API & developers

One governed REST API for your systems and your agents.

Bearer keys, org isolation, scopes, rate limits and a full audit trail. The same surface your UI and AI agents use — companies, contacts, deals, activities, leads, agent runs, and Heisen chat.

Base URL & auth

Production base URL. Org resolved by the key.

Create API keys in the product (Settings). Keys are hashed at rest, never shown again in full, and always scoped to one organization.

Base URL

https://app.maxorconnect.com/api/v1

Authentication

Authorization: Bearer mk_live_…

Bearer mk_live_Org-isolatedScopes read / writeEarly access

Governance

Policy-checked on every call.

The API is not a backdoor. It is the same governed surface as the UI — isolation, scopes, spend caps and audit by design.

Bearer API keys

Authorization: Bearer mk_live_…. Keys are SHA-256 hashed; plaintext is never stored. Rotate or revoke anytime.

Read & write scopes

Each key carries scopes. Writes require write; list endpoints require read. Missing scope → 403.

Org isolation

The key resolves the organization. Every query is filtered to that org — multi-tenant by construction.

Rate limits

Per-org limits (e.g. Heisen chat ~30 req/min). Exceeded calls return 429. Heavy agent loops use dedicated limits.

Audit trail

Agent runs and sensitive mutations land in the same audit story as human actions — exportable for reviews.

Grounding firewall

Heisen chat answers are independence-checked against org data and tool outputs. Fabricated numbers get corrected or flagged.

Endpoints

Live /api/v1 catalog

Full live /api/v1 surface from production MaxorConnect — CRM, agent runs, knowledge-base RAG, Heisen chat, and session support chat. Feature gates match product entitlements.

Method	Path	Scope	Description
GET	`/api/v1/companies`	read	List companies in the org (pagination / filters).
POST	`/api/v1/companies`	write	Create or update a company (match by external_id or name).
GET	`/api/v1/contacts`	read	List contacts (search + pagination).
POST	`/api/v1/contacts`	write	Create or update a contact (match by email).
GET	`/api/v1/deals`	read	List deals / pipeline (stage filters).
POST	`/api/v1/deals`	write	Create or update a deal (match by external_id).
GET	`/api/v1/activities`	read	List activities (filter by type, company, contact, deal).
POST	`/api/v1/activities`	write	Append an activity (note, call, email, meeting, task) — append-only.
GET	`/api/v1/leads`	read	List leads.
POST	`/api/v1/leads`	write	Create a lead.
POST	`/api/v1/agent-runs`	write	Submit an AI agent run with approval enforcement (write scope).
POST	`/api/v1/knowledge-base`	read	Semantic search over the org knowledge base / indexed docs (RAG). Body: query, optional limit & category. Requires read scope.
POST	`/api/v1/heisen/chat`	write	Programmatic Heisen Q&A or paid agent (tools:true needs Heisen Assistant). Bearer write scope.
POST	`/api/v1/support-chat`	session	In-product support chat stream (Heisen Core). Session auth — not an API key endpoint.

Catalog re-verified against maxor-connect app/api/v1 route handlers (companies, contacts, deals, activities, leads, agent-runs, knowledge-base, heisen/chat, support-chat). Scope session = signed-in product user, not mk_live_. Early access — contact us for keys.

Heisen Chat API

Grounded Q&A or the paid agent loop.

POST /api/v1/heisen/chat — same intelligence your team uses in the product, with a grounding firewall on every answer.

tools:false (default) — grounded Q&A from the org snapshot + RAG; any write-scoped key
tools:true — multi-step agent with read CRM tools; requires the Heisen Assistant add-on
stream:true for token streaming; grounding metrics on JSON responses
Spend-capped per org; 402 when the AI cap is reached

Request

POST /api/v1/heisen/chat
Authorization: Bearer mk_live_••••••••
Content-Type: application/json

{
  "messages": [
    { "role": "user", "content": "Summarize my pipeline and flag at-risk deals." }
  ],
  "model": "balanced",
  "tools": true,
  "stream": false
}

Response

{
  "content": "Open pipeline is $33.2M across 75 deals…",
  "model": "heisen-balanced",
  "usage": { "input_tokens": 1200, "output_tokens": 180 },
  "grounding": { "ratio": 0.82, "grounded": 14, "total": 17 },
  "tools_used": ["pipeline_summary"],
  "latency_ms": 5210
}

Illustrative. Models: fast | balanced | max. Rate limit ~30 req/min/org. maxDuration up to 120s.

Errors

Predictable status codes. Machine-readable where it matters.

Clients should handle auth, entitlement and rate-limit paths explicitly — especially for agents.

Status / code	Meaning
`400 BAD_REQUEST`	Invalid JSON body or schema.
`401`	Missing or invalid API key.
`403`	Key lacks required scope (e.g. write).
`402 ASSISTANT_REQUIRED`	tools:true without Heisen Assistant entitlement.
`402 ai_spend_cap_reached`	Org AI spend cap for the period reached.
`422 VALIDATION_ERROR`	Field-level validation failed.
`429`	Rate limit exceeded — back off and retry.
`502 / 503`	Upstream model or AI backend unavailable.

FAQ

What builders ask before wiring.

How do I get an API key?

During early access, contact us to enable your org, then create keys in product settings. Keys use the mk_live_ prefix and are shown once.

Is the API the same for humans and agents?

Yes. UI, automations and AI agents share /api/v1 — same org isolation, scopes and audit expectations.

Can I use Heisen without the Assistant add-on?

Grounded Q&A (tools:false) works with a write-scoped key. tools:true (live CRM tools in a multi-step loop) requires the Heisen Assistant entitlement.

Where is the OpenAPI file?

The live catalog on this page matches production. A downloadable OpenAPI bundle ships as the surface stabilizes through early access — ask us if you need an early draft for partner integration.

The first agentic ERP.
Request early access.

Join early access to the first ERP built for humans and agents on one governed platform. Full ops suite live today — public release targeted for September 1, 2026.

Security & access control

or write [email protected]