7 min read
Top pick: Attio is the agentic CRM with a full read/write REST API, webhooks, an App SDK, and a hosted MCP server in one developer platform.
Runners-up:
Salesforce: Best for enterprises that need REST, SOAP, GraphQL, and bulk APIs.
HubSpot: Best for teams that want one API across CRM, marketing, sales, and service.
Twenty: Best for engineering-led teams that want an open-source, self-hostable CRM.
Pipedrive: Best for sales teams that want a simple, OpenAPI-described REST API.
Close: Best for inside sales teams that want API-key scripting plus an MCP server.
monday CRM: Best for teams that already run work on monday.com boards.
Freshsales: Best for SMBs that want a documented REST API with a Postman collection.
How to choose a CRM API
A RevOps engineer gets a request on Monday: enrich every new signup, route it to an owner, and post the result in Slack before the rep opens their laptop. By Wednesday the script works. By Friday it breaks, because someone added a custom field the API did not expose, and the rate limit throttled the backfill. The CRM was fine in the demo. The API decided whether the project shipped.
Five questions separate a CRM API you can build on from one you work around:
Data model access. Can the API read and write custom objects and attributes, or only the standard ones?
Authentication. API keys suit internal scripts. OAuth 2.0 is needed for anything user-facing or multi-tenant.
Events. Webhooks let your systems react to CRM changes without polling.
Agent access. An MCP server lets AI assistants search and update records with the same permissions as a user.
Limits and plan gating. Rate limits and plan tiers decide whether a backfill runs in an hour or a week.
The best CRM APIs
1. Attio
Best for: Technical GTM and RevOps teams building custom revenue systems on a flexible data model.
Attio is the agentic CRM where the API is part of the product, not an add-on. The REST API reads and writes objects, attributes, and records, including custom objects. Webhooks, OAuth 2.0, the App SDK, and the hosted MCP server sit in the same developer platform, so a script, an in-app extension, and an AI agent all work on the same live customer context. The platform handles 400m+ API calls per week.
Features:
REST API: Full read/write access to objects, records, and attributes, with API keys or OAuth 2.0.
Webhooks: External systems react to Attio events as they happen.
App SDK: TypeScript and React apps run inside the Attio interface.
MCP: Claude, ChatGPT, and Cursor connect with one-click OAuth.
Considerations:
Custom object limits depend on plan: three on Free, five on Plus, 12 on Pro, unlimited on Ultra.
Teams that want to self-host their CRM need a different architecture.
The App SDK is built for TypeScript and React.
Learn more: docs.attio.com
Pricing: See attio.com/pricing
2. Salesforce
Best for: Enterprise engineering teams that need many API styles for large, complex integrations.
Salesforce gives developers the widest choice of interfaces. REST handles application integrations, SOAP serves legacy server-side work, GraphQL lets you request exactly the fields you need, and Bulk API 2.0 moves large datasets asynchronously. Streaming and Change Data Capture push record changes to subscribers in near real time.
Features:
REST, SOAP, and GraphQL APIs for different integration styles.
Bulk API 2.0: Asynchronous loads and queries at scale.
Change Data Capture: Near-real-time record change events.
Metadata and Tooling APIs: Deploy customizations across environments.
Considerations:
The number of API surfaces means more to learn before the first integration ships.
Customizations often rely on Apex, Flow, and admin skills alongside the API.
Matching an API to a use case takes planning across REST, SOAP, GraphQL, and Bulk.
Learn more: help.salesforce.com
Pricing: See salesforce.com/editions-pricing
3. HubSpot
Best for: Marketing and sales teams that want one API across CRM, marketing, and service data.
HubSpot's REST API at api.hubapi.com spans CRM objects plus marketing, sales, and service data. Date-based versioning keeps older versions live until their end-of-life date, which gives integrations a predictable upgrade path. Private apps use scoped access tokens, so each integration only reaches the data it needs.
Features:
Date-versioned endpoints such as `/crm/objects/2026-03/contacts`.
Private app tokens with granular scopes.
OAuth 2.0 for third-party apps.
Webhooks for account events.
Considerations:
Plan tier decides how deep record customization and permissions go.
Agent Hub usage is billed on credits, on top of plan pricing.
Integrations pinned to a dated version need a planned upgrade before it reaches end-of-life.
Learn more: developers.hubspot.com
Pricing: See hubspot.com/pricing
4. Twenty
Best for: Engineering-led startups that want an open-source CRM they can self-host and extend in code.
Twenty is an open-source CRM under AGPL-3.0, so you can run it yourself and own the data. It ships native REST and GraphQL APIs, webhooks, and OAuth. A TypeScript Apps framework packages custom objects, server logic, React components, and agents as installable apps.
Features:
REST and GraphQL APIs over CRM objects and records.
Webhooks for record and workflow events.
Apps framework: Custom objects, server logic, and agents as packages.
Native MCP server for Claude, ChatGPT, and Cursor.
Considerations:
Self-hosting puts upgrades and infrastructure on your team.
The company was founded in 2023, so the ecosystem is younger than older platforms.
AGPL-3.0 licensing deserves a review from your legal team.
Learn more: docs.twenty.com
Pricing: See twenty.com/pricing
5. Pipedrive
Best for: Sales teams at small and mid-sized businesses that want a straightforward REST API around deals and contacts.
Pipedrive's API is stateless, JSON-based, and supports CORS. Both v1 and v2 ship with OpenAPI 3 specifications, which makes generating clients and tests simple. More than 50 endpoints cover deals, persons, organizations, leads, activities, custom fields, files, and webhooks.
Features:
OpenAPI 3 specs for v1 and v2.
Per-user API tokens or OAuth 2.0.
Endpoints for core CRM objects, activities, and custom fields.
Webhooks for real-time data changes.
Considerations:
Two live API versions mean checking which one an endpoint lives in.
Automations do not fire during bulk imports.
Pipedrive is built around a sales pipeline, so non-sales data models need more design.
Learn more: support.pipedrive.com
Pricing: See pipedrive.com/en/pricing
6. Close
Best for: Inside sales teams that script calling, email, and SMS workflows against a clean API.
Close pairs a REST API with both API-key authentication for internal scripts and OAuth 2.0 for multi-tenant integrations. Webhooks deliver real-time events with a 30-day event log for auditing, and an MCP server connects Close data to AI agents.
Features:
API keys for scripts, OAuth 2.0 for user-facing integrations.
Webhooks with a 30-day event log.
MCP server for AI agents.
Community client libraries for Python, Node.js, Ruby, PHP, and Go.
Considerations:
Client libraries are community-maintained.
The product is focused on outbound sales, so it suits that motion best.
Complex custom data models take more modeling work.
Learn more: help.close.com
Pricing: See close.com/pricing
7. monday CRM
Best for: Cross-functional teams that already manage work on monday.com and want CRM data on the same boards.
monday CRM runs on the monday.com GraphQL API, which lets developers query and mutate boards and items with flexible field selection. Authentication works through personal API tokens or OAuth. The apps framework packages integrations as native building blocks, and SDKs cover JavaScript and Python.
Features:
GraphQL queries and mutations with flexible field selection.
Personal tokens, OAuth, and short-lived guest tokens.
Webhooks for board data changes.
Hosted MCP servers for AI assistants.
Considerations:
Data is organized as boards and items, so CRM objects map onto that structure.
GraphQL suits teams comfortable writing queries.
SDKs exist for JavaScript and Python only.
Learn more: support.monday.com
Pricing: See monday.com/crm/pricing
8. Freshsales
Best for: Small and mid-sized sales teams that want a documented REST API and a ready-made Postman collection.
Freshsales has a JSON REST API for contacts, accounts, deals, tasks, appointments, notes, and CPQ products. Freshworks publishes a Postman collection, so a developer can test endpoints in minutes. Webhooks and workflow-triggered API calls keep outside systems in sync.
Features:
Full create, read, update, and delete on core CRM objects.
Token-based authentication against an account-specific subdomain.
Postman collection for exploring endpoints.
Webhooks and workflow-triggered API calls.
Considerations:
The default rate limit is 1,000 requests per hour per account, so plan backfills around it.
Requests go to an account-specific subdomain.
Native integrations are lighter than the largest marketplaces.
Learn more: developers.freshworks.com
Pricing: See freshworks.com/crm/pricing
FAQs
Should I build on a CRM API or use a no-code connector?
No-code connectors suit simple, low-volume syncs between two tools. A direct API integration fits when you need custom objects, high volume, branching logic, or an AI agent acting on records. Many teams start with a connector and move the busiest flows to the API once the logic settles.
How should I handle API credentials safely?
Create a dedicated key or OAuth app per integration, grant only the scopes it needs, and store secrets in a secrets manager rather than in code. Separate keys make it easy to rotate one integration without breaking the rest, and scoped access limits the damage if one leaks.