Developers
Your CRM, wired into everything else
Keys with scopes, rate limits and expiry. REST routes over deals, contacts and any object you define, with upsert and batches. Signed events out, no-code actions in, an MCP server for your agents, and automations that run the rest.
Free plan, not a trial · Keys and webhooks on Pro · Docs inside the app
The API
Read and write every record you own
One key in the X-API-Key header. Writes are idempotent, so a retried request creates one record, not two; an upsert matches on any identity key you name, an email, a domain or your own external id; and a batch sends many operations in one request. The same routes serve Companies, People, Deals and every object you define.
| Method | Path | Does |
|---|---|---|
GET | /deals | List deals, filtered by stage, priority or outcome |
POST | /deals | Create a deal |
PATCH | /deals/:id | Update a deal, including its stage |
GET | /contacts | List contacts |
POST | /contacts | Create a contact |
GET | /stages | Your pipeline stages, in order |
GET | /activities | Calls, emails, meetings and notes |
POST | /activities | Log an activity on a deal or a contact |
GET | /objects | Every object with its attributes, so a client describes itself |
GET | /objects/:slug/records | List records of any object, built in or your own |
POST | /objects/:slug/records | Create a record, validated against its field types |
GET | /records/:id | One record with its values |
PATCH | /records/:id | Update values |
DELETE | /records/:id | Archive a record; it stays restorable |
Keys are created in Settings and shown once, each with resource-level scopes (read deals, write people), a rate limit, an expiry by default and overlapping rotation, under an integration identity that outlives whoever issued it. The full reference lives inside the app beside your keys.
Webhooks
Every change reaches your systems, signed
A record changes and every subscribed endpoint hears about it: signed with HMAC-SHA256 over the body and a timestamp, retried with growing gaps, replayable from the log, and available to pull by cursor for systems that prefer to ask.
- EventA record changes
- Fan-outOne delivery per endpoint
- RetriesOnly if a delivery fails
- DeliveredSigned and timestamped
- ReplayFrom the delivery log
Secrets are shown once and rotate at any time. Endpoints are https only. A webhook is one action an automation can take; the rest are on the automations page.
No code needed
A form, a signature, a payment: straight into Ishara
One inbound endpoint accepts a JSON body with an action field: create a deal, update it, move it to a stage, create a contact matched to its company by domain, or log a call, email, meeting or note. Zapier and Make guides live in the app, so a form submission or a signed contract lands on the right record without a line of code.
What connects to Ishara, and how a whole CRM comes in when a webhook is the wrong tool.
curl "https://<your-project>/functions/v1/ishara-api/deals?stage=Proposal" \
-H "X-API-Key: px_your_key"
{ "data": [
{ "id": "d_01", "title": "Doha logistics hub", "stage": "Proposal",
"value": 48000, "currency": "QAR", "outcome": "open" }
], "count": 1 }Agents
An MCP server for the agents your team already runs
Connect any MCP client with a scoped key and it reads your records, lists and reports the way a teammate would, and proposes changes rather than making them: every proposal waits in Review with the values it would write, and a person applies it.
Ask Ishara, the agent step inside automations and the API propose through the same door: AI you approve before it writes anything.
Frequently asked questions
What can I reach through the Ishara API?
Your own records: deals, contacts, stages, activities and any object you define, through the same routes. A client reads /objects first and describes itself from the attributes it finds.
How are API rate limits set?
You pick a limit per key when you create it, along with its scope and expiry. A call over the limit gets a retry-after in seconds, and lists page by offset.
Can I create custom-object records by API?
Yes. GET, POST, PATCH and DELETE work on any object, built in or your own. Calls run as the key's owner, so validation and access rules apply to a custom object exactly as they do to Deals.
Do I need a developer to connect a form or a signing tool?
No. The inbound endpoint takes a JSON body with an action field, and Zapier and Make guides inside the app walk through it step by step.
Wire your CRM into everything else.
Connect the world’s intelligence with your team’s knowledge. Bring a clearer picture to every conversation and opportunity.
Public intelligence · Private enterprise context · Agent access