API & integrations (CRM, Make, n8n)

Can list and look up that resource. Any attempt to create, change or archive receives a 403 error with code PERMISO_DENEGADO and the missing permission.

Besides looking up, it can create, update and archive in that resource. It is the permission a two-way synchronisation needs.

Permissions are per resource, and that has already shown: when suppliers were added, the keys that already existed — all of them for customers — did NOT gain access to them. They had to be ticked. The same will hold for any resource added later: an integration never sees more than you granted it.

The fields are the same as in the customer record: nombre and tipo (particular or empresa) are required; nif_cif, apellidos, razonSocial, email, telefono, telefonoSecundario, direccion (calle, numero, piso, codigoPostal, localidad, provincia, pais) and notas are optional. The tax ID is stored in upper case and the email in lower case. In responses every key is always present, with null when there is no value, so the field mapping in your tool never breaks. Watch the name: nombre is the first name (or the trading name for a business) and the surname goes separately in apellidos, plural.

If the body carries a key that does not exist (for example firstName instead of nombre, or the singular apellido instead of apellidos), the request is not rejected, but that value is not saved. So it does not go unnoticed, the response when creating or editing a customer includes avisos.camposIgnorados listing those keys; address keys carry their path, such as direccion.ciudad. If you see it, check your integration's field mapping. The fields the API itself returns (id, codigo, createdAt…) never trigger it, so you can read a customer, change it and send it back whole.

Only nombre is required. Optional: codigo, cif, email, telefono, telefonoSecundario, web, direccion (a single line, not an object as it is for customers), ciudad, provincia, codigoPostal, pais, contactos, tipoProveedor (general, producto, servicio, logistica or otro), formaPago, plazoPago (in days; 0 means payment on delivery), cuentaCliente and notas. Each contact carries nombre — required — plus cargo, telefono, email and notas; contacts have no identifier of their own.

The list you send REPLACES the one that was there. Send an empty list and every contact is deleted; leave the key out (or send null) and they stay as they were. That is what lets you read a supplier, change one field and send the whole thing back without odd side effects.

Unlike the customer one, the supplier code (PROV-004) is not unique: it can repeat even within your own shop. That is why GET /proveedores/{id} only accepts the id. If your ERP only stores the code, use the list filter: GET /proveedores?codigo=PROV-004 returns every match and you decide which one it is.

Each ticket includes numeroFicha, estado, prioridad, ubicacion, averiaDeclarada, diagnostico, the lifecycle dates (booking-in, diagnosis and repair start and end, customer notice, collection and ultimoCambioEstado, when it moved into its current status), a customer summary (id, codigo, codigoVisible, nombre, apellidos, razonSocial), the device (id, codigo, tipo, marca, modelo, numeroSerie, imei, color), the quote (numero, total, estado, fechaEnvio and fechaRespuesta, or null if there is none), the assigned technician (name only) and plazoEntregaEstimado, the turnaround time the customer was given on the booking-in receipt. Internal notes, signatures, photos, documents and device passwords are never returned.

If your CRM or phone system opens the customer record when a call comes in, use GET /clientes?telefono=<number>. It searches both the main and the secondary phone and ignores how the number is written: spaces, hyphens, your country's international code (+44 or 0044) and the leading 0. So “07700 900123” finds a customer saved as “+44 7700-900-123”. At least 6 digits are needed.

GET /clientes/{id}/resumen returns, in a single call, what a CRM usually shows on the customer record: totalReparaciones, reparacionesAbiertas (the device is still in the workshop), porEstado, totalPresupuestado and totalPresupuestosAprobados (in the workshop's currency, which comes in moneda), primeraReparacion, ultimaReparacion and ultimaActividad (the latest change on any of their tickets). It needs the Repairs resource, just like the tickets.

Lists accept page (from 1) and limit (25 by default, 100 at most; anything higher is capped at 100). The busqueda field searches name, surname, company name, tax ID, email, code and telephone.

120 requests per minute per key (plenty for a periodic synchronisation; it stops a runaway loop). 10 active keys per organisation. Lists return at most 100 records per page. If the organisation is on the free plan with its monthly quota used up, creating customers is blocked just as in the app.

You can revoke one without breaking the others, and the list shows when each was last used.

Keep it in your tool's credential store (Make connections, n8n credentials, environment variables). If it ends up in a repository or on a website, consider it compromised.

Revocation is immediate: the old key starts getting 401 CLAVE_REVOCADA. Update the new one in your tool and that is it.

The complete technical reference (paths, parameters, schemas and error codes) is published in an open format at /api/v1/openapi.json, with no key needed. By default it is in Spanish; add ?lang= with your language to get it translated (for example /api/v1/openapi.json?lang=en-GB, ?lang=en or ?lang=ro). You can import it into Postman, Insomnia, Make or n8n to have every call ready.