API conventions

Workspace scope

Replace {workspace_id} with a UUID from your active workspace (returned by GET /api/v1/users/users/ as active_workspace.id).

All workspace routes require membership. Role-based permissions apply — see MODULE_PERMISSIONS.md in the repo.

Admin-only routes

These require workspace admin role:

• /api/v1/{workspace_id}/developers/… (access tokens, webhooks)
• Some role permission updates

HTTP methods

Method	Usage
GET	Read
POST	Create or actions
PUT / PATCH	Update (PATCH = partial)
DELETE	Delete or soft-delete

IDs

• Workspace, event, form IDs: UUID
• Lead IDs: string (may be composite)

Dates & times

Use ISO 8601 in UTC where possible:

"2026-06-20T09:00:00Z"

Pagination

List endpoints may support query parameters such as:

Param	Description
page	Page number
page_size	Items per page
search	Text search (where supported)
ordering	Sort field

Exact params vary by endpoint — check Interactive API explorer or the section docs.

Error responses

Validation error (400):

{
  "field_name": ["This field is required."]
}

Permission denied (403):

{
  "detail": "You do not have permission to perform this action."
}

Not found (404):

{
  "detail": "Not found."
}

Unauthorized (401):

{
  "detail": "Authentication credentials were not provided."
}

Rate limiting

Rate limiting uses Redis when configured. Excessive requests may return 429 Too Many Requests.

Webhooks vs REST

Outbound webhooks (configured in Developers settings) deliver event payloads to your URL. See Webhooks.

Inbound integration webhooks (Calendly, HubSpot, etc.) are documented under Integrations.