REST API module for Perfex CRM

About REST API module for Perfex CRM

Connect Perfex CRM to AI agents, automation platforms and any third-party app with a flexible, fully-documented REST API and a built-in MCP server. The REST API module for Perfex CRM exposes your customers, contacts, leads, invoices, projects, tasks and much more over standard HTTP - so external applications, automation tools and AI assistants can read and write Perfex data in real time, and you can control your installation remotely, with no custom core work required.

The API operates over HTTP/HTTPS and follows REST conventions: it uses standard HTTP methods (GET, POST, PUT, DELETE) and meaningful HTTP status codes to define requests and responses. If you have worked with any REST API before, you will be productive in minutes.

New in v3 - the AI-ready release - a built-in MCP server exposing 148 CRM tools to AI agents (Claude, ChatGPT, Cursor, n8n), Webhooks 2.0 with a 124-event catalog and async signed delivery, an OpenAPI specification endpoint, invoice sending by API, new Knowledge Base and Notes endpoints, batch operations (up to 50 per request), idempotent POST retries, per-response rate-limit headers, server-side invoice totals, tolerant partial updates and one-click self-update.

By the numbers

Capability	This module
MCP tools for AI agents (Claude, ChatGPT, Cursor, n8n)	148, permission-filtered, JSON-RPC 2.0
Webhook events	124, across 22 resource groups, HMAC-signed with async delivery
Documented API surface (OpenAPI 3.0)	74 paths, 144 operations, with 498 typed request fields across 35 endpoints
Postman collection	144 requests in 25 folders, generated from the specification so it cannot fall behind
Automation platforms	Zapier, Make.com and n8n - native connectors, no glue code
Batch operations	Up to 50 per request, with per-operation results
Requirements	Perfex CRM, PHP 7.4 or later with full PHP 8.x support

A complete API service for Perfex CRM

This is a mature, actively developed module that gives you a complete API service for your Perfex CRM installation - the foundation for building your own third-party service connections to Zapier, IFTTT, Make.com, n8n, AI agents and any other platform you rely on. It installs, activates and gives you a fully working API in only a few seconds, and stays compatible with the latest Perfex CRM release and PHP 8.x.

The possibilities are genuinely unlimited - the only prerequisite is that you are familiar with REST APIs. Complete online documentation, with full request and response examples for every endpoint, is included to help you build your connections; if you are not comfortable working with APIs, consider hiring an expert to set up your integrations.

AI-ready: a built-in MCP server for AI agents

Version 3.0 turns Perfex into an AI-ready platform. The module now ships with a built-in MCP server (Model Context Protocol) that exposes 148 CRM tools over JSON-RPC 2.0 on a streamable HTTP endpoint, so AI assistants like Claude, ChatGPT, Cursor and n8n AI agents can securely search customers, draft invoices, update leads, manage tasks and much more, straight from a conversation.

Every tool respects the permissions of the API token behind it - an agent can only see and do what its token is allowed to - so you expose exactly as much of your CRM as you choose. Enable it with a single toggle in the admin settings, paste the endpoint URL into your AI client, and your CRM becomes part of your AI workflow with no custom code.

Every endpoint you need

Almost everything you manage inside Perfex is available as an endpoint, with create, read, update, delete and search support where it makes sense. The currently available endpoints cover:

Sales and billing

• Invoices - add, update, delete, request, search and email invoices
• Estimates - add, update, delete, request and search estimates
• Proposals - add, update, delete, request and search proposals
• Payments - add a payment, list all payments and search payments
• Subscriptions - add, update, delete, request a subscription and list subscriptions
• Contracts - add, delete and request contracts
• Expenses - add, update, delete, request and search expenses, plus request expense categories
• Payment modes and taxes - request payment modes and list all taxes

Contacts and pipeline

• Customers - add, update, delete, request, search and list all contacts of a customer
• Contacts - add, update, delete, request and search contacts
• Leads - add, update, delete, request and search leads
• Custom fields - add, update, delete, request fields and their values, and search field values

Projects and delivery

• Projects - add, update, delete, request and search projects
• Milestones - add, update, delete, request and search milestones
• Tasks - add, update, delete, request and search tasks, with task checklist and assignee support, plus full CRUD on a task’s comments (GET, POST, PUT and DELETE on /api/tasks/{id}/comments)
• Timesheets - add, update, delete, request a timesheet and list timesheets
• Calendar events - create, update, delete, get all events and request a specific event

Support and team

• Tickets - add, update, delete, request and search tickets, plus post replies with attachments and status changes
• Staff members - add, update, delete, request and search staff

Knowledge, notes and content

• Knowledge base - full CRUD for articles and groups, with group filtering and automatic unique-slug generation
• Notes - polymorphic notes attached to 12 entity types (customers, leads, contracts, tickets, invoices, estimates, credit notes, staff, expenses, proposals, projects and tasks)

Custom modules and automation

• Third-party (custom modules) - full CRUD against the custom database tables you explicitly expose: get all records, get a record by ID, insert, update and delete. Access is gated by an allowlist you fill in yourself, so a token can only ever reach the tables you named
• Automation connectors - poll for new data, test triggers and list available resources for Zapier, Make.com and n8n
• Batch operations - execute up to 50 operations in a single request, with per-operation results and continue-on-error

File attachments can be pushed to leads, contracts, tasks and expenses, and every list endpoint shares a unified toolkit for pagination, sorting, field selection and date-range filtering so large results stay fast and predictable.

Granular permissions per API token

Issue a dedicated API key for each integration and decide exactly what it is allowed to do. The permissions system lets you grant or revoke Get, Create, Update and Delete access per resource, so every connected application - and every AI agent - runs with least-privilege access. Built-in request limiting and quota limiting let you cap usage, and each key can be given an expiry date - all managed from one screen.

The permission editor covers every capability, Notes, Knowledge Base and Webhooks included, and gives you Select all, Read-only and Clear all buttons, a live count of what is selected, and a per-feature toggle that grants a whole row at once - so setting up a token takes seconds rather than a scroll through dozens of checkboxes. Because the MCP tool list is permission-filtered, granting a feature is also what makes its tools visible to an AI agent.

Custom tables created by other Perfex add-ons are governed the same way. Rather than one all-or-nothing switch, each token is granted the individual tables it may touch, with Read and Write held separately - a token granted Read on a table cannot write to it at all. Existing tokens keep working after the upgrade: each one is granted the tables it was already allowed to reach, with Write only where it already had it.

Webhooks 2.0

Stop polling for changes that may never come. Webhooks 2.0 pushes real CRM events to any URL the moment they happen - a catalog of 124 events across 22 resource groups, bridged to 75 core Perfex actions so both admin-side and API-side changes fire notifications. Delivery can run asynchronously: a background queue (via cron, with an admin-load fallback for installs without one) claims each job atomically and retries failures with exponential backoff.

Every request is HMAC-signed with a timestamp (X-Perfex-Signature) for verification and replay protection, and deliveries are guarded by SSRF filtering and TLS verification, with an optional strict mode that blocks private-LAN targets. You manage it all through a dedicated webhook management API - create, update, delete and toggle webhooks, browse the event catalog and read delivery logs programmatically - or from the admin UI, with a built-in test function and a complete delivery log to confirm everything works before you go live.

Native automation connectors

You should not need a developer to wire Perfex into your stack. The module ships with native support for the Zapier, Make.com and n8n automation platforms, plus a ready-to-import Postman collection covering all 22 resources. A standalone manifest generator produces the manifest for each platform with download links and setup instructions - drop in your API key and start building scenarios. Dedicated polling and test endpoints with timestamp filtering give automation triggers exactly the shape they expect, and a resource-discovery endpoint lets tools enumerate what is available.

Built-in reporting and tooling

Operating an API should not be a black box. A reporting interface gives you user statistics and per-API-key statistics so you can see how each integration is being used. Request logging captures every call for monitoring and debugging, response caching for GET requests improves performance and reduces server load, and an interactive Swagger playground lets you test endpoints and read the documentation from inside Perfex. An API response transformer can wrap responses in a standardised JSON format, filter response fields by query parameter, and automatically strip sensitive fields for privacy. An OpenAPI 3.0 specification endpoint (GET /api/openapi) describes the entire Themesic REST API for Perfex CRM - 74 paths and 144 operations, with every request body documenting its fields, types and required flags across 498 typed fields - so you can import it into Postman, Insomnia or Stoplight in seconds, or generate a typed client in any language. The Postman collection is generated from that same specification (144 requests in 25 folders), so it can never fall behind the product, and every response carries X-RateLimit headers so clients always know exactly where they stand.

Built for developers

Small details make an API pleasant to build against, and v3 is full of them:

• Unified list toolkit on every list endpoint - pagination, sorting (?sort=-datecreated), field selection (?fields=id,company) and date-range filters (created_after / created_before), all fully backwards compatible.
• Server-side totals for invoices, estimates, proposals and credit notes, computed from line items, taxes, discounts and adjustments so you never recalculate on the client.
• Unified items shape - POST and PUT accept the same items array structure that GET returns, and the legacy newitems format keeps working for existing integrations.
• record_id in every create response - the ID of the record you just created comes straight back from the POST.
• Tolerant partial updates on 13 resources - unknown payload fields are ignored instead of causing errors.
• Idempotency-Key support on POST - an identical retry safely replays the stored response instead of re-executing, within a 24-hour window.
• One-click self-update with a daily version check, downgrade guard and OPcache reset, so the module keeps itself current.

Enterprise-grade security

API security is handled by middleware you configure from an intuitive admin interface, no coding required. Restrict access with IP whitelisting and blacklisting (with CIDR notation support), set a configurable maximum request body size to prevent abuse, and enable security headers such as X-Frame-Options and Content-Security-Policy. Authentication is flexible too: send your key as a Bearer token in the Authorization header, pass it as an authtoken or api_key query parameter for simple URL-based access, or use the JWT implementation - whichever fits the client you are integrating. Table-name sanitisation and parameterised queries protect the dynamic custom-table endpoints against SQL injection, and those endpoints reach nothing by default: a built-in denylist plus an allowlist you populate yourself in API settings decide which tables a token may touch at all.

New in v3, brute-force protection throttles repeated failed authentications per IP, and an optional staff-level data-visibility mode links a token to a staff member so the API scopes data exactly like the admin panel does. A v3 platform-settings panel puts it all in one place, letting you toggle the MCP server, webhook delivery mode, SSRF strict mode, TLS verification, staff visibility and authentication throttling from the admin UI.

What you can build

The REST API module turns Perfex into a connected platform and lets you:

• Connect AI agents - let Claude, ChatGPT, Cursor or n8n AI agents work directly with your CRM through the built-in MCP server, finding customers, drafting invoices, updating leads or summarising open tickets, with every action bounded by the token’s permissions.
• Automate workflows - connect Perfex CRM to accounting software, project-management platforms or email-marketing systems, eliminate manual data entry, and synchronise data, create leads and update contacts automatically, with native support for Zapier, Make.com and n8n.
• Extend functionality - integrate external services such as geolocation, SMS notifications or payment gateways to build a CRM experience tailored to your exact requirements.
• Improve efficiency - keep accurate, up-to-date information flowing between Perfex and every connected tool, eliminating data inconsistencies and manual errors, with real-time webhook notifications of every change.
• Foster collaboration - share CRM data with the right team members and sync task progress into your project-management and team-communication platforms.
• Drive business growth - build a unified ecosystem of applications that work together harmoniously, so you can make data-driven decisions and deliver exceptional customer experiences.

Common questions

Does Perfex CRM have a built-in REST API?

No - Perfex CRM does not ship with a full REST API of its own. This module adds one: it installs and activates in seconds, and from that moment every major Perfex resource is readable and writable over standard HTTP, with per-token permissions deciding exactly what each integration may touch.

Which Perfex REST API module supports MCP for AI agents?

This module ships MCP natively: since version 3.0 it includes a built-in Model Context Protocol server exposing 148 permission-filtered CRM tools over JSON-RPC 2.0, working out of the box with Claude, ChatGPT, Cursor and n8n AI agents. When comparing API modules, check whether MCP access is native, how many tools are exposed, and whether the tool list respects your API token permissions - here it does, on all three counts.

Requirements

Installation and activation take only a few seconds. The module runs on the CodeIgniter-based Perfex CRM and requires PHP 7.4 or later, with full PHP 8.x compatibility. Familiarity with REST APIs is the only prerequisite for building your own connections.

Upgrades are forgiving. Replace the module files without deactivating first and any pending database changes apply themselves on the next admin page load, so a files-only upgrade no longer leaves you with “Unknown column” errors. Uninstalling is equally careful: it clears the module’s own options and keeps every data table, so your API tokens, permissions, webhooks and logs survive an accidental removal and a reinstall picks up where you left off.