Quickstart

Make your first authenticated call to the Corteksa CRM API in a few minutes. This works whether you're on the web or mobile app team, or an external partner integrating over the public API.

Before you start

You need two things:

• A workspace — your Corteksa account. Every request is scoped to it.
• An API key — create one in Settings → Developers → API keys. Keys look like crtk_live_<hex> and carry scopes (read.contacts, create.deals, …) that decide exactly what they can touch.

Your base URL is your workspace subdomain — the same host the app uses:

https://<workspace>.corteksa.com/api/v1

The subdomain selects the workspace's database; your API key selects the identity and permissions within it. Everything is versioned under /api/v1.

Step 1 — Make your first request

Read the records of any object (here, contacts). Send your key in the X-Api-Key header:

curl https://acme.corteksa.com/api/v1/object/data/contacts \
  -H "X-Api-Key: crtk_live_7f3c…"

You get back a page of records plus pagination:

{
  "data": [
    {
      "slug": "jane-doe-a1b2",
      "name": "Jane Doe",
      "email": "jane@acme.com",
      "status": "Customer"
    }
  ],
  "pagination": { "total": 128, "page": 1, "per_page": 25 }
}

That's it — you're talking to the API. If you get 401, check the key; if you get 403, the key is missing the read.contacts scope.

Step 2 — Create a record

POST to the same object endpoint. The data object is keyed by each field's slug (not its display name) — you can find field slugs in the Models section or the API reference:

curl -X POST https://acme.corteksa.com/api/v1/object/data/contacts \
  -H "X-Api-Key: crtk_live_7f3c…" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "name-8fk2": "Sara Ali",
      "email-p0zx": "sara@acme.com",
      "status-a1b2": "Lead"
    }
  }'

{
  "data": { "slug": "sara-ali-9d4e", "name": "Sara Ali", "status": "Lead" },
  "message": "Record created"
}

Creating a record needs the create.contacts scope. select/status values are validated against the field's allowed options.

Step 3 — Keep in sync with webhooks

Instead of polling, subscribe to signed webhooks and Corteksa pushes record events (created, updated, deleted) to your endpoint in real time. See the Receive webhooks recipe to register an endpoint and verify the signature.

Authentication at a glance

Different callers use different credentials — all over HTTPS:

External integrations start with an API key. When you want to act on another workspace's behalf, use the OAuth "Connect" flow. Both are covered in API Keys & OAuth.

Core concepts

• Workspace / tenant — an isolated dataset. Free-tier workspaces share a database with row-level isolation; paid tenants get a dedicated database.
• Objects & fields — the CRM schema is dynamic. "Contact", "Company", and "Deal" are objects; each has typed fields, and you can define your own.
• Records — the rows of an object. The records API (/api/v1/object/data/:objectSlug) is your main data surface.
• Slugs, not IDs — everything is addressed by a human-readable slug (object_slug, record_slug, and field slugs in the request body), never internal numeric IDs. Slugs are stable across environments.

Next steps

• API reference — every endpoint, interactive. Try a call and copy the request in your language.
• Data model — objects, fields, and relations, and how the dynamic schema works.
• API keys & scopes — the full auth model and the "Connect with Corteksa" OAuth flow.
• Guides — how each product area works: Core CRM, AI, Billing, and more.