REST API module for Perfex CRM

About REST API module for Perfex CRM

Connect Perfex CRM to AI agents, automation platforms and any third-party app with a flexible, fully-documented REST API and a built-in MCP server. The REST API module for Perfex CRM exposes your customers, contacts, leads, invoices, projects, tasks and much more over standard HTTP - so external applications, automation tools and AI assistants can read and write Perfex data in real time, and you can control your installation remotely, with no custom core work required.

The API operates over HTTP/HTTPS and follows REST conventions: it uses standard HTTP methods (GET, POST, PUT, DELETE) and meaningful HTTP status codes to define requests and responses. If you have worked with any REST API before, you will be productive in minutes.

New in v3.0 - the AI-ready release - a built-in MCP server exposing 148 CRM tools to AI agents (Claude, ChatGPT, Cursor, n8n), Webhooks 2.0 with a 124-event catalog and async signed delivery, an OpenAPI 3.1 specification endpoint, new Knowledge Base and Notes endpoints, batch operations (up to 50 per request), idempotent POST retries, per-response rate-limit headers, server-side invoice totals, tolerant partial updates and one-click self-update.

A complete API service for Perfex CRM

This is a mature, actively developed module that gives you a complete API service for your Perfex CRM installation - the foundation for building your own third-party service connections to Zapier, IFTTT, Make.com, n8n, AI agents and any other platform you rely on. It installs, activates and gives you a fully working API in only a few seconds, and stays compatible with the latest Perfex CRM release and PHP 8.x.

The possibilities are genuinely unlimited - the only prerequisite is that you are familiar with REST APIs. Complete online documentation, with full request and response examples for every endpoint, is included to help you build your connections; if you are not comfortable working with APIs, consider hiring an expert to set up your integrations.

AI-ready: a built-in MCP server for AI agents

Version 3.0 turns Perfex into an AI-ready platform. The module now ships with a built-in MCP server (Model Context Protocol) that exposes 148 CRM tools over JSON-RPC 2.0 on a streamable HTTP endpoint, so AI assistants like Claude, ChatGPT, Cursor and n8n AI agents can securely search customers, draft invoices, update leads, manage tasks and much more, straight from a conversation.

Every tool respects the permissions of the API token behind it - an agent can only see and do what its token is allowed to - so you expose exactly as much of your CRM as you choose. Enable it with a single toggle in the admin settings, paste the endpoint URL into your AI client, and your CRM becomes part of your AI workflow with no custom code.

Every endpoint you need

Almost everything you manage inside Perfex is available as an endpoint, with create, read, update, delete and search support where it makes sense. The currently available endpoints cover:

Sales and billing

• Invoices - add, update, delete, request and search invoices
• Estimates - add, update, delete, request and search estimates
• Proposals - add, update, delete, request and search proposals
• Payments - add a payment, list all payments and search payments
• Subscriptions - add, update, delete, request a subscription and list subscriptions
• Contracts - add, delete and request contracts
• Expenses - add, update, delete, request and search expenses, plus request expense categories
• Payment modes and taxes - request payment modes and list all taxes

Contacts and pipeline

• Customers - add, update, delete, request, search and list all contacts of a customer
• Contacts - add, update, delete, request and search contacts
• Leads - add, update, delete, request and search leads
• Custom fields - add, update, delete, request fields and their values, and search field values

Projects and delivery

• Projects - add, update, delete, request and search projects
• Milestones - add, update, delete, request and search milestones
• Tasks - add, update, delete, request and search tasks, with task checklist and assignee support
• Timesheets - add, update, delete, request a timesheet and list timesheets
• Calendar events - create, update, delete, get all events and request a specific event

Support and team

• Tickets - add, update, delete, request and search tickets, plus post replies with attachments and status changes
• Staff members - add, update, delete, request and search staff

Knowledge, notes and content

• Knowledge base - full CRUD for articles and groups, with group filtering and automatic unique-slug generation
• Notes - polymorphic notes attached to 12 entity types (customers, leads, contracts, tickets, invoices, estimates, credit notes, staff, expenses, proposals, projects and tasks)

Custom modules and automation

• Third-party (custom modules) - full CRUD against any custom database table created by third-party modules: get all records, get a record by ID, insert, update and delete
• Automation connectors - poll for new data, test triggers and list available resources for Zapier, Make.com and n8n
• Batch operations - execute up to 50 operations in a single request, with per-operation results and continue-on-error

File attachments can be pushed to leads, contracts, tasks and expenses, and every list endpoint shares a unified toolkit for pagination, sorting, field selection and date-range filtering so large results stay fast and predictable.

Granular permissions per API token

Issue a dedicated API key for each integration and decide exactly what it is allowed to do. The permissions system lets you grant or revoke Get, Create, Update and Delete access per resource, so every connected application - and every AI agent - runs with least-privilege access. Built-in request limiting and quota limiting let you cap usage, and each key can be given an expiry date - all managed from one screen.

Webhooks 2.0

Stop polling for changes that may never come. Webhooks 2.0 pushes real CRM events to any URL the moment they happen - a catalog of 124 events across 22 resource groups, bridged to 75 core Perfex actions so both admin-side and API-side changes fire notifications. Delivery is asynchronous by default: a background queue (via cron, with an admin-load fallback for installs without one) claims each job atomically and retries failures with exponential backoff.

Every request is HMAC-signed with a timestamp (X-Perfex-Signature) for verification and replay protection, and deliveries are guarded by SSRF filtering and TLS verification, with an optional strict mode that blocks private-LAN targets. You manage it all through a dedicated webhook management API - create, update, delete and toggle webhooks, browse the event catalog and read delivery logs programmatically - or from the admin UI, with a built-in test function and a complete delivery log to confirm everything works before you go live.

Native automation connectors

You should not need a developer to wire Perfex into your stack. The module ships with native support for the Zapier, Make.com and n8n automation platforms, plus a ready-to-import Postman collection covering all 22 resources. A standalone manifest generator produces the manifest for each platform with download links and setup instructions - drop in your API key and start building scenarios. Dedicated polling and test endpoints with timestamp filtering give automation triggers exactly the shape they expect, and a resource-discovery endpoint lets tools enumerate what is available.

Built-in reporting and tooling

Operating an API should not be a black box. A reporting interface gives you user statistics and per-API-key statistics so you can see how each integration is being used. Request logging captures every call for monitoring and debugging, response caching for GET requests improves performance and reduces server load, and an interactive Swagger playground lets you test endpoints and read the documentation from inside Perfex. An API response transformer can wrap responses in a standardised JSON format, filter response fields by query parameter, and automatically strip sensitive fields for privacy. An OpenAPI 3.1 specification endpoint (GET /api/openapi.json) describes the entire API - 72 paths and 139 operations - so you can import it into Postman, Insomnia or Stoplight in seconds, and every response carries X-RateLimit headers so clients always know exactly where they stand.

Built for developers

Small details make an API pleasant to build against, and v3 is full of them:

• Unified list toolkit on every list endpoint - pagination, sorting (?sort=-datecreated), field selection (?fields=id,company) and date-range filters (created_after / created_before), all fully backwards compatible.
• Server-side totals for invoices, estimates, proposals and credit notes, computed from line items, taxes, discounts and adjustments so you never recalculate on the client.
• Tolerant partial updates on 13 resources - unknown payload fields are ignored instead of causing errors.
• Idempotency-Key support on POST - an identical retry safely replays the stored response instead of re-executing, within a 24-hour window.
• One-click self-update with a daily version check, downgrade guard and OPcache reset, so the module keeps itself current.

Enterprise-grade security

API security is handled by middleware you configure from an intuitive admin interface, no coding required. Restrict access with IP whitelisting and blacklisting (with CIDR notation support), set a configurable maximum request body size to prevent abuse, and enable security headers such as X-Frame-Options and Content-Security-Policy. Authentication is flexible too: send your key as a Bearer token in the Authorization header, pass it as an authtoken or api_key query parameter for simple URL-based access, or use the JWT implementation - whichever fits the client you are integrating. Table-name sanitisation and parameterised queries protect the dynamic custom-table endpoints against SQL injection.

New in v3, brute-force protection throttles repeated failed authentications per IP, and an optional staff-level data-visibility mode links a token to a staff member so the API scopes data exactly like the admin panel does. A v3 platform-settings panel puts it all in one place, letting you toggle the MCP server, webhook delivery mode, SSRF strict mode, TLS verification, staff visibility and authentication throttling from the admin UI.

What you can build

The REST API module turns Perfex into a connected platform and lets you:

• Connect AI agents - let Claude, ChatGPT, Cursor or n8n AI agents work directly with your CRM through the built-in MCP server, finding customers, drafting invoices, updating leads or summarising open tickets, with every action bounded by the token’s permissions.
• Automate workflows - connect Perfex CRM to accounting software, project-management platforms or email-marketing systems, eliminate manual data entry, and synchronise data, create leads and update contacts automatically, with native support for Zapier, Make.com and n8n.
• Extend functionality - integrate external services such as geolocation, SMS notifications or payment gateways to build a CRM experience tailored to your exact requirements.
• Improve efficiency - keep accurate, up-to-date information flowing between Perfex and every connected tool, eliminating data inconsistencies and manual errors, with real-time webhook notifications of every change.
• Foster collaboration - share CRM data with the right team members and sync task progress into your project-management and team-communication platforms.
• Drive business growth - build a unified ecosystem of applications that work together harmoniously, so you can make data-driven decisions and deliver exceptional customer experiences.

Requirements

Installation and activation take only a few seconds. The module runs on the CodeIgniter-based Perfex CRM and requires PHP 7.4 or later, with full PHP 8.x compatibility. Familiarity with REST APIs is the only prerequisite for building your own connections.