Platform API

The Platform API is how a script or an external agent works in one firm without clicking through the app. Every call uses the prefix /api/v1/x on the Capsure API.

The firm comes from the token. A tenantId in the path, the query, or the body is rejected. The API cannot do something your role cannot do, and it cannot store a field, a type, or an action the catalog does not list.

Examples on these pages use Harbor Lane Capital and the company Northwind Health. They are the same fictional firm as the rest of this manual.

What you can call

Area	What it changes
Catalog	The firm’s record types, fields, relations, actions, and node config
Records	Company, Person, Deal, Lead, and Investor
Funds	A fund profile and its commitments. Not a capital call
Portfolio	Portfolio companies and a fund’s value
Changes	Record creates, updates, and deletes from the app and API
Custom fields	A field definition. The value is written on the record
Search	The same search the app uses
Saved views	A named list state on a grid that already exists
Forms	A form definition and its versions
Automations	A designer tree. Publish is a separate call
Agents	A specialist in the agent library
Quick actions	An extra sparkle entry on a record
Processes	A checklist definition. Not an automation
Strategies	An investment strategy, its requirements, and its fit rules
Deal sources	Where a deal came from
Attribute sets	A named group of custom fields
Reports	Dashboards, datasets, and report templates
Workspace	Tasks, people, legal, documents, firms, and workflow
Product screens	Taxonomy, portal users, ESG requests, products, investors, and integrations
Connectors	A firm’s connection to an external system
Imports	A file import. Apply follows a dry run

Authentication is how you get a session token, or an API token issued in Administration. The CLI calls these routes with that token. Errors lists the codes a failed call returns.

GET /api/v1/x/openapi lists these routes for the signed-in caller. It does not list the firm’s fields. Those are on the catalog, because they differ by firm.

How a write is classed

Each route has a class. The OpenAPI document includes it.

Class	What a successful call does
Query	Reads. Nothing is stored
Record	Writes immediately, the way editing a company does
Draft	Stores something that is not live yet. An automation draft does not run
Commit	Makes a draft current. Publishing an automation is a commit

A create or update often returns { result, catalogVersion }. catalogVersion is the catalog’s current fingerprint. Sending a stale expectedCatalogVersion is 409 catalog_conflict. Nothing is written. Read the catalog again and retry. Omitting it is allowed. It does not stop two callers from patching the same record. Without If-Match, the later patch wins. With If-Match, a stale version is 412 version_conflict.

A first script

Read the catalog, create a company, save the automation on the Automations page, then publish that id. The publish body is {}.

GET /api/v1/x/catalog
POST /api/v1/x/records/Company
{ "name": "Northwind Health", "companyType": "PrivateCompany" }

POST /api/v1/x/automations
POST /api/v1/x/automations/{id}/publish

A high-impact tree returns 409 with the draft id in result.id and result.code of publish_blocked. The draft is kept. Publish that one in the designer.

What this API does not do

• Create users, edit roles, or grant permissions.
• Change feature flags, branding, or tenant settings.
• Change the layout of a record page. New fields use custom fields.
• Post a chat message and ask Capsure AI to build something.
• Run a quick action or a connector call as its own route. A quick action runs from the sparkle. A connector runs from a published automation or from the test call.
• Accept a connection string, a database query, or a path to forward.

There is no route that deletes a company, a person, or a deal. Those stay in the product.

Calling the same request again

A POST may send Idempotency-Key. The key is stored before the write and kept for 24 hours. The same key and the same body return the stored response, with Idempotent-Replayed: true. A different body, or the same key on a different route, is 409 idempotency_conflict. A second call while the first is still running is 409 idempotency_in_progress. After 24 hours the same key can be used again. The key is the firm and the person, not the token.

An API token is limited to 300 calls a minute. The next call is then 429 rate_limited, and Retry-After is the wait in seconds. A session sign-in is not counted.

Changes lists creates, updates, and soft deletes of the records this API exposes, from the API and from the product, oldest first. Capital calls, notices, and transactions are not routes on this prefix.