Everything an AI agent can do with the SugarCRM API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints22
API versionv11
Last updated23 June 2026
Orientation

How the SugarCRM API works.

The SugarCRM API is how an app or AI agent works with a CRM instance: listing accounts, reading a contact, creating a lead, updating an opportunity, or filing a case. Access starts by exchanging a user's login for a token, and that user's role and access lists decide which modules and records the token can read or change. SugarCRM does not split access into per-method permissions, so an agent inherits exactly what its login can see and do.

22Endpoints
8Capability groups
12Read
10Write
0Permissions
Authentication
SugarCRM uses two-legged OAuth 2.0. A call POSTs to /oauth2/token with a grant_type of password, a client_id (commonly 'sugar'), a client_secret, a username, a password, and a platform, and receives a bearer access_token plus a refresh_token. Every later request carries the token in an OAuth-Token header or a standard Authorization: Bearer header. There is no hosted authorization-code consent screen; the token represents one Sugar user.
Permissions
SugarCRM has no granular per-endpoint OAuth scopes. What a token can do is set entirely by the Sugar user's Role and the Access Control Lists (ACLs) on each module, down to view, edit, delete, import, and field level. An agent inherits exactly the access of the login it authenticates as, so least-privilege is achieved by giving that login a tightly scoped role.
Modules
Almost every method is generic over a module name in the path, like /Accounts, /Contacts, /Leads, /Opportunities, or /Cases. The same list, get, create, update, delete, filter, and relate methods work across all of them, including custom modules, so one set of endpoints covers the whole CRM. The Metadata API returns the live set of modules and fields for an instance.
Versioning
The API version is a major and minor number, like v11, set in the request path (/rest/v11/) or the HTTP Accept header. v11 arrived in the Fall '17 release; the minor number has risen since (v11_4 in Sugar 9.0, v11.8 in Sugar 10.0, and on toward v11_24) as endpoints were added without breaking compatibility. A deprecated version stays supported for at least a year.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to SugarCRM determines what it can reach. A call signs in for an access token, then sends that token on every request, and a separate route lets SugarCRM push changes out to other systems.

Ways to connect

REST API

The REST API is served from each instance at https:///rest/v11/, takes and returns JSON, and pages lists with max_num and offset. A call signs in at /oauth2/token for a bearer access token and sends it on every request. Almost every record method is generic over a module name in the path, so Accounts, Contacts, Leads, Opportunities, Cases, and custom modules share one endpoint set.

Best forConnecting an app or AI agent to a SugarCRM instance.
Governed byThe Sugar user the token authenticates as, and that user's role and ACLs.
Docs ↗

Bulk API

The /bulk endpoint runs a sequence of REST requests in one call. A client POSTs a requests array, each entry naming a url, method, and optional data and headers, and the requests run in order with their results returned together. A failure inside one sub-request does not stop the batch, which cuts the round trips an agent makes for a multi-step task.

Best forRunning many related calls in one round trip.
Governed byThe same token and role as the individual calls inside the batch.
Docs ↗

Outbound (logic hooks / Connect)

SugarCRM has no hosted webhook product on the core REST API. An administrator configures outbound notifications inside the instance with logic hooks or the Sugar Connect framework, so a change like a new or updated record can call another system. This is set up per instance rather than registered through the REST API.

Best forPushing instance changes to other systems without polling.
Governed byThe instance configuration an administrator controls.
Docs ↗
Authentication

OAuth 2.0 (password grant)

The primary login. A call POSTs to /oauth2/token with grant_type=password, a client_id (commonly 'sugar'), a client_secret, the user's username and password, and a platform value such as base. It returns a bearer access_token, an expires_in, and a refresh_token. The token represents one Sugar user, and that user's role and ACLs decide its access. There is no hosted consent screen.

TokenBearer access token tied to one Sugar user
Best forServer-side integrations and agents acting as a service user.
Docs ↗

OAuth 2.0 (refresh token)

When an access token expires, a call POSTs to /oauth2/token with grant_type=refresh_token plus the refresh_token, client_id, client_secret, and platform, and receives a new access token without re-sending the password. The refresh token has its own lifetime, returned as refresh_expires_in.

TokenRefresh token exchanged for a new bearer access token
Best forKeeping a long-running agent authenticated without storing the password in every call.
Docs ↗
Capability map

What an AI agent can do in SugarCRM.

The SugarCRM API is organized around modules, the record types a CRM holds, like Accounts, Contacts, Leads, Opportunities, and Cases. Each module shares the same set of methods to list, read, create, update, delete, and relate records, and a write changes real customer data.

Endpoint reference

Every SugarCRM API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Records (by module)

Generic create, read, update, and delete on any module, like Accounts, Contacts, Leads, Opportunities, and Cases.4

No OAuth scope. Requires the user to have view access to the record via role and ACLs.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Requires edit/create access on the module via role and ACLs.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Requires edit access on the record. A concurrent change can return 409 edit_conflict.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Requires delete access on the module via role and ACLs.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Filter & list

List and filter records in a module by an expression, with paging and field selection.4

No OAuth scope. Returns only what the user's role and ACLs allow on that module. Pages with max_num and offset; next_offset is -1 when done.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. POST is recommended over the GET form because long filter URLs can break. A saved filter id can be passed instead of, or joined with, an inline filter.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Same as the POST form, but limited by maximum URL length on large filters.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Counts only records the user is permitted to see.

Acts onrecord
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
List, create, relate, and unlink records across module relationships.5

No OAuth scope. Returns related records the user is allowed to see, like an account's contacts.

Acts onrelated_record
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Requires edit access on both the module and the related module.

Acts onrelated_record
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Links two records that already exist, like attaching an existing contact to an account.

Acts onrelationship
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Removes the link between two records; it does not delete either record.

Acts onrelationship
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Affects the current user's favorites, not the record's shared data.

Acts onfavorite
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
Global, cross-module search over fields flagged for unified search.1

No OAuth scope. The q parameter matches fields with unified_search enabled; max_num and offset page the results. Returns only records the user can see.

Acts onsearch_result
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Metadata & enums

Discover the instance's modules, fields, views, and dropdown options.3

No OAuth scope. The response can be several megabytes; a type_filter narrows it, and the _hash lets a client send X-Metadata-Hash to skip unchanged metadata.

Acts onmetadata
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope, but this endpoint is administrator-only. It is used for modules not visible in the standard metadata response.

Acts onmetadata
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Returns the key-and-label option list for the field, like the account_type values on Accounts.

Acts onenum
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Current user

Read the profile and preferences of the authenticated user.1

No OAuth scope. Useful to confirm which Sugar user a token authenticates as, and therefore its effective access.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Bulk & service

Run many requests in one call, and check that the API is reachable.2

No OAuth scope. Each sub-request carries the same access as the token. A failure inside one sub-request does not stop the batch.

Acts onbulk_request
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. A lightweight reachability check.

Acts onservice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Authentication

Sign in for a token, refresh it, and log out.2

No OAuth scope. Returns a bearer access_token, expires_in, and a refresh_token. The token represents one Sugar user.

Acts ontoken
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No OAuth scope. Ends the session tied to the access token.

Acts ontoken
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

SugarCRM does not expose a hosted webhook product on the REST API. An administrator wires up outbound notifications inside the instance using logic hooks or the Sugar Connect framework, so a change like a new lead can reach another system.

EventWhat it signalsTriggered by
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

SugarCRM runs on each customer's own instance, so how fast and how much an app can call is governed by that instance's server and platform settings rather than a single published rate ceiling.

Request rate

SugarCRM is deployed per customer, on SugarCloud or self-hosted, so there is no single published account-wide request-rate ceiling like a multi-tenant SaaS. Throughput is bounded by the instance's web server, PHP, and database capacity, and by platform-level settings an administrator controls. A heavy call, like the full Metadata API response, can be several megabytes, so the X-Metadata-Hash header lets a client skip re-fetching unchanged metadata. The /bulk endpoint reduces round trips by running a sequence of requests in one call.

Pagination

A list or filter call pages with max_num to set the page size and offset to skip records. The response returns a next_offset field, which is the offset to pass for the next page, or -1 when no more records remain. A fields parameter narrows which fields come back to reduce payload size, and an order_by parameter sorts the results.

Request size

The full Metadata API response is typically a few megabytes and grows with customization. A request exceeding the instance's configured limit returns HTTP 413 request_too_large. The /bulk endpoint accepts a requests array, and a failure inside one sub-request does not stop the batch or fail the overall call.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
301incorrect_versionThe requested REST API version is wrong or unavailable on this instance.Call a supported version in the path (/rest/v11/) or the Accept header, and check the instance's supported versions.
401need_login / invalid_grantNo valid session, or the OAuth credentials were rejected. need_login means the token is missing or expired; invalid_grant means the login or refresh token was bad.Authenticate at /oauth2/token, or refresh the access token. Verify the client_id, client_secret, username, and password.
403not_authorizedThe authenticated user's role or ACLs do not permit this action on this module or record.Grant the needed access on the user's Sugar role, or authenticate as a user that has it. This is the main permission boundary.
404not_found / no_methodThe record or module does not exist or is not visible to this user (not_found), or the path does not map to a known endpoint (no_method).Check the module name and record id, confirm the user can see the record, and verify the endpoint path and method.
409edit_conflictThe record changed since it was read, so the update would overwrite newer data.Re-read the record, re-apply the change, and retry, or send the expected modified date so the server can detect the conflict.
412metadata_out_of_dateThe client's cached metadata hash no longer matches the instance, often after a customization or upgrade.Re-fetch the Metadata API and send the new X-Metadata-Hash on subsequent requests.
413request_too_largeThe request exceeded the instance's configured size limit.Send fewer records, narrow the fields, or split the work, for example across smaller /bulk batches.
422missing_parameter / invalid_parameterA required parameter was absent (missing_parameter) or a supplied value was not valid (invalid_parameter).Read the error_message, fix the parameters, and resend. The request is not retryable unchanged.
500fatal_errorAn unexpected error on the SugarCRM instance, returned as {"error": "fatal_error", "error_message": "..."}.Retry with backoff, and check the instance logs or contact the instance administrator if it persists.
503maintenance / service_unavailableThe instance is in maintenance or temporarily unavailable, for example during an upgrade.Wait and retry with backoff once the instance is back online.
Versioning & freshness

Version history.

SugarCRM versions its REST API with a major and minor number. The major number changes only for a breaking change, the minor number rises as endpoints are added, and an older version stays supported for at least a year after it is deprecated.

Version history

What changed, and when

Latest versionv11
v11Current version
REST API v11 (current major line)

v11 is the current major version of the Sugar REST API. The major number changes only for a breaking change; the minor number (v11_1, v11_4, v11_8, on toward v11_24) rises as endpoints are added without breaking existing clients. A version is selected in the request path (/rest/v11/) or the HTTP Accept header, and a deprecated version stays supported for at least a year.

What changed
  • v11 introduced in the Fall '17 release, alongside the prior v10 line, to support new dashboard APIs while keeping v10 clients working.
  • Almost every record method is generic over a module name in the path, so one set of endpoints covers Accounts, Contacts, Leads, Opportunities, Cases, and custom modules.
  • The version can be supplied in the URL path or the HTTP Accept header, but not in both at once.
v11_4
v11_4 (Sugar 9.0.0)

Sugar 9.0.0 introduced the v11_4 minor version, adding REST endpoints including a leancount on a related-records link, without breaking earlier v11 clients.

What changed
  • Added GET ///link//filter/leancount for counting related records.
  • Minor, backward-compatible addition within the v11 major line.
v11_8
v11_8 (Sugar 10.0, Q2 2020)

The Sugar 10.0 release (Q2 2020) shipped on the v11.8 REST API minor version, continuing additive changes within the v11 major line.

What changed
  • Backward-compatible endpoint additions delivered with the 10.0 product release.
  • Older REST versions remained supported per the one-year-after-deprecation policy.
v10
v10 (earlier major line)

v10 is the prior major version, still reachable on instances that support it. v11 was added alongside v10 in Fall '17 so existing v10 dashboard clients kept working while new dashboard APIs landed in v11.

What changed
  • Superseded by v11 for new integrations.
  • Remained callable to avoid breaking existing clients during the transition.

Pin the version in the request path or the Accept header, and move up deliberately.

SugarCRM REST API release notes ↗
Questions

SugarCRM API, answered.

How does an agent authenticate to SugarCRM?+
SugarCRM uses two-legged OAuth 2.0. A call POSTs to /rest/v11/oauth2/token with grant_type=password, a client_id (commonly 'sugar'), a client_secret, the user's username and password, and a platform value such as base. The response returns an access_token, a token_type of bearer, expires_in, and a refresh_token. The access token is then sent on every request, and a grant_type of refresh_token gets a fresh one when it expires.
Does SugarCRM support the standard OAuth authorization-code login?+
Not in the usual hosted-consent sense. The documented grant types on /oauth2/token are password and refresh_token, so an integration logs in with a username and password rather than redirecting a user to a consent screen. SugarCRM added bearer-token support in Fall '18, but the token still represents one Sugar user, and that user's role decides its access.
How are permissions scoped if there are no OAuth scopes?+
SugarCRM controls access through the Sugar user's Role and the Access Control Lists (ACLs) on each module, not through per-endpoint scopes attached to the token. A role can allow or deny view, list, edit, delete, import, export, and mass-update on a module, and can restrict access to a user's own records or a team's records. An agent inherits exactly the access of the login it uses, so a narrow role is how least-privilege is enforced.
How does an agent work with different record types?+
Almost every method is generic over a module name in the path. To list accounts an agent calls GET /Accounts; to create a lead it POSTs to /Leads; to update an opportunity it PUTs to /Opportunities/:record. The same pattern covers Contacts, Cases, and custom modules. To discover the modules and fields a particular instance has, an agent calls the Metadata API.
How does SugarCRM signal errors?+
An error returns an HTTP status code and a JSON body with an error field (a short label) and an error_message field (a human-readable message), for example {"error": "not_authorized", "error_message": "..."}. Common labels include need_login and invalid_grant on 401, not_authorized on 403, not_found and no_method on 404, invalid_parameter and missing_parameter on 422, and fatal_error on 500.
Can SugarCRM push events to an agent?+
There is no hosted webhook product on the core REST API. Outbound notifications are configured inside the instance by an administrator, using logic hooks or the Sugar Connect framework, so a change like a new or updated record can call out to another system. An agent that needs to react to changes without that setup polls the filter endpoints instead.
How does API versioning and pinning work?+
The version is a major and minor number set either in the URL path, like /rest/v11/, or in the HTTP Accept header, but not both at once. The major number changes only for a breaking change, the minor number rises as endpoints are added, and a deprecated version stays supported for at least a year. v11 was introduced in Fall '17 and its minor number has advanced across later Sugar releases.
Related

More crm API guides for agents

What is Bollard AI?

Control what every AI agent can do in SugarCRM.

Bollard AI sits between a team's AI agents and SugarCRM. Grant each agent exactly the access it needs, read or write, module by module, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared SugarCRM login.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
SugarCRM
Sales Follow-up Agent
View contacts ResourceOffReadFull use
Update opportunities ActionOffReadFull use
Delete records ActionOffReadFull use
Per-agent access, set in Bollard AI, not in SugarCRM