CRM exposes authenticated record, editor, profile/identity, import/export, privacy, archive and operation endpoints under the configured API route groups. The capability crm_api, current integration credentials and applicable staff/record permissions are independent requirements; check the running route/middleware contract before integrating. Never use a browser's selected-company value as proof of ownership.
Watch the lesson
Route families
| Family | Purpose and safeguards |
|---|---|
| Records/editor | Supported entity list/detail/create/update/delete and current field/relationship options |
| Views/exports | Authorized filters, readable fields, export permission and retained export history |
| Imports | Stage, map, preview, duplicate review, approve/run, pause/cancel and guarded rollback |
| Identity/preferences | Explicit candidate/merge/recovery review, channel-purpose consent evidence and suppression |
| Operations | Reassignment, stages, enrollment, approved AI/tool actions and file attachment |
| Privacy/archives | Reviewed data portability, supported restore and retained deletion/erasure evidence |
| Mobile | Dedicated authenticated CRM projections and Helpdesk contracts; not an authorization bypass |
Use the deployment's routes/crm.php, its included route files and controller validation as the exact payload contract. Not every implemented advanced endpoint is enabled in the MVP profile. Editor options are current reviewed choices, not a permanent grant for later writes. Record versions, scoped relationship IDs and supplied review evidence must remain consistent through submission.
Keys, tools and queues
Use the supported authenticated API/MCP tool path with the smallest action/data scope needed. Do not place OAuth tokens or provider credentials in tool arguments or client code. Queued work reloads the original actor/tenant/company and current entitlement; serialization of a job is not successful execution. API/storage quotas apply to integrations too.
An authorization denial or stale review requires a new authorized review. A timeout after a write is an unknown outcome until reconciled; blindly retrying a create can duplicate external records. Zoho uses durable operation receipts and exact source IDs for this reason. See Zoho record updates.
CRM reads through account API keys and MCP
When enabled, account integrations expose Contacts, Deals, Activities and Notes as explicitly scoped CRM reads. Each resource has independent browse and read key permissions: crm_contacts, crm_deals, crm_activities and crm_notes. REST uses GET /api/v1/account/{resource} or GET /api/v1/account/{resource}/{id}; MCP exposes the corresponding browse_... and read_... tools.
The key, current staff/company access, CRM API feature and integration API allowance must all permit the operation. Browse returns permitted summaries and counts; detail returns the current domain projection. Revoking or rotating the parent key, removing a staff permission, changing the effective plan or exhausting the shared API allowance can deny an operation. A derived token cannot widen its parent key's permissions. The same tenant API metering applies to the REST and MCP paths.
These account-key/MCP resources are read-only. They do not expose generic CRM create, edit or delete tools. Existing staff-authenticated CRM mutation endpoints retain their own explicit version, review, quota and idempotency contracts; read access never authorizes those writes. Consult the current API route and tool discovery output rather than guessing a writable operation.
Reviewed stage mapping
Call the supported stage-mapping preview before applying a populated-stage change. Submit its exact versions and review receipt with apply=true; HTTP apply without a review is rejected. A changed source stage, destination stage, pipeline, workspace or deal population requires a fresh preview. The receipt does not grant permission, bypass required fields or create an approval.
CRM events
The existing scoped event endpoint is a cursor-based audit pull feed. Consumers checkpoint the returned cursor and handle repeat processing. It is distinct from an outbound webhook subscription or a guarantee that another CRM has received a change. Zoho record updates use their own connector and durable per-record synchronization contract.
Native Helpdesk extension
The pending mobile extension adds GET /api/v1/helpdesk/tickets/options with optional ticket_id, returning current permissions, allowed actions and permitted form metadata. Its private file stream is GET /api/v1/helpdesk/tickets/{ticket}/files/{index} with an opaque revision and optional comment_id. The index is the original attachment slot, not an arbitrary object path. Existing POST/PATCH/comment/action routes remain the write paths.
Downloads are authenticated, no-store, exact-record/revision checked and rechecked at streaming time. The app refuses redirect following and stale-session native saves. Raw storage paths are not the download contract. These endpoints require the matching backend release; see Mobile Helpdesk.
Advanced feature contracts
Reviewed AI qualification and copilot, quotes/approvals, sequences/onboarding and reports/forecasts retain their domain checks when invoked through supported staff API operations. Their presence does not add writable account-key/MCP tools or extend Zoho migration and sync coverage. Provider consent, worker completion and actual delivery require their own outcome evidence.