Your business
API keys, webhooks and Zapier
Connect Zapier, Make, another tool or your own code: an API key to read and change your CRM, and webhooks that tell another address when something happens.
Making a key
- 1A key for Zapier, Make or your code, with only the permissions it needs; shown once.
- 2What each key may do: read, change, send texts and emails, webhooks.
- 3Webhooks tell another address when something happens; Test sends a sample and shows the answer.
- Open Settings → Integrations and click New key under API keys.
- Name it (like "Zapier") and give it only what it needs:
- Read: contacts, opportunities, calendars, tasks, workflows and so on;
- Change: create and update them;
- Send texts and emails to your contacts, from your number and email;
- Webhooks: subscribe to events (Zapier and Make need this).
- Copy the key: it's shown once. It starts with
vk_. Keep it secret, like a password.
Revoke stops a key at once, along with the webhooks it made. Only the account's owner and admins make and revoke keys, and no key can make another key.
Calling the API
Send the key in the Authorization header to https://builder.powerpro.ai/api/v1/…. Requests and answers are JSON.
curl https://builder.powerpro.ai/api/v1/contacts?q=smith \
-H "Authorization: Bearer vk_your_key"| What | Call |
|---|---|
| Check a key (who it belongs to, what it may do) | GET /me |
| Contacts: list and search, one, create, change, delete | GET /contacts?q=…&tag=…&page=0, GET /contacts/{id}, POST /contacts, PATCH /contacts/{id}, DELETE /contacts/{id} |
| A note on a contact | POST /contacts/{id}/notes {"body": "…"} |
| A text or email to a contact (needs "Send texts and emails") | POST /contacts/{id}/messages {"channel": "sms" | "email", "subject": "…", "body": "…"} |
| Pipelines, tags, custom fields, calendars | GET /meta |
| Opportunities: a pipeline's, by stage; create, change, delete | GET /pipelines/{id}/board, POST /opportunities, PATCH /opportunities/{id}, DELETE /opportunities/{id} |
| Appointments | GET /appointments, POST /appointments, PATCH /appointments/{id}, DELETE /appointments/{id} |
| Tasks | GET /tasks?contactId=…&open=1, POST /tasks, PATCH /tasks/{id} {"done": true} |
| Add a contact to a workflow, or take them out | POST /automations/{id}/enroll, POST /automations/{id}/unenroll {"contactId": "…"} |
| Forms and their answers | GET /forms, GET /form-submissions?formId=…&contactId=…&limit=50, or as a spreadsheet GET /forms/{id}/submissions.csv |
These are the same calls the app's own screens make, with the same checks: what one screen refuses (a contact without a name, email or phone, say), the API refuses too, with a sentence saying why. Changes show in History as made by an app, and can be undone there. A key works only on its own account, up to 600 calls a minute.
| Answer | Means |
|---|---|
| 401 | No key, a wrong one, or a revoked one. |
| 403 | The key doesn't have the permission (the answer says which), or no key can do that. |
| 404 | Not found, or not this account's. |
| 429 | Too many calls: wait a little. |
Webhooks
A webhook tells another address when something happens. Add one under Webhooks in Settings → Integrations (New webhook: what happens, and the address), or let Zapier or Make add theirs. Each one can be tested with Test, which sends a sample.
The events: a contact is created, a tag is added or removed, a website form is sent, an appointment is booked or cancelled, an opportunity moves to a stage or is won or lost, a payment is received, an invoice is paid, a text or email comes in, a call is missed, a Facebook lead comes in.
Each delivery is a POST with the event and the contact:
{
"id": "evt_1234",
"event": "tag_added",
"occurredAt": "2026-10-27T10:15:00.000Z",
"contact": { "id": "…", "firstName": "Sam", "lastName": "Rivera", "email": "sam@example.com", "phone": "+15125550142", "tags": ["VIP"], … },
"data": { "tag": "VIP" }
}- Signed:
X-Vision-Timestamp, andX-Vision-Signature: sha256=…, an HMAC-SHA256 oftimestamp.bodywith the webhook's secret (shown once when it's made). Check it before trusting a delivery. - Tried again when the address doesn't answer 2xx: after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours.
- Turned off when the address answers
410 Gone(that's how Zapier unsubscribes), or after 50 failures in a row. - Only public addresses: never one on a private network.
Subscribing through the API (REST hooks)
With a key that has the "Webhooks" permission: GET /hooks/events lists the events, each with a sample; POST /hooks {"event": "contact_created", "targetUrl": "https://…"} subscribes and answers its id and secret; GET /hooks lists the key's own; DELETE /hooks/{id} unsubscribes. This is how Zapier's and Make's "instant" triggers connect.
Zapier and Make
Until our Zapier and Make apps are published, connect with their built-in tools and a key:
- Zapier: Webhooks by Zapier. For a trigger, use "Catch Hook" and add its address as a webhook here. For an action, use "Custom Request" to call the API with the header
Authorization: Bearer vk_…. - Make: the Webhooks module (Custom webhook) for triggers, and HTTP → Make a request for actions, with the same header.
For incoming data the other way round (another tool starting one of your workflows), use the workflow trigger Inbound webhook.