Skip to content
Ordyum

Developers

An API-first CRM, one key per client.

Every workspace is created with its own API key. Use it to send leads from any site, sync your client’s systems or build a native app on top of Ordyum.

Open API reference Download OpenAPI

  • One key per workspace

    Created with the workspace and shown once. Add more keys with read or read/write scope and revoke any of them instantly.

  • REST & OpenAPI 3.1

    Predictable JSON, stable error codes, cursor pagination and Idempotency-Key on every POST.

  • Signed webhooks

    HMAC-SHA256 signatures with timestamp, exponential retries and a replayable delivery log.

  • Ready for native apps

    Native clients such as Flutter authenticate with a session token and the Ordyum-Workspace header.

Developers

Quickstart

  1. 1

    Copy your workspace key

    You receive it when you create the workspace. You can create more in Settings → Integrations.

    ord_live_4kq2x9…Start free trial
  2. 2

    Send your first lead

    Ordyum deduplicates by email and phone, stores the attribution and creates a follow-up task.

    POST /v1/leads
    curl -X POST https://your-ordyum.com/v1/leads \
  -H "Authorization: Bearer ord_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: contact-form-8841" \
  -d '{
    "first_name": "Lucía",
    "last_name": "Romero",
    "email": "lucia@example.com",
    "phone": "+34 600 000 000",
    "message": "I would like a quote for implants",
    "source": "landing",
    "attribution": {
      "source": "google",
      "medium": "cpc",
      "campaign": "implants",
      "gclid": "Cj0KCQjw…"
    }
  }'
  3. 3

    Read it back

    List contacts with filters and follow next_cursor to page through results.

    GET /v1/contacts
    curl "https://your-ordyum.com/v1/contacts?q=lucia&limit=25" \
  -H "Authorization: Bearer ord_live_…"

# → { "data": [ … ], "next_cursor": "eyJ…" }

Signed webhooks

Webhooks

Subscribe an endpoint to the events you need. Each delivery is a JSON POST signed with your endpoint secret; reply 2xx within 10 seconds.

Events

  • contact.created
  • contact.updated
  • contact.deleted
  • company.created
  • company.updated
  • company.deleted
  • deal.created
  • deal.updated
  • deal.stage_changed
  • deal.won
  • deal.lost
  • deal.deleted
  • task.created
  • task.updated
  • task.completed
  • activity.created
  • lead.received
  • form.submitted
  • message.received
  • message.sent
Webhooks
POST /your-endpoint
Ordyum-Event: lead.received
Ordyum-Delivery: 3f6c0a1e-…
Ordyum-Signature: t=1760000000,v1=5f1c…

{
  "id": "evt_…",
  "type": "lead.received",
  "created_at": "2026-10-07T09:12:44.000Z",
  "workspace_id": "…",
  "data": { "contact": { … }, "created": true }
}
Verify the signature (Node.js)
import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyOrdyum(rawBody, header, secret) {
  // header: "t=1760000000,v1=5f1c…"
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  const age = Math.abs(Date.now() / 1000 - Number(parts.t))
  if (!parts.t || !parts.v1 || age > 300) return false
  const expected = createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex')
  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}

Developers

Limits & conventions

Requests per API key
300 / minute
Requests per user session
600 / minute
Anonymous requests per IP
60 / minute
Idempotency-Key replay window
24 hours
Maximum page size
100
Errors
{ error: { code, message, details } }

Rate-limited responses return 429 with RateLimit-* and Retry-After headers. Keys stop working while the agency is paused and resume as soon as it is active again.

Your clients’ leads deserve better than a spreadsheet.

Set up your agency, your first client and its API key in two minutes. Connect a form and watch the first lead arrive.

Start free trial Talk to sales

No card required · Cancel anytime · Or try the demo without signing up