CrowdStack API
A small, stable REST API for getting data into CrowdStack from wherever it lives. Today it covers contacts and campaigns; more resources follow as we need them ourselves.
Base URL
All endpoints live under https://crowdstack.org/api/v1/. The version is part of the path; breaking changes ship as a new version and the old one keeps working. Requests and responses are JSON, and responses are never cached.
Authentication
Create a key under Settings → General → API keys. Keys belong to the workspace, not to a person, and are shown once at creation. Send one as a bearer token on every request:
Authorization: Bearer cs_live_…
Content-Type: application/jsonRevoking a key takes effect immediately. Keep keys in your integration's secret store; if one leaks, revoke it and create another.
Errors
Every error has the same shape. code is stable and meant for programs; message is for people.
{
"error": {
"code": "validation_failed",
"message": "The request body did not validate.",
"details": [
{ "path": "fields.demo_url", "message": "Unknown field. Defined fields: plan_interest." }
]
}
}| Status | Code | When |
|---|---|---|
| 400 | invalid_request | The body is not valid JSON. |
| 401 | unauthorized | The key is missing, revoked, or unknown. |
| 404 | not_found | The campaign or contact is not in this workspace. |
| 422 | validation_failed | The body failed validation. `details` lists each problem. |
| 429 | rate_limited | The key is over its per-minute limit. Retry after a short wait. |
| 500 | internal | Something failed on our side. Safe to retry. |
Rate limits
300 requests per minute per key. Over the limit you get a 429 with code rate_limited; wait a moment and retry. Limits apply per key, so give each integration its own key and one runaway script cannot starve the others.
Resources
- ContactsPeople in your CRM. Create or update them by email, including company, tags, lifecycle stage and any custom fields you have defined.
- CampaignsOutreach sequences. List them to find an id, then enrol contacts. Sending itself stays with the campaign runner, so send windows, mailbox limits and unsubscribes apply to API-enrolled contacts exactly as they do to everyone else.