API Overview

HARi CRM exposes a full REST API for integration and automation.

Base URL

https://<your-workspace>.haricrm.com/api

Authentication

All API requests require a Bearer token:

# Login
curl -X POST https://acme.haricrm.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@company.com", "password": "your-password"}'

# Response
{
  "access_token": "eyJ...",
  "refresh_token": "abc...",
  "expires_in": 3600
}

# Use the token
curl https://acme.haricrm.com/api/records/contact \
  -H "Authorization: Bearer eyJ..."

API Keys

For server-to-server integration, create an API key in Settings:

curl https://acme.haricrm.com/api/records/contact \
  -H "Authorization: Bearer hari_a1b2c3..."

API keys use the hari_ prefix and have the same permissions as the user who created them.

OpenAPI Specification

The full API spec is available at:

GET /api/openapi.json

This returns the OpenAPI 3.0 JSON, auto-generated from your tenant’s schema metadata. The list of endpoints adapts to the entities you have installed. Use it with Swagger UI, Postman, or any OpenAPI-compatible tool.

This endpoint requires authentication: send the same Authorization: Bearer header as any other API call. The spec is generated from your own workspace’s schema, so the token determines which entities you see.

Schema Discovery

For AI agents and CLI tools:

GET /api/schema/endpoints

Returns a condensed map of all endpoints with method, path, summary, and body schema. It requires the same Authorization: Bearer header.

Data API (TreeQL)

CRUD operations on any entity:

# List records
GET /api/records/{entity}?page=1&page_size=25

# Get one record
GET /api/records/{entity}/{id}

# Create
POST /api/records/{entity}
Body: { "field": "value", ... }

# Update
PUT /api/records/{entity}/{id}
Body: { "field": "new_value" }

# Delete
DELETE /api/records/{entity}/{id}

Filtering

# Single filter
GET /api/records/contact?filter=source,eq,website

# Multiple filters
GET /api/records/contact?filter=source,eq,website&filter1=_score,gt,20

# Operators: eq, neq, gt, gte, lt, lte, cs (contains), sw (starts with)

Sorting

GET /api/records/contact?sort=created_at,desc

Including related data

GET /api/records/contact?include=first_name,last_name,email_address,company_id

Webhooks

Subscribe to events for real-time notifications:

# Subscribe
POST /api/webhooks/subscribe
{
  "target_url": "https://hooks.zapier.com/...",
  "entity": "contact",
  "event": "after_save"
}

# Events: after_create, after_update, after_delete, after_save (any save)

Rate Limits

• Authenticated requests: 1,000/minute per user
• Login attempts: 20/minute per IP
• Unauthenticated requests: 60/minute per IP