Getting started
Create an API key, make your first request, and learn the contracts every SalesOS endpoint follows.
The SalesOS API is a JSON-over-HTTPS API rooted at:
The machine-readable contract is the OpenAPI 3 document at
GET /v1/openapi.json. It needs no
authentication, and the API reference and the SDKs are
generated from it.
1. Create an API key
- In SalesOS, open Settings → API Keys and choose New API Key.
- Name it after the integration that will use it, for example
warehouse-sync. - Grant only the scopes it needs, for example
READ_LEADSandWRITE_CONTACTS. See scopes. - Set an expiry (90 days is the default) and, if the integration runs from fixed addresses, an IP allow-list.
- Copy the secret. It is shown once: SalesOS stores only a hash of it.
The key acts as you, in the organization you created it in. It never has more access than your own user, and your role and record visibility still apply.
2. Authenticate
Send the key in the X-API-Key header:
Authorization: ApiKey sk_... also works. API-key requests do not need a CSRF token or a session.
3. Read the response
List endpoints return one envelope:
Every response also carries:
| Header | Meaning |
|---|---|
API-Version | The release of /v1 that served the request. See versioning. |
RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset | Your key's quota for the current window. See rate limits. |
4. Write safely
Send an Idempotency-Key on every POST and PATCH so a retried request can't
create a duplicate:
Next steps
- Authentication: scopes, expiry, rotation, IP allow-lists
- Requests: pagination, sorting and filtering
- Errors: the error shape and the codes to branch on
- API reference: every operation, with a try-it console
- GraphQL: read across objects, custom objects included
- Developer orgs: a free sandbox org to build in, and change sets to promote what you built