Zircon CRM / AI & integrations
Runs in the browser · HU / EN / DEREST API with separate permissions for every integration
With the Zircon CRM REST API, your website, online shop, BI tool or an automation reads and writes customers, leads, projects, tickets and financial records directly. Every integration gets its own API user and can do only what you tick in its permission grid.
19 business resourcesPermissions per resourceExpiring, rotatable tokens
In short
What is the Zircon CRM REST API for?
A REST API is a standard web interface that other systems use to request and send data as JSON. Zircon CRM makes 19 business resources available this way, custom fields included, for get, search, create, update and delete. Each integration gets a separate API user, an expiring token and permissions per resource. It is built for developers, integration partners and BI analysts.
Sound familiar?
Data flows, but nobody knows who takes what.
If one of these rings true, your integrations are still running blind.
- 01
The online shop sees everything
Syncing orders needed a key, and the admin account was the easiest choice. Since then the shop has had access to payments and staff records too.
- 02
One leaked key, three systems down
The token ended up in a public code repository. It has to be replaced, but nobody knows which integrations still use it.
- 03
The night-time script ran wild
A faulty loop keeps firing requests non-stop, and by morning the interface is crawling. Which integration caused it only shows up in the server logs.
What it does
What the Zircon CRM REST API gives you.
The API is managed by administrators, and every change to it is written to the activity log.
19 resources, with custom fields
Customers, contacts, leads, projects, milestones, tasks, timesheets, tickets, invoices, estimates, proposals, contracts, credit notes, expenses, payments, items, staff, calendar events and subscriptions. Responses include the custom field values too.
A permission grid per resource
For every API user you tick, resource by resource, what it may do: get, search, create, update, delete. A website form can then create leads and nothing else, while a BI tool may only read invoices.
Expiry, limits, rotation
Each API user can have an expiry date, and configurable request limits and burst limits protect the system from overload. One tick generates a new token: the old one stops working immediately, and the usage statistics carry over.
Search in custom fields and tags
Keyword search covers the usual fields and the values of custom fields. Tickets, leads, invoices and projects can also be found by tag (#), and document numbers work with or without your prefix.
Usage statistics and reporting
Every request is logged with endpoint, response code, response time and IP address. You see 7, 30 or 90 days of statistics per API user, and the company-wide report exports to CSV.
Sensitive data stays inside
Password hashes, password-reset keys and two-factor secrets are stripped from every response, whichever endpoint returns the data.
How it works
How a website form feeds the CRM.
- 01
Create the API user
Give it a name (for example "website, lead form"), an expiry date if it is temporary, and set its request limits.
- 02
Grant only what it needs
In the grid, tick Leads → Create and, if needed, Custom Fields → Get.
- 03
The developer tests it
Hand the token to the developer, who checks it with the token-check endpoint and tries calls in the admin request builder before connecting the form.
- 04
Watch the traffic
New enquiries arrive as leads. The statistics show any errors, and if the token ever leaks, you replace it with one save.
Works with
The modules the API works with most.
- MCP server for AI assistantsfor AI assistants, MCP is the better route because it runs as the staff member, with their permissions.
- Web-to-lead formswhen the built-in form is not enough, your own form creates leads through the API.
- Invoicinginvoices can be read and written with items and totals, and payments recorded against them.
- Custom fieldscustom field values travel with the record in both directions.
- Data import and exportCSV import for one-off moves, the API for continuous sync.
- Integrationsthe list of ready-made third-party connections that need no development.
Honestly
Good to know before you start.
The API answers requests but does not push events (there are no webhooks), and list endpoints return everything at once, without paging. Integrations follow changes by polling, so plan large BI extracts accordingly.
Updating a document with line items (invoice, estimate, proposal, credit note) needs the complete document, including items and totals. An update that sends files replaces the existing attachments.
Staff visibility rules do not apply to API users. Only give trusted integrations read access to financial and staff data.
The request builder calls the live system and changes real data. Use a test API user with limited permissions when experimenting.
An invoice created through the API is Zircon CRM's own invoice. Hungarian companies issue the official invoice, reported to the tax authority, through the Számlázz.hu integration.
Before you write
Fair questions. Straight answers.
- 01
Can I connect an AI assistant to the REST API?
Technically yes, but Zircon CRM has the MCP server for that. MCP runs as the staff member, with their permissions, logs every call, and Claude or Cursor connect in a few steps. Staff visibility rules do not apply to API users.
- 02
Does Zircon CRM notify another system when data changes?
No. The API only answers requests and does not send events. If an integration has to react to changes, it polls the relevant endpoint at intervals, and you set the request limits with that in mind.
- 03
Does the Zircon CRM API work with n8n, Make or Zapier?
Yes, with any tool that can send a generic HTTP request. There are no ready-made connectors: the automation calls the endpoints directly with the token.
- 04
What should I do if an API token has leaked?
In Zircon CRM, edit the API user, ask for a new token and save. The old token stops working immediately, the integration has to be switched to the new one, and the usage statistics move over to it.
Let's talk.
The first call costs nothing
A human replies — not a bot
Bring a list of which of your systems should read or write what in the CRM. In the demo we set up an API user with exactly those permissions together and look at what its statistics show.
- hello@zircon.hu
- Phone
- +36 30 487 7979
- Hours
- Weekdays 9–17
- Support
- support@zircon.hu (existing clients)