API & webhooks reference

Every endpoint below is relative to:

https://mqcl-crm.com/api/v1

Generate a key in Settings → API & webhooks (workspace admins only). The full key is shown once at creation — store it securely. Send it as a Bearer token on every request:

curl https://mqcl-crm.com/api/v1/contacts \
  -H "Authorization: Bearer mqcl_live_your_key_here"

A missing or invalid key returns 401. Keys can be revoked anytime from the same settings page.

Send JSON bodies. Successful creates return 201 with the new record under a data key.

Create a contact

curl -X POST https://mqcl-crm.com/api/v1/contacts \
  -H "Authorization: Bearer mqcl_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "Jane",
    "lastName": "Doe",
    "email": "jane@acme.com",
    "status": "WARM"
  }'

Create a company

curl -X POST https://mqcl-crm.com/api/v1/companies \
  -H "Authorization: Bearer mqcl_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Inc", "domain": "acme.com", "website": "https://acme.com" }'

Create a deal

stageId is optional — omit it and the deal lands in the first stage of your default pipeline.

curl -X POST https://mqcl-crm.com/api/v1/deals \
  -H "Authorization: Bearer mqcl_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme expansion", "amount": 5000, "currency": "USD" }'

Errors return a matching HTTP status and a JSON body:

{ "error": { "message": "Invalid or revoked API key." } }

Validation failures return 422 with an issues array describing each field. Unknown records return 404.

Add an endpoint in Settings → API & webhooks and subscribe to the events you care about. When an event fires we POST a signed JSON payload to your URL.

Payload

POST https://your-endpoint.example.com
X-MQCL-Event: deal.won
X-MQCL-Signature: sha256=<hmac>

{
  "event": "deal.won",
  "workspaceId": "…",
  "occurredAt": "2026-06-12T09:30:00.000Z",
  "data": { "id": "…", "name": "Acme expansion", "amount": 5000 }
}

Verify the signature

Each delivery is signed with your endpoint's secret (shown once when you add it). Recompute the HMAC over the raw request body and compare:

import crypto from 'node:crypto';

function isValid(rawBody, signatureHeader, secret) {
  const expected =
    'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader),
  );
}

Respond with a 2xx status to acknowledge. Non-2xx responses and timeouts are recorded in the endpoint's recent-delivery log.