Base URL

All endpoints live under https://crowdstack.org/api/v1/. The version is part of the path; breaking changes ship as a new version and the old one keeps working. Requests and responses are JSON, and responses are never cached.

Authentication

Create a key under Settings → General → API keys. Keys belong to the workspace, not to a person, and are shown once at creation. Send one as a bearer token on every request:

Authorization: Bearer cs_live_…
Content-Type: application/json

Revoking a key takes effect immediately. Keep keys in your integration's secret store; if one leaks, revoke it and create another.

Errors

Every error has the same shape. code is stable and meant for programs; message is for people.

{
  "error": {
    "code": "validation_failed",
    "message": "The request body did not validate.",
    "details": [
      { "path": "fields.demo_url", "message": "Unknown field. Defined fields: plan_interest." }
    ]
  }
}
StatusCodeWhen
400invalid_requestThe body is not valid JSON.
401unauthorizedThe key is missing, revoked, or unknown.
404not_foundThe campaign or contact is not in this workspace.
422validation_failedThe body failed validation. `details` lists each problem.
429rate_limitedThe key is over its per-minute limit. Retry after a short wait.
500internalSomething failed on our side. Safe to retry.

Rate limits

300 requests per minute per key. Over the limit you get a 429 with code rate_limited; wait a moment and retry. Limits apply per key, so give each integration its own key and one runaway script cannot starve the others.

Resources