Developers
Your CRM, wired into everything else
Keys with scopes, rate limits and expiry. REST routes over deals, contacts and any object you define. Signed webhooks out, no-code actions in, and automations that run the rest.
Free plan, not a trial · Keys and webhooks on Pro · Docs inside the app
The API
Read and write every record you own
One key in the X-API-Key header. Writes accept an idempotency key, so a retried request creates one record, not two. The same routes serve Companies, People, Deals and every object you define.
| Method | Path | Does |
|---|---|---|
GET | /deals | List deals, filtered by stage, priority or outcome |
POST | /deals | Create a deal |
PATCH | /deals/:id | Update a deal, including its stage |
GET | /contacts | List contacts |
POST | /contacts | Create a contact |
GET | /stages | Your pipeline stages, in order |
GET | /activities | Calls, emails, meetings and notes |
POST | /activities | Log an activity on a deal or a contact |
GET | /objects | Every object with its attributes, so a client describes itself |
GET | /objects/:slug/records | List records of any object, built in or your own |
POST | /objects/:slug/records | Create a record, validated against its field types |
GET | /records/:id | One record with its values |
PATCH | /records/:id | Update values |
DELETE | /records/:id | Archive a record; it stays restorable |
Keys are created in Settings and shown once, each with a scope, a rate limit and an expiry you choose. The full reference lives inside the app beside your keys.
Webhooks
Every change reaches your systems, signed
A record changes and every subscribed endpoint hears about it: signed with HMAC-SHA256 over the body and a timestamp, retried with growing gaps, replayable from the log.
- EventA record changes
- Fan-outOne delivery per endpoint
- RetriesOnly if a delivery fails
- DeliveredSigned and timestamped
- ReplayFrom the delivery log
Secrets are shown once and rotate at any time. Endpoints are https only. A webhook is one action an automation can take; the rest are on the automations page.
No code needed
A form, a signature, a payment: straight into Ishara
One inbound endpoint accepts a JSON body with an action field: create a deal, update it, move it to a stage, create a contact matched to its company by domain, or log a call, email, meeting or note. Zapier and Make guides live in the app, so a form submission or a signed contract lands on the right record without a line of code.
What connects to Ishara, and how a whole CRM comes in when a webhook is the wrong tool.
curl "https://<your-project>/functions/v1/ishara-api/deals?stage=Proposal" \
-H "X-API-Key: px_your_key"
{ "data": [
{ "id": "d_01", "title": "Doha logistics hub", "stage": "Proposal",
"value": 48000, "currency": "QAR", "outcome": "open" }
], "count": 1 }Frequently asked questions
What can I reach through the Ishara API?
Your own records: deals, contacts, stages, activities and any object you define, through the same routes. A client reads /objects first and describes itself from the attributes it finds.
How are API rate limits set?
You pick a limit per key when you create it, along with its scope and expiry. A call over the limit gets a retry-after in seconds, and lists page by offset.
Can I create custom-object records by API?
Yes. GET, POST, PATCH and DELETE work on any object, built in or your own. Calls run as the key's owner, so validation and access rules apply to a custom object exactly as they do to Deals.
Do I need a developer to connect a form or a signing tool?
No. The inbound endpoint takes a JSON body with an action field, and Zapier and Make guides inside the app walk through it step by step.
Wire your CRM into everything else.
32,822 investors, government tenders across six markets and a CRM that starts free. Bring your data from any CRM or spreadsheet in an afternoon.
Free plan · 32,822 investors · six markets