REST & GraphQL API

REST that behaves like a first-class product.

140+ endpoints across every Atlas object. Typed schemas, idempotent writes, cursor pagination, and 99.99% uptime. Keys in one minute, production integration in an afternoon.

Start free Book a demo

POST /v1/deals

curl -X "POST" "https://api.atlas.dev/v1/deals" \
-H "Authorization: Bearer $ATLAS_KEY" \
-H "Idempotency-Key: 8f4e2c1a-demo" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme expansion",
"value": 48000,
"currency": "USD",
"stage": "qualified",
"contact_id": "con_01HFXZ...",
"ai_scoring": true
  }'
# 201 Created
{ "id": "deal_01HFXZR2V3...", "ai_score": 82 }

Everything you need, built in.

The essentials for teams that want to move fast without giving up control.

140+ REST endpoints

CRUD plus search, bulk, and action endpoints for every Atlas object — deals, contacts, activities, tasks, tickets.

GraphQL for complex reads

Single query to fetch a deal with contacts, activities, and scoring. No N+1 round-trips.

OAuth 2.0 + scoped API keys

PKCE flow for user apps, scoped keys for server-to-server. Rotate any key in one click.

1000 req/s per key

Token-bucket rate limits with burst capacity. `X-RateLimit-Remaining` on every response.

Idempotency keys

Safely retry any POST. Dedup window is 24 hours — no double deals, ever.

Type-safe SDKs

Typed in four languages. Tested in production.

Every endpoint ships in TypeScript, Python, Go, and Ruby. Types are generated from the OpenAPI 3.1 spec — if it compiles, it runs.

TypeScript: strict types, Zod-compatible schemas, tree-shakeable
Python: pydantic v2 models, async + sync clients, type stubs
Go: context-aware, generics on list/search endpoints
Ruby: Sorbet-typed, Rails-friendly ActiveSupport conventions

atlas.deals.create()

import { Atlas } from "@atlas/sdk";
const atlas = new Atlas(process.env.ATLAS_KEY);
// Fully typed — autocomplete everywhere
const deal = await atlas.deals.create({
name: "Acme expansion",
value: 48000,
stage: "qualified",
aiScoring: true,
});
deal.aiScore // number | null

Search & bulk

Query the CRM like a database.

Filter by any field, any operator, any boolean combo. Cursor-paginated for stable iteration. Bulk endpoints for 1K-object writes in one call.

Search with AND/OR/NOT, ranges, null-checks, and fuzzy text
Cursor pagination returns `has_more` + `next_cursor`
Bulk create/update/delete up to 1,000 objects per call
`expand` parameter to inline related objects in one request

atlas.contacts.search()

const results = await atlas.contacts.search({
query: {
and: [
{ title: { contains: "VP" } },
{ company.employees: { gte: 100 } },
{ score: { gte: 80 } },
],
},
expand: ["company", "open_deals"],
limit: 50,
});
results.data.length // 50
results.next_cursor // "cur_8f4e..."

Errors & status codes

Predictable errors. Never vague.

Every 4xx response returns a structured error with a stable `code`, a human `message`, and (for validation) field-level `details`. 5xx responses are retriable with exponential backoff.

400 `validation_error` with field-level detail array
401 `unauthorized` · 403 `permission_denied` · 404 `not_found`
409 `idempotency_conflict` if key reuse with different body
429 with `Retry-After` header, 5xx with `request_id` for support

HTTP 400 Bad Request

{
"error": {
"code": "validation_error",
"message": "value must be a positive integer",
"request_id": "req_01HFXZR2V3...",
"details": [
{
"field": "value",
"code": "invalid_type",
"got": "negative"
}
]
}
}

Teams ship revenue with this.

Real-world use cases across every revenue function.

Sync a homegrown app

Mirror your internal tool's objects into Atlas. Bi-directional sync with idempotency keeps state consistent across retries.

Custom pipeline automation

Listen to `deal.updated`, apply your domain logic, write back with a scoped API key. Zero Zapier tax.

Embed CRM inside your product

Use the API to power deal views in your app. Scoped keys restrict access per tenant.

Reporting & analytics

Nightly batch jobs pull deltas via cursor pagination into your warehouse. GraphQL avoids over-fetching.

Frequently asked questions

What's the rate limit?

1,000 requests/second per API key with burst up to 3,000. Every response returns `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset`. Enterprise plans can raise limits.

How do idempotency keys work?

Pass an `Idempotency-Key` header (we recommend a v4 UUID) on any POST. Atlas returns the original response for any replay within 24 hours. If you reuse a key with a different body, you get a 409 `idempotency_conflict`.

Can I use OAuth for user-facing integrations?

Yes — OAuth 2.0 with PKCE for installed apps, plus a token exchange endpoint for server-side. 20+ scopes including `deals:read`, `contacts:write`, and `webhooks:manage`.

Is there a sandbox?

Every workspace comes with a sandbox environment at `https://sandbox.atlas.dev`. Same API surface, isolated data, seeded fixtures for tests. Reset at any time.

Do you version the API?

Yes — the `Atlas-Version` header pins a calendar-versioned release (e.g. `2026-01-15`). Breaking changes only ship in new versions, and we maintain the previous 24 months.

Keep exploring

Webhooks →SDKs →Integrations →Guides →

Run revenue on Atlas.

Start free, no credit card required. Setup in under 10 minutes.

Start free Talk to sales