List contacts

GEThttps://<your-url>/api/v2/contacts

MCP id contacts.indexAlso on this path: POST Create a contact

Returns the contacts the caller may read, by name A-Z.

Token scope: api:read:customers
Without it: 403 insufficient-token-scope.
Permission: customers::read
Without it: 403 insufficient-permission.
Rate cost: 1 unit, read bucket. view=detail makes it 3. Adds: each include +1, q +2.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One customer's contacts

curl -G \
  'https://<your-url>/api/v2/contacts' \
  --data-urlencode 'filter[contactable_type]=customer' \
  --data-urlencode 'filter[contactable_id]=1' \
  --data-urlencode 'include=role' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/contacts?filter[contactable_type]=customer&filter[contactable_id]=1&include=role', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/contacts?filter[contactable_type]=customer&filter[contactable_id]=1&include=role');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/contacts?filter[contactable_type]=customer&filter[contactable_id]=1&include=role',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "id": 1,
      "contactable_type": "customer",
      "contactable_id": 1,
      "contactable": {
        "id": 1
      },
      "contact_role_id": 1,
      "role": null,
      "name": "Marieke de Vries",
      "email": "marieke@example.test",
      "phone": "+31 20 123 4567",
      "address": "…",
      "zip": "…",
      "city": "…"
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1,
      "current_page": 1,
      "last_page": 1
    }
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

6 more fields, listed under Response

Pass filter[contactable_type] and filter[contactable_id] together to list one customer's or one user's contacts (there is no nested path for them), or filter[contact_role_id] to list one role's. Pass q to search name and email, and include=contactable,role to expand the parent and the role.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

19 parameters in 6 groups

Views

viewstring

Which field set to render.

summarydefaultdetail

Pagination

per_pageinteger1 to 100

Rows per page. At most 25 when include names a to-many relation; a larger value is 400 invalid-query-parameter.

Default: 25

cursorstring

Opaque keyset cursor from a previous page's links.next. Never construct one by hand.

pageinteger1 to 1000

Opt in to page-number paging: 1-based, at most 1000. Omit it, the default, to page by opaque cursor, which is what links.next hands you. Cannot be combined with cursor. Published only on collections that count their rows on every request.

Filters

=: equals
[in]: any of a comma-separated list
[null]: true or false: whether it is empty
[gte][lt]: at least, less than

filter[contact_role_id]integer=[in][null]

Assigned contact role. Use the null operator to list contacts with no role.

A comma-separated list of at most 100 values.

filter[contactable_id]integer=[in]

Key of the parent record. This pair is how a customer's contacts are listed: there is no /customers/{customer}/contacts path.

A comma-separated list of at most 100 values.

filter[contactable_type]string

Kind of parent the contact hangs off. Must be sent together with filter[contactable_id]; one half without the other is a 400.

filter[created_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Creation timestamp. Pair with sort=id for a stable full export.

filter[updated_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Last-write timestamp. Use for incremental sync.

Search

qstring

Free-text search over name, email, in that order of relevance. At most one substring match per request: q together with a contains filter is 400 invalid-query-parameter.

Sorting

sortstring

Up to three keys, comma-separated, each optionally prefixed with - for descending.

Default: name

Key	Sorts by
`name`	Contact name, A→Z.
`id`	Id, ascending. An id never changes, so use this for a stable full export.
`updated_at`	Last-write timestamp; pair with the id tiebreaker for sync.

Prefix a key with - for descending.

Includes

includestring

Comma-separated names to inline, at most five.

Path	Adds	Cost
`contactable`	Expands the parent record into a CustomerSummary or a UserSummary. The `user` branch is cross-prefix: expanding it additionally needs `users::read` and a token covering the users prefix, and without them the row keeps the {"id": N} reference form with `contactable_type` intact rather than failing.	+1
`role`	Expands the assigned contact role into {id, name}.	+1

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a page of ContactList rows.

dataarray of ContactList

The rows, each a ContactList.

meta.pagePage

per_page, next_cursor, prev_cursor, total, current_page, last_page.

linksPageLinks

self, next, prev.

Each row is a ContactList: 18 fields.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning

idinteger

Unique identifier.

contactable_typestring

The kind of record contactable points at; it says which branch of contactable applies.

customeruser

New values may be added.

contactable_idinteger

The id of the record contactable points at.

contactableRef or CustomerSummary or UserSummary

The record this contact belongs to: a customer for a CRM contact, a user for an employee's emergency contact. Rendered as {"id": N} until named in ?include=contactable, and still as {"id": N} where the caller may not read the parent's prefix. contactable_type and contactable_id are always present, so the parent can be found without the include, and the reference form shows nothing contactable_id does not.