The public API is the same API the app runs on.
There is no separate, thinner API for partners. Your system uses the same REST calls as NG CRM, through keys with precisely defined rights, and learns about changes through signed webhooks.
- REST /api/v1
- Signed webhooks
- OpenAPI and Postman
- Official registers
What your integration team gets
A public API, signed webhooks, official registers and Mailbook — everything NG CRM needs to work alongside your systems.
- Available
Scoped keys
Three gates: API access per legal entity, key scope (read or write per function) and a service account. The key secret is shown once; only its fingerprint is stored.
- Available
Traffic control
IP allowlist, per-minute limit and daily quota, rotation with a transition window and revocation with a reason. A call log, without storing request bodies.
- Available
Idempotent calls
Idempotency-Key support: a request repeated after a dropped connection does not create a second record.
- Available
Shareable documentation
OpenAPI (JSON and YAML) and a Postman collection, a share link with expiry and password, and a signature-check guide in five languages.
- Available
Signed webhooks
Events for partners, contacts, leads, opportunities, quotes, activities, tickets and campaigns. An HMAC signature in the NgCrm-Signature header, to public https addresses only.
- Available
Delivery you can replay
Retries, automatic disabling after repeated failures, replay of a chosen range and secret rotation with 24 hours of dual signatures.
- Available
Official Serbian registers
Territories and addresses from the official statistical and cadastral registers, seven levels down to the street, instead of free-typed place names.
- Available
Mailbook
One connection for the whole company, with exceptions per legal entity — for Viber conversations, transactional messages and campaigns.
- Available
Microsoft 365 and Google calendar
Two-way calendar sync with a connected provider mailbox. We enable it during onboarding, with an app registration for your installation.
All capabilities listed are part of NG CRM. Anything that depends on your external accounts, such as a Microsoft 365 or Google calendar, is enabled during onboarding.
A typical integration with your system
For example, when an accepted quote should become an order in your business system.
- 01
An administrator opens access
Enables the API for the legal entity and creates a service account with a key scoped to the functions needed.
- 02
Your team gets documentation
OpenAPI and the Postman collection through a link with expiry and password.
- 03
A webhook reports the change
When the customer accepts the quote, NG CRM sends a signed event to your https address.
- 04
Your system reads and writes
It verifies the signature, reads the quote through the API and returns a status if needed — with an Idempotency-Key.
How we think about integrations
NG CRM stays a CRM
Accounting, inventory and invoicing are not part of the product. Data from those systems comes in and goes out through the API and webhooks, not through built-in modules.
Secure by default
A key does only what its scope allows, webhooks go only to public https addresses, and secrets cannot be read again — only replaced.
Errors are visible and fixable
The call log and the webhook delivery log show what went through, and replaying a range fixes what was missed without manual copying.
Frequently asked questions
Is there a ready-made integration with my accounting software?
Not as a ready-made connector. Your system connects through the public REST API and webhooks, with the OpenAPI documentation and Postman collection your administrator shares.
How do I verify that a webhook really comes from NG CRM?
Every event carries an HMAC signature in the NgCrm-Signature header. A signature-check guide exists in five languages, and during secret rotation both signatures arrive for 24 hours.
What if my system was unavailable?
NG CRM retries delivery and, after repeated failures, disables the webhook so it does not flood the log. When your system is back, a chosen range of events can be replayed.
Can a key access all data?
Only what it is given: the API must be enabled for the legal entity, the key has a read or write scope per function and is tied to a service account, with an optional IP allowlist.
Want to see how this looks in NG CRM?
We will show you in a demo, on examples from your own sales. No obligation.
- office@konissoftware.com
- Phone
- +381 66 000 977