The API gives programmatic access to the same data model powering the app itself, accounts, contacts, deals, projects, tasks, time entries, invoices, so you can build integrations without waiting on a pre-built connector for every tool in your stack. See the full reference on the API page.
In this guide
Authenticating API requestsReading and writing dataUsing webhooks for real-time eventsRate limits and best practicesFrequently asked questions
Authenticating API Requests
Generate an API key from Settings → API Keys, scoped to the specific modules it needs access to, a key used for a reporting integration doesn't need write access to billing, for example. Include the key as a bearer token on every request; keys can be rotated or revoked instantly if one is ever compromised.
Reading and Writing Data
The API follows standard REST conventions, GET to read, POST to create, PUT/PATCH to update, DELETE to remove, across resources like /projects, /tasks, /time-entries, /invoices, and /accounts. Every resource returned through the API mirrors what you'd see in the UI, since both read from the same underlying data.
Using Webhooks for Real-Time Events
Rather than polling the API for changes, register a webhook under Settings → Webhooks to receive a POST request the moment something happens, a task completed, an invoice paid, a deal moved to a new stage. This is the same event system automation rules use internally, exposed so your own systems can react in real time too, see Setting Up Automation Rules for the equivalent no-code version.
Rate Limits and Best Practices
- Scope each API key to only the modules and permissions the integration actually needs
- Prefer webhooks over polling for anything event-driven, it's faster and reduces API load
- Handle pagination on list endpoints rather than assuming all results return in one call
- Watch for rate-limit response headers and back off automatically rather than retrying immediately
See the API and webhooks in action
Talk to us about the integration you're building, we'll point you to the right endpoints.
Frequently asked
API access is included on all plans, with webhook support and higher rate limits available on higher tiers. Check the API page for the exact limits tied to your plan.
Yes, API keys are scoped when created, you can grant read-only access to specific modules, full read/write access, or anything in between, so an integration only has the permissions it actually requires.
Polling means repeatedly calling the API to check for changes, which wastes requests and introduces delay. Webhooks push a notification the moment an event happens, so your system reacts in near real time without constantly asking whether anything changed.