Build on Strkr.
The public REST API is live. OpenAPI 3.1 spec, Swagger UI you can hit from a browser, bearer API keys with per-scope access, and tenant isolation on every query. No ticket to open, no partner program to apply to, no 'contact us for API access.' Spin up a workspace, mint a key, start calling.
Two links. One minute to a working request.
Machine-readable, hand-written, single source of truth.
The spec at /v1/openapi.json is checked into the service repo and regenerated every build. Point your codegen at it to produce clients in any language. No docs/code drift because the handler is the spec.
Learn more Interactive docsSwagger UI, loaded straight from a browser.
Every endpoint, request shape, response shape, and error code is browsable at /v1/docs. Paste in your bearer token in the authorize dialog and send real requests against your own tenant. No local setup.
Learn moreFour things worth knowing before the first call.
Bearer API keys, scoped per endpoint.
Every request carries Authorization: Bearer stk_live_<token>. Keys are minted by workspace admins and tagged with explicit scopes like accounts:read, contacts:write, deals:delete. A key only sees what its scopes permit. No session cookies on the public surface.
Every query filtered by the key's workspace.
A key is bound to a single tenant at mint time. Every row the API returns is scoped to that tenant at the database layer. Cross-tenant reads are architecturally impossible, not a convention. Audit log on every write confirms it.
Generous by default. Lift on request.
200 requests per minute per key. 1,000 requests per minute per workspace. Response headers surface current usage. Rate-limited requests return 429 with a Retry-After. Need higher ceilings for an import, a batch job, or a sync product? Email support with volumes and we lift.
HTTP codes that mean what they say.
401 for an invalid key. 403 for a key missing the scope. 404 for a record outside the tenant or genuinely gone. 422 for a validation failure with the offending field named. 429 when the rate limit bites. 409 CONSENT_DENIED when a send-path hits an opted-out contact. Every error is JSON, every error is parseable.
30+ endpoints across the records you work with every day.
Accounts
List, create, read, update, delete the companies in your pipeline. Custom fields round-trip on every call. Preferences bag gates send-paths.
GET POST PATCH DELETE /v1/accounts Contacts
Full CRUD on people records plus a preferences endpoint that reads and writes consent state across email, SMS, phone, postal, and WhatsApp.
GET POST PATCH DELETE /v1/contacts Deals
The revenue pipeline. Stage transitions, amount, close date, owner, custom fields. List endpoint supports filtering and pagination.
GET POST PATCH DELETE /v1/deals Leads
Pre-qualified records before they convert into contacts. First-class leadId relation on tasks and activities. On convert, polymorphic links replay onto the created contact.
GET POST PATCH DELETE /v1/leads Tasks
To-dos linked polymorphically to any record. Filter by leadId, assignee, due date. Round-trips the customFields bag like every standard object.
GET POST PATCH DELETE /v1/tasks Activities
Timeline rows: calls, meetings, notes, emails. Also polymorphic. The feed that powers every record detail page in the product.
GET POST PATCH DELETE /v1/activities Custom objects
The custom objects your tenant has defined, read as records at /v1/objects/{apiName}/records. Full list, filter, create, update, delete. Field definitions are introspectable.
GET POST PATCH DELETE /v1/objects/{apiName}/records Schema
Every object definition and every field definition in your tenant, listable through /v1/objects. Codegen a type-safe client against the real schema the tenant uses, not a static assumption.
GET /v1/objects, /v1/objects/{apiName} Files
Attachments to any record via a presign flow. POST to /v1/attachments/presign for an S3 upload URL, then confirm. Download URLs are per-call signed. List and delete attachments linked to a record.
POST /v1/attachments/presign Messaging
Strkr Messaging SMS and MMS. Channels, threads, messages, and send endpoints. Consent-gated at the API layer, auto-STOP keyword handling, carrier segment counting, usage metered to Stripe.
POST /v1/messaging/send Inbox
Email threads polymorphically linked to a record. Query by entityType and entityId. Gmail-sync auto-links threads to the matching contact, lead, or account.
GET /v1/inbox/threads/for-entity Consent
Preferences bags on contacts, accounts, and leads. Opt-in and opt-out state per channel, quiet hours in a timezone, global do-not-contact, audit row on every change.
PATCH /v1/{contacts|accounts|leads}/{id}/preferences Copy, paste, replace the token, send.
List contacts
curl https://api.strkr.io/v1/contacts?limit=50 \
-H "Authorization: Bearer stk_live_YOUR_TOKEN"Returns a JSON object with a contacts array. Each row includes id, email, firstName, lastName, accountId, customFields, and audit timestamps.
Create a contact
curl https://api.strkr.io/v1/contacts \
-X POST \
-H "Authorization: Bearer stk_live_YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "jane@example.com",
"firstName": "Jane",
"lastName": "Doe",
"customFields": { "externalId": "crm-9821" }
}'Returns 201 with the created record. Unknown top-level keys return 422 UNKNOWN_FIELD. Put integration metadata on customFields and it round-trips untouched.
Create a deal
curl https://api.strkr.io/v1/deals \
-X POST \
-H "Authorization: Bearer stk_live_YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme expansion Q4",
"amount": 48000,
"stage": "qualified",
"accountId": "01HC9...uuid",
"closeDate": "2026-12-31"
}'Amount is in major units of the tenant currency. Stage must be one of the stages defined on the pipeline. Deal fields are introspectable through the Schema endpoints.
The three ways teams build on Strkr today.
Server-to-server, available today.
Mint a scoped key in Admin, store it in your secrets manager, call the API. Right path for sync jobs, data imports, admin tooling, internal dashboards, and anything running on your own infrastructure.
Event-driven listeners, in beta.
Subscribe to record changes and have Strkr POST signed payloads to your endpoint. Right path for cross-system automation that reacts to new deals, new contacts, or stage changes. Signed with a shared secret, retried on failure, DLQ for permanent failures.
Third-party apps, on the roadmap.
Three-legged OAuth for apps acting on behalf of a workspace user is scheduled for 2027 Q1. Until then, workspace admins can mint delegated API keys per integration partner and revoke them per partner. If you need OAuth sooner, email support with the use case.
No official SDK yet. The OpenAPI spec is the SDK.
The OpenAPI 3.1 spec at /v1/openapi.json is the only thing Strkr publishes. Point your codegen at it (openapi-generator, openapi-typescript, oapi-codegen, kiota) and produce a typed client in TypeScript, Python, Go, Rust, Ruby, Java, or anything else your codegen targets. The spec is regenerated on every API deploy, so the client stays in sync with the surface.
An official TypeScript client is on the roadmap for 2027. Until then, generated clients work and are, in practice, what most integrators prefer because they match the version of the API they're actually calling.
Four links worth bookmarking.
How we protect what the API returns.
Encryption in flight and at rest, row-level tenant isolation, audit log on every write, no data mining, no AI training on customer records. The posture that sits behind every bearer token.
Learn more ComplianceHIPAA, SOC 2, GDPR, CCPA.
HIPAA with a BAA available on request. SOC 2 Type II in audit, target 2026 Q4. GDPR and CCPA compliant today. The posture integrators ask about on day one.
Learn more ArticlesGuides, walkthroughs, deep dives.
Weekly posts on everything from webhook signing to custom object modeling to building a two-way sync without duplicating records. Written by the engineers who ship the API.
Learn more PricingAPI access included on every paid tier.
Starter at $29 per seat per month, Pro at $59, Scale at $119, 14-day trial on every tier. API keys and the full endpoint surface ship on every plan. No API gating. No upcharge for the thing that makes the product useful.
Learn moreTry it free. Bring your team next week.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.