrations. Everything your dashboard does is backed by it, and the full, always-current list of endpoints - with request and response examples - lives in the interactive API reference:
- API reference (interactive): api.protocolcrm.com/docs
- OpenAPI spec (raw): api.protocolcrm.com/v1/openapi.json
To call the API you need an API key - a secret token you create yourself and send with each request. Start here:
- Creating & using API keys - create a key, keep it safe, authenticate a request, and revoke a key.
- API rate limits & AI usage budget - the per-key request limits, the
429Retry-Aftercontract, and the402you’ll see if AI-backed calls exceed the monthly AI budget.
- Webhooks: register an HTTPS endpoint, choose events, verify the signature, and read the delivery log to get notified in real time instead of polling.
- Building workflows on the API: tasks and purchase imports that are safe to run twice, the client history feed, and the headers that tag a workflow’s changes.
API keys vs. connecting an AI assistant. If you just want to connect Claude or ChatGPT to Protocol, you don’t need an API key: paste the connector URL from the AI agent page into your assistant and approve the connection in your browser (Connecting your assistant). API keys are for calling the REST API directly from your own code.
Creating & using API keys
Create an API key, keep it safe, authenticate a request with it, find the API reference, and revoke a key. Owner-only.
API rate limits & AI usage budget
Request rate limits per API key, the 429 + Retry-After contract, and the 402 you'll see if AI-backed calls exhaust the account's AI credits for the billing period.
Webhooks
Get notified when things happen in Protocol. Register an endpoint, choose events, verify the signature, and read the delivery log. Owner only.
Building workflows on the API
Safe re-runs for automations: idempotent tasks, duplicate-proof purchase imports, the client history feed, and the headers that tag a workflow's changes.