Conventions
Versioning and changelog
The API is version 1, dated 2026-10-10. It grows without breaking your code; a change that would break it ships only as a new version, announced 90 days ahead.
- Current version
2026-10-10- Header
X-API-Version- Notice for breaking changes
- 90 days
Every response carries X-API-Version: 2026-10-10 — the version that served it. Log it with your requests; it tells you which documentation applied.
These do not break a well-behaved client, so they ship without a new version:
- New endpoints, and new optional parameters on existing ones.
- New fields in responses and in event payloads.
- New event types, new error codes and new values in fields that list built-in values, such as lead sources.
- Higher limits and better error messages.
Removing or renaming a field or an endpoint, changing a type, or making an optional parameter required happens only in a new version. Before that, the endpoints that will change answer with Deprecation and Sunset headers — the second gives the date the old behaviour ends — and the change is listed in the changelog below at least 90 days before the sunset date.
The API reference moved here, to nextora.co/docs, and is now generated from the API’s own code (OpenAPI 3.1), so the two cannot drift apart. Changes from the earlier, undocumented behaviour of /api/v1:
- Lists page with cursors by default:
limit,cursor,meta.next_cursor.offsetstill works. - One error shape everywhere, with a stable
codeand arequest_id. - Unknown filter and sort fields return
400 validation_failedinstead of being ignored. New filter operatorin. - Deleting moves records to Trash, as in the app, and
POST /{resource}/{id}/restorebrings them back. - Writes run the same automations, activity log and webhooks as edits in the app.
- New endpoints: pipelines, users, notes, custom-field definitions and webhook subscriptions with their deliveries.
- Webhooks for twenty event types, sent for every change — app, API, MCP, workflows and imports — signed with
Nextora-Signatureand retried automatically, six attempts in all. Idempotency-Keyon POST, and rate-limit headers on every response.- Contacts accept
tags,sourceandcustom_fields; companies acceptsize; tasks exposeassignee_ids; custom-field updates merge instead of replacing. - The forecast answers in snake_case, applies
pipeline_id, and counts deals without a category aspipeline. - Fixed: deal search, deal
statuson create,probability: 0, and subtasks missing from paged task lists.