CRM

The SuperCool CRM has its own API. The SuperCool app on Zapier is built on it, and your code can call it too: create and update contacts, tag them, open and move opportunities, add tasks, put contacts into workflows, send texts and emails, subscribe to CRM events, and post leads from your own forms.

These endpoints are not under /v1. They use the same API keys as the rest of the SuperCool API, but their own base URL and error shape. They're also in the API reference and the OpenAPI spec.

#Authentication

Send one of your dashboard API keys as a bearer token:

Authorization: Bearer sc_key_9fK2...x7Qa
X-Workspace-Id: 6650a1b2c3d4e5f6a7b8c9d0

• Use a regular key. An isolated key gets 403.
• Pick the CRM. Without X-Workspace-Id, requests go to the key owner's personal CRM. To use a team's CRM, send the team id in X-Workspace-Id. The key's owner must be a member of that team (any role). The team id is shown on the Zapier card in the CRM's Settings → Integrations. The /zapier/… endpoints also accept it as ?workspace_id=, and POST /leads as workspace_id in the body; the header wins.
• Everything is done as the key. Contacts, tags, opportunities and tasks it creates, and the activity it writes on contacts, are attributed to the key (api_key:<key id>).

#Test a key

GET /zapier/me checks the key and returns who it belongs to and which CRM it reaches. Zapier calls it when you connect an account and shows label as the connection's name.

curl https://api.supercool.com/api/v1/crm-app/zapier/me \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "X-Workspace-Id: 6650a1b2c3d4e5f6a7b8c9d0"

{
  "ok": true,
  "user_id": "64f1c2a9e4b0a1b2c3d4e5f6",
  "email": "[email protected]",
  "workspace_id": "6650a1b2c3d4e5f6a7b8c9d0",
  "team_name": "Rivera Studio",
  "role": "admin",
  "key": { "id": "pat:6a1b2c3d4e5f", "name": "Zapier", "hint": "sc_key_9fK2…x7Qa" },
  "label": "[email protected] · Rivera Studio"
}

workspace_id is the team id (null for a personal CRM), team_name the team's name, and role your role in that CRM: admin or member.

#Errors

Errors have one field, detail. It's usually a sentence:

{ "detail": "Contact not found" }

There is no 409: conflicts, like a duplicate opportunity or an email address that's already taken, are 400. An unexpected failure is 500 with {"detail": "Something went wrong"}.

A 422 has one of two shapes. A schema error lists the problems:

{ "detail": [{ "type": "missing", "loc": ["body", "title"], "msg": "Field required", "input": {} }] }

A refused text or email has a machine-readable reason and a sentence you can show people:

{ "detail": { "reason": "no_consent", "message": "Text campaigns go only to contacts with explicit SMS consent." } }

See refusal reasons for every reason.

#Rate limits

Over the limit, the request gets 429 with {"detail": "Too many Zapier requests per minute for this key"} (or Too many leads per minute for this key). The window is a rolling 60 seconds: wait, then retry. Texts and emails also have daily sending limits; going over them is a refusal, not a 429.

#Contacts in requests

Most actions work on one existing contact. Name it with any of these fields:

The contact is found by contact_id (or contact) as an id, then as an email address (if it contains @) or a phone number, then by email, then by phone. If none matches, the request gets 404 with Contact not found.

#The contact object

Contact actions return the contact. The main fields:

Other fields may be present, such as attribution (first and last touch from forms and the Lead API).

#Contacts

#Create or update a contact

POST /zapier/contacts finds the contact by email, then by phone, and updates it, or creates it if there is none. A new contact's source is zapier. Only the non-empty fields you send are written; nothing is blanked.

Explicit consent is never downgraded. Send consent and sms_consent only when the person actually agreed.

curl https://api.supercool.com/api/v1/crm-app/zapier/contacts \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "first_name": "Jane",
    "last_name": "Doe",
    "phone": "(555) 555-0123",
    "tags": "lead, webinar",
    "consent": true
  }'

Returns 200 with the contact at the top level, plus ok and created (true if the contact is new):

{
  "ok": true,
  "created": true,
  "id": "ct_8f2a6c1e9b3d5f7a0c4e",
  "email": "[email protected]",
  "phone": "+15555550123",
  "first_name": "Jane",
  "last_name": "Doe",
  "display_name": "Jane Doe",
  "tags": ["tag_1a2b3c4d5e6f7a8b9c0d", "tag_0d9c8b7a6f5e4d3c2b1a"],
  "fields": {},
  "source": "zapier",
  "status": "active",
  "dnd": { "email": false, "sms": false, "calls": false, "all": false, "reason": null, "at": null },
  "consent": {
    "email": { "status": "explicit", "source": "zapier", "at": "2026-10-23T14:02:11.402000Z" },
    "call": { "status": "none", "source": null, "at": null }
  },
  "created_at": "2026-10-23T14:02:11.402000Z",
  "updated_at": "2026-10-23T14:02:11.402000Z"
}

Errors: 400 (email or phone is required, Email address is not valid, Phone number is not valid, a custom field value of the wrong type), 422 (wrong field types).

#Update a contact

POST /zapier/contacts/update changes an existing contact. Name the contact with the lookup fields, and send the fields to change: the same contact fields as create or update. Only the fields you send change. tags are added to the contact's tags. Custom field keys must exist. consent and sms_consent are ignored here.

An email or phone that you used to find the contact, and that it already has, is not a change.

curl https://api.supercool.com/api/v1/crm-app/zapier/contacts/update \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "contact": "[email protected]", "company": "Example Co", "tags": ["customer"] }'

Returns 200 with ok: true and the updated contact at the top level.

Errors: 400 (Nothing to update, Another contact already has that email, Unknown custom field '…', invalid email or phone), 404 (Contact not found).

#Find a contact

GET /zapier/contacts/find looks a contact up by id, contact, email or phone (query parameters, same order as the lookup fields). It never returns 404: no match is an empty list.

curl "https://api.supercool.com/api/v1/crm-app/zapier/contacts/[email protected]" \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY"

{ "items": [{ "id": "ct_8f2a6c1e9b3d5f7a0c4e", "email": "[email protected]", "first_name": "Jane", "last_name": "Doe" }] }

Each item is a full contact (shortened here).

#Add tags

POST /zapier/contacts/tags adds tags to a contact, by name. Missing tags are created. Name the contact with the lookup fields.

curl https://api.supercool.com/api/v1/crm-app/zapier/contacts/tags \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "contact_id": "ct_8f2a6c1e9b3d5f7a0c4e", "tags": ["vip", "webinar"] }'

Returns 200 with ok: true and the contact. Adding tags the contact already has changes nothing. Errors: 400 (tags is required), 404 (Contact not found).

#Remove tags

POST /zapier/contacts/tags/remove takes tags off a contact. tags takes names (matched ignoring case and extra spaces) or tag ids (tag_…). Tags the contact doesn't have are skipped.

curl https://api.supercool.com/api/v1/crm-app/zapier/contacts/tags/remove \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "tags": "webinar" }'

Returns 200 with ok: true and the contact. Errors: 400 (tags is required), 404 (Contact not found).

#Opportunities

An opportunity is a potential sale: one contact, in one stage of one pipeline, with a status of open, won, lost or abandoned.

#Create an opportunity

POST /zapier/opportunities opens an opportunity for a contact. Name the contact with the lookup fields.

curl https://api.supercool.com/api/v1/crm-app/zapier/opportunities \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "pipeline": "Sales", "stage": "Qualified", "value": "1500" }'

Returns 201 with the opportunity:

{
  "id": "opp_7d8e9f0a1b2c3d4e5f6a",
  "pipeline_id": "pl_2b3c4d5e6f7a8b9c0d1e",
  "stage_id": "st_5e6f7a8b9c0d1e2f3a4b",
  "contact_id": "ct_8f2a6c1e9b3d5f7a0c4e",
  "name": "Jane Doe",
  "status": "open",
  "value": 150000,
  "currency": "usd",
  "source": "zapier",
  "owner_user_id": null,
  "tags": [],
  "fields": {},
  "expected_close_at": null,
  "created_at": "2026-10-23T14:05:00.118000Z",
  "updated_at": "2026-10-23T14:05:00.118000Z"
}

Other fields, such as followers, lost_reason, stage_entered_at and days_in_stage, are included too. value is always in minor units in responses. Responses from these endpoints don't fill in pipeline_name and stage_name; use GET /zapier/pipelines to name the ids.

Errors: 400 (Pipeline not found, No stage '…' in pipeline '…', Jane Doe already has an open opportunity in Sales, Value must be a number), 404 (Contact not found), 503 (pipelines aren't available on the account).

#Move an opportunity

POST /zapier/opportunities/{opportunity_id}/move moves an opportunity to another stage, another pipeline, or another status. Send at least one of:

curl https://api.supercool.com/api/v1/crm-app/zapier/opportunities/opp_7d8e9f0a1b2c3d4e5f6a/move \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "stage": "Proposal sent" }'

Returns 200 with the opportunity. Errors: 400 (stage, pipeline or status is required, an unknown stage or pipeline, Status must be open, won, lost or abandoned, the contact already has an open opportunity in the new pipeline), 404 (Opportunity not found), 503.

#Tasks

#Create a task

POST /zapier/tasks adds a task, optionally on a contact.

curl https://api.supercool.com/api/v1/crm-app/zapier/tasks \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "title": "Call Jane", "email": "[email protected]", "due_date": "2026-10-27", "due_time": "10:00", "timezone": "America/Chicago" }'

Returns 201 with the task: id (tsk_…), title, description_html, contact_id, opportunity_id, assigned_to, due_at, due_date, due_time, all_day, timezone, status (open), origin ({"kind": "manual", "reason": "Created by Zapier"}), created_at and updated_at.

Errors: 400 (title is required, due_date must be YYYY-MM-DD, due_time must be HH:MM, unknown time zone '…'), 404 (Contact not found), 422 (no title field), 503.

#Workflows

#Add a contact to a workflow

POST /zapier/workflows/{workflow_id}/enroll starts a published workflow for a contact. Name the contact with the lookup fields. The workflow's own re-entry rules apply.

curl https://api.supercool.com/api/v1/crm-app/zapier/workflows/wf_0a1b2c3d4e5f6a7b8c9d/enroll \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]" }'

{
  "ok": true,
  "reason": "enrolled",
  "enrollment_id": "wfe_6f7a8b9c0d1e2f3a4b5c",
  "workflow_id": "wf_0a1b2c3d4e5f6a7b8c9d",
  "workflow_name": "New lead follow-up",
  "contact_id": "ct_8f2a6c1e9b3d5f7a0c4e"
}

Not being enrolled is not an error: the response is 200 with ok: false and the reason:

Errors: 404 (Workflow not found, Contact not found), 503.

#Texts and emails

#Consent rules

Send Text and Send Email are marketing sends. They follow the same rules as a campaign, so they only reach people who agreed to hear from you:

• Email needs explicit email consent. The contact's email consent must be explicit. The API sets it with consent: true on create or update or the Lead API. Contacts created without it get imported_unknown, which isn't enough.
• Texts need explicit SMS consent. The contact's SMS consent must be explicit. The API sets it with sms_consent: true, only for a contact with a phone number. Nothing else the API does grants SMS consent.
• Opt-outs always win. A contact on Do Not Disturb, an address that unsubscribed, bounced or complained, and a number that replied STOP are never sent to.
• Texts respect quiet hours. Texts go out only during the CRM's texting hours (8:00 to 21:00 by default) in the recipient's time zone, worked out from the number. Outside them, the send is refused with quiet_hours.
• Daily limits apply, and so do pauses on the account (for example after a high bounce rate).

A refused send gets 422 with a reason (see below). Nothing is sent and nothing is queued: fix the cause, or try again later.

Texts and emails use credits. The response's credits is what the send cost.

#Send a text

POST /zapier/messages/sms texts a contact from the CRM's phone number. Name the contact with the lookup fields.

curl https://api.supercool.com/api/v1/crm-app/zapier/messages/sms \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "contact": "+15555550123", "text": "Hi Jane, your order shipped today." }'

{
  "ok": true,
  "contact_id": "ct_8f2a6c1e9b3d5f7a0c4e",
  "id": "cmsg_9b2c4d6e8f0a1b3c5d7e",
  "status": "accepted",
  "kind": "sms",
  "conversation_id": "cv_3c4d5e6f7a8b9c0d1e2f",
  "segments": 1,
  "credits": 10,
  "error": null,
  "created_at": "2026-10-23T14:10:02.551000Z"
}

status is accepted (handed to the carrier), uncertain (the carrier's answer didn't come back), failed, or refused (the carrier says the number opted out). Errors: 400 (text is required), 404 (Contact not found), 422 (refused), 503.

#Send an email

POST /zapier/messages/email emails a contact from the CRM's default sender. Name the contact with the lookup fields.

curl https://api.supercool.com/api/v1/crm-app/zapier/messages/email \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "subject": "Your order shipped", "text": "Hi Jane,\nyour order shipped today." }'

Returns 201 with ok, contact_id and the message (id, status, kind, conversation_id, credits, error, created_at). status is accepted, uncertain or failed. Errors: 400 (subject and html (or text) are required), 404 (Contact not found), 422 (refused), 503.

#Refusal reasons

#Lists for dropdowns

These return what the Zapier app shows in its dropdowns, as {"items": [...]}:

curl https://api.supercool.com/api/v1/crm-app/zapier/pipelines \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY"

{
  "items": [{
    "id": "pl_2b3c4d5e6f7a8b9c0d1e",
    "name": "Sales",
    "stages": [
      { "id": "st_4d5e6f7a8b9c0d1e2f3a", "name": "New lead", "position": 0 },
      { "id": "st_5e6f7a8b9c0d1e2f3a4b", "name": "Qualified", "position": 1 }
    ]
  }]
}

#Triggers (REST hooks)

To hear about CRM events, subscribe a URL to a trigger. SuperCool POSTs each matching event to it, as it happens. This is how Zapier's instant triggers work, and it works the same for any URL.

#Trigger catalogue

A Lead API post fires both form_submitted and lead_received, and new_contact or contact_updated as well.

#Subscribe

POST /zapier/hooks subscribes a URL to one trigger.

curl https://api.supercool.com/api/v1/crm-app/zapier/hooks \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "event": "new_contact", "target_url": "https://hooks.example.com/supercool/new-contact" }'

Returns 201 with the subscription:

{
  "id": "zh_4c1d2e3f4a5b6c7d8e9f",
  "key_id": "pat:6a1b2c3d4e5f",
  "event": "new_contact",
  "label": "New Contact",
  "target_url": "https://hooks.example.com/supercool/new-contact",
  "target_host": "hooks.example.com",
  "key_name": "Zapier",
  "key_hint": "sc_key_9fK2…x7Qa",
  "deliveries": 0,
  "failures": 0,
  "last_delivery_at": null,
  "last_status": null,
  "last_error": null,
  "created_at": "2026-10-23T13:40:00Z",
  "updated_at": "2026-10-23T13:40:00Z"
}

• Subscribing the same URL to the same trigger again returns the existing subscription, so retrying a subscribe is safe.
• A CRM can have up to 100 subscriptions. Past that, the request gets 400.
• Subscriptions belong to the CRM, not to the key: every key that reaches the CRM sees and can remove them, and they're listed on the Zapier card in Settings → Integrations, where an admin can remove them too.

Errors: 400 (Unknown event '…'; one of: …, target_url must be a public http(s) URL, the 100-subscription limit), 422 (a missing field).

#List subscriptions

GET /zapier/hooks returns the CRM's subscriptions, newest first, as {"items": [...]}. deliveries and failures count delivered and failed events; last_status and last_error describe the latest attempt.

curl https://api.supercool.com/api/v1/crm-app/zapier/hooks -H "Authorization: Bearer $SUPERCOOL_API_KEY"

#Unsubscribe

DELETE /zapier/hooks/{hook_id} removes one subscription. Events still waiting to be delivered to it are dropped.

curl -X DELETE https://api.supercool.com/api/v1/crm-app/zapier/hooks/zh_4c1d2e3f4a5b6c7d8e9f \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY"

{ "ok": true }

DELETE /zapier/hooks with a JSON body does the same by id, or by target_url (every subscription to that URL, or only the one for event if you send it). It needs id or target_url (400 otherwise).

curl -X DELETE https://api.supercool.com/api/v1/crm-app/zapier/hooks \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "target_url": "https://hooks.example.com/supercool/new-contact", "event": "new_contact" }'

Both return 404 (Hook not found) when nothing matches.

#Sample events

GET /zapier/perform-list/{event} returns up to 3 of the CRM's most recent events for a trigger, newest first, in the same payload a subscription receives. When the CRM has none yet, it returns one made-up sample ("id": "ev_sample") so you can map fields before the first real event. An unknown trigger key gets 400.

curl https://api.supercool.com/api/v1/crm-app/zapier/perform-list/new_contact \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY"

#Payload

Every delivery is a JSON POST of one event:

{
  "id": "ev_3f9a1c2e7b8d4e5f6a7b",
  "trigger": "new_contact",
  "type": "contact.created",
  "label": "Contact created",
  "occurred_at": "2026-10-23T14:02:11.402000Z",
  "contact_id": "ct_8f2a6c1e9b3d5f7a0c4e",
  "contact": {
    "id": "ct_8f2a6c1e9b3d5f7a0c4e",
    "email": "[email protected]",
    "phone": "+15555550123",
    "first_name": "Jane",
    "last_name": "Doe",
    "full_name": "Jane Doe",
    "company": "Example Co",
    "address": null,
    "city": "Austin",
    "state": "TX",
    "postal_code": "78701",
    "country": "US",
    "website": null,
    "source": "form",
    "owner_user_id": null,
    "fields": {},
    "tag_ids": ["tag_1a2b3c4d5e6f7a8b9c0d"],
    "tags": ["lead"],
    "dnd": { "email": false, "sms": false, "calls": false, "all": false, "reason": null, "at": null },
    "consent": { "email": "explicit", "sms": null },
    "created_at": "2026-10-23T14:02:11.402000Z",
    "updated_at": "2026-10-23T14:02:11.402000Z"
  },
  "data": { "source": "form", "tags": ["tag_1a2b3c4d5e6f7a8b9c0d"], "owner_user_id": null },
  "ref": {},
  "actor": { "kind": "system", "id": null }
}

#Delivery

The request carries these headers:

Deliveries are not signed. Treat the target_url as a secret, and use a URL that's hard to guess.

• Respond with any 2xx within 10 seconds. Redirects are not followed.
• 410 Gone unsubscribes. The subscription is removed, with anything still waiting for it. This is how Zapier turns a hook off when a Zap is deleted.
• Some failures are retried. A timeout, a network error, 408, 425, 429 or any 5xx is retried after 1 minute, 5 minutes, 15 minutes, 1 hour, 6 hours and 24 hours: up to 7 attempts in all. Then the delivery is marked failed.
• Other 4xx (and 3xx) responses fail at once, without retries.
• Delivery is at least once. Each event gets one delivery per subscription, but that delivery can reach you more than once: for example, when your server handled it but answered after 10 seconds, it's retried. Drop duplicates by id. Events can arrive out of order.
• A revoked key stops its subscriptions. If the API key that created a subscription is revoked, the subscription is removed the next time an event would go to it.

Failures show on the subscription (failures, last_status, last_error) and on the Zapier card in Settings → Integrations.

#Lead API

POST /leads adds a lead to the CRM from your own form, landing page or backend. It creates the contact, or updates the one with the same email or phone, with source lead_api. It's like create or update, plus attribution and an optional opportunity.

curl https://api.supercool.com/api/v1/crm-app/leads \
  -H "Authorization: Bearer $SUPERCOOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "first_name": "Jane",
    "phone": "+15555550123",
    "tags": ["webinar"],
    "consent": true,
    "sms_consent": true,
    "source": "pricing page",
    "attribution": { "utm_source": "google", "utm_campaign": "fall-promo" },
    "opportunity": { "pipeline": "Sales", "value": 50000 }
  }'

Returns 201:

{
  "ok": true,
  "created": true,
  "contact": { "id": "ct_8f2a6c1e9b3d5f7a0c4e", "email": "[email protected]", "phone": "+15555550123", "first_name": "Jane", "source": "lead_api" }
}

contact is the full contact (shortened here). Every lead fires the form_submitted and lead_received triggers.

Errors: 400 (email or phone is required, an invalid email or phone), 401, 403, 422 (wrong field types, like tags as a string), 429 (600 leads per minute per key).