Brixit API

Connect your applications to contacts, inquiries, listings, transactions, notes, follow-ups, reports and lookups. This is the public integration API also used by Zapier and n8n. It runs on your Brixit backend at https://YOUR-BACKEND/api/automation/v1.

Choose a resource, then an action. Each action page contains its URL, required fields, request examples, response details and an interactive tester.

• Contacts
• Inquiries
• Listings
• Transactions
• Reports
• Lookups

Start with GET /me below to verify the connected user and company. Download the complete JSON reference.

Get connected

1. In Brixit, open Settings → Zapier & n8n and create a connection.
2. Choose an access level and expiry. Read-only access is enough to test reads.
3. Copy the connection key shown once and the automation endpoint.
4. Paste them in the explorer. Use your installation’s HTTPS backend address.

Send Authorization: Bearer <connection key> and Accept: application/json on all three endpoints. POST requests also need Content-Type: application/json. An automation key authenticates only to this gateway; it does not authenticate to the application’s /api/v1/app routes. Access remains limited by the connection, your CRM role, company and record visibility.

curl --request GET 'https://crm.example.com/api/automation/v1/me' \
  --header "Authorization: Bearer $BRIXIT_CONNECTION_KEY" \
  --header 'Accept: application/json'

Endpoints and request envelope

Every operation uses POST /execute, including reads. The method and path returned by /operations describe the underlying CRM action; do not send an automation connection key to that underlying path.

{
  "operation": "contacts.list",
  "data": { "searchText": "contact@example.com", "page": 1, "per_page": 25 }
}

For notes and follow-ups, entity_id identifies the parent contact or listing. id identifies the child note or follow-up when reading, updating or deleting one.

{
  "operation": "contacts.notes.create",
  "parameters": { "entity_id": 456 },
  "idempotency_key": "viewing-note:submission-12345",
  "data": { "title": "Viewing request", "details": "Requested a two-bedroom viewing." }
}

JSON types and required fields

Use JSON numbers for IDs and numeric fields, true / false for booleans, and arrays for repeated values. Dot notation in the reference describes nesting: location.lat means {"location":{"lat":25.08}}; commission_splits.*.split_amount means the field belongs to each object in the commission_splits array. A nullable field accepts null; optional means it may be omitted. A required field must contain a value. Conditional requirements and enum values are listed alongside every declared field.

Use YYYY-MM-DD for date-only fields and an ISO 8601 timestamp with an explicit timezone offset for follow-ups, for example 2026-11-01T10:00:00+04:00. build_year is a four-digit year. Three-character currency codes such as AED are strings. send_reminder uses the strings "yes" and "no", not a boolean.

Look up IDs in your installation using lookups.* operations. Example IDs are placeholders, not globally valid values. Required custom fields vary by company; send them in custom_fields_data using keys such as field_123. The gateway uses JSON and does not support binary file uploads, exports or arbitrary URLs.

Tenant and identity fields are server-owned. The gateway removes company_id, user_auth_id, is_superadmin, added_by, last_updated_by, create_user_id and _method from the top level of data.

Response formats

GET /me returns an object like this (illustrative values):

{
  "id": 123,
  "name": "Example User",
  "company_id": 5,
  "company_name": "Example Agency",
  "access": "read",
  "expires_at": "2026-12-01T00:00:00.000000Z"
}

access is read, write (read/create/update), or delete (also allows deletes). GET /operations returns an array, for example:

[
  {
    "id": "contacts.get",
    "name": "contacts.get",
    "method": "GET",
    "path": "lead-contacts/{id}",
    "parameters": ["id"],
    "requires_idempotency_key": false
  }
]

POST /execute preserves the underlying operation’s HTTP status and response body. Most record endpoints return status, message and data; list endpoints also return pagination metadata. Reports return {"data": {...}} with metrics and tables. Do not assume all results have the same envelope or that every success uses HTTP 200. The explorer shows the actual status and complete response body.

For paginated CRM lists, inspect meta.current_page, meta.last_page and meta.has_more_pages. Normal reads default to page 1 with 25 records; per_page is clamped to 1–100. Reports use 25 rows per table: pass the returned table key as data.table and the next data.page to retrieve more rows. Report per_page does not override this size in the automation gateway.

Errors and limits

Gateway validation can return Laravel’s message / errors object. Validation inside execution can return {"error":"Brixit rejected the supplied fields.","fields":["field_name"]}. Other execution failures return an error string; underlying controller failures may be reduced to this generic error. Do not rely on detailed validation messages always being present.

The gateway is limited to 60 requests per minute per authenticated identity/IP throttle key, in addition to the underlying API’s limits. Successful writes are cached for their connection and idempotency key. Identical retries return the original result; changed requests with the same key return 409. Keep the key and complete payload unchanged after a timeout. CRM notifications and other external effects can run during a write, so a cancelled browser request does not undo the operation.

Browser troubleshooting

The browser sends requests directly to the backend you enter. Nothing is sent until you select Send request. The tester does not save the connection key in browser storage, URLs or copied code. Use Clear key and response when finished.

A network error may mean an invalid URL, untrusted HTTPS certificate, unreachable backend, redirect, or CORS rejection. Configure your backend to allow the website’s origin, GET, POST, OPTIONS, and the Authorization, Accept and Content-Type headers. Browser access also depends on any firewall or private-network restrictions. Use the cURL example from a machine that can reach a private installation.

The website tester accepts HTTPS only. For local HTTP development, use a local HTTP client or n8n. Never put your connection key into a URL.