Create a contact

POSThttps://<your-url>/api/v2/contacts

MCP id contacts.storeAlso on this path: GET List contacts

Creates a contact under a customer or a user.

Token scope: api:write:customers
Without it: 403 insufficient-token-scope.
Permission: customers::create
Without it: 403 insufficient-permission.
Rate cost: 1 unit, write bucket. A write costs the same whatever view you ask for.
Also: Accepts Idempotency-Key. Never cached: private, no-store. Unknown body keys are refused, never dropped.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: A contact on a customer

curl -X POST \
  'https://<your-url>/api/v2/contacts' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <key>' \
  -d '{
    "contactable_type": "customer",
    "contactable_id": 1,
    "name": "Marieke de Vries",
    "email": "marieke@example.test",
    "phone": "+31 20 123 4567",
    "comment": "<p>Prefers email.</p>"
  }'

const response = await fetch('https://<your-url>/api/v2/contacts', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'Idempotency-Key': '<key>',
  },
  body: JSON.stringify({
    "contactable_type": "customer",
    "contactable_id": 1,
    "name": "Marieke de Vries",
    "email": "marieke@example.test",
    "phone": "+31 20 123 4567",
    "comment": "<p>Prefers email.</p>"
  }),
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->withHeader('Idempotency-Key', '<key>')
    ->post('https://<your-url>/api/v2/contacts', [
        'contactable_type' => 'customer',
        'contactable_id' => 1,
        'name' => 'Marieke de Vries',
        'email' => 'marieke@example.test',
        'phone' => '+31 20 123 4567',
        'comment' => '<p>Prefers email.</p>',
    ]);

import requests
response = requests.request(
    'POST',
    'https://<your-url>/api/v2/contacts',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json', 'Content-Type': 'application/json', 'Idempotency-Key': '<key>'},
    json={'contactable_type': 'customer', 'contactable_id': 1, 'name': 'Marieke de Vries', 'email': 'marieke@example.test', 'phone': '+31 20 123 4567', 'comment': '<p>Prefers email.</p>'},
)

Response

The shape of the response, with sample values.

{
  "data": {
    "id": 1,
    "contactable_type": "customer",
    "contactable_id": 1,
    "contactable": {
      "id": 1
    },
    "contact_role_id": 1,
    "role": null,
    "name": "Marieke de Vries",
    "email": "marieke@example.test",
    "phone": "+31 20 123 4567",
    "address": "…",
    "zip": "…",
    "city": "…"
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/idempotency-key-in-flight",
  "title": "Idempotency key in flight",
  "status": 409,
  "detail": "The original request for this Idempotency-Key is still being processed. Retry shortly.",
  "instance": "/api/v2/worklogs",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S"
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/validation-failed",
  "title": "Validation failed",
  "status": 422,
  "detail": "3 fields failed validation.",
  "instance": "/api/v2/worklogs",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "errors": [
    {
      "pointer": "/date",
      "code": "date_format",
      "detail": "The date does not match the format Y-m-d."
    },
    {
      "pointer": "/minutes",
      "code": "min",
      "detail": "The minutes must be at least 1."
    },
    {
      "pointer": "/description",
      "code": "required",
      "detail": "The description field is required."
    }
  ]
}

6 more fields, listed under Response

contactable_type and contactable_id are required together: the type is an alias (customer or user) and the id must name a record the caller may read, which for a user additionally requires the users prefix. Returns 201 with a Location header.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydetaildefault

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

Idempotency-Keystring≤ 255

A caller-chosen key that makes this POST safe to retry. Replaying it returns the original response with Idempotency-Replayed: true.

Request body

Unknown keys are refused with 422, naming the key.

contactable_typestringRequired

The record this contact belongs to: a customer for a CRM contact, a user for an employee's emergency contact. Rendered as {"id": N} until named in ?include=contactable, and still as {"id": N} where the caller may not read the parent's prefix. contactable_type and contactable_id are always present, so the parent can be found without the include, and the reference form shows nothing contactable_id does not.

customeruser

contactable_idintegerRequired

Required when contactable_type is present.

namestring≤ 255Required

Contact name. This is the default sort key and one of the fields ?q= searches.

emailemail or null≤ 255

Email address. The second field ?q= searches; not unique.

phonestring or null≤ 255

Phone number.

contact_role_idinteger or null → ContactRole.id

Assigned contact role, or null. Deleting a role unassigns it rather than refusing.

addressstring or null≤ 255

Street address. plnnrly pre-fills this from the customer when adding a contact, but the API fills in no default for it.

zipstring or null≤ 255

Postal code.

citystring or null≤ 255

City.

countrystring or null≤ 255

Country as an ISO 3166-1 alpha-2 code, e.g. NL, as plnnrly writes it. Older records may hold any string.

positioninteger or null

Display order within one parent, ascending. Null where unset.

commentstring or null

Free-form note, sanitised HTML. The emergency-contact form uses it for the relationship to the employee, e.g. Partner.

Response 201

Returns a Contact in the detail view.

Headers

ETag: A strong validator of exactly this representation.
Idempotency-Replayed: true when this response was replayed from a stored Idempotency-Key rather than produced by a new write.
Location: The absolute URL of the created or queued resource.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning