Push leads in. Sync contacts, accounts, opportunities, and activities out. Plain JSON over HTTPS, Bearer keys, no SDK required — if your tool can make an HTTP request, it can talk to Tarmac.
Create an API key in Settings → Workspace → API keys (workspace admins only). The secret is shown once at creation. Send it on every request:
curl https://app.go-tarmac.com/api/v2/contacts \ -H "Authorization: Bearer tmk_live_your_key_here"
| Plan | API access |
|---|---|
| Free | None |
| Basic | Read — every GET endpoint |
| Pro | Full — read and write |
| Enterprise | Full — plus higher limits and webhooks by arrangement |
Rate limit: 120 requests/minute per key (429 with a Retry-After header past it). Revoke keys any time from Settings; revocation is immediate.
Every workspace gets an intake URL with a private token — find yours under Contacts → ＋New lead → Share form. POST any form payload; common field aliases (first_name, fname, tel, email_address, …) are normalized automatically, and a fullName is split for you. Perfect for website forms, Zapier, or your ad platform's webhook.
curl -X POST https://app.go-tarmac.com/api/intake/<your-token> \
-H "Content-Type: application/json" \
-d '{
"firstName": "Maria",
"lastName": "Gonzalez",
"phone": "(818) 555-0142",
"email": "maria@example.com",
"company": "Gonzalez Roofing",
"notes": "Asked about weekly service"
}'
New leads route by your workspace rules (owner match → territory → round-robin) and appear in the dialer queue like any hand-entered lead. Do-not-call numbers are flagged before anyone dials.
Base URL https://app.go-tarmac.com/api/v2. Every route is scoped to the key's workspace — there is no cross-workspace access, ever.
GET/contacts | List contacts |
GET/contacts/:id | One contact |
POST/contacts | Create — firstName, lastName, email, phones: [{number, type, ok_to_call}], accountId, title, notes |
PATCH/contacts/:id | Partial update |
DELETE/contacts/:id | Delete |
GET/accounts | List accounts |
POST/accounts | Create — name, domain, industry, ownerUserId |
PATCH/accounts/:id | Partial update |
GET/opportunities | List opportunities |
POST/opportunities | Create — contactId, stage, amountUsdMrr |
GET/activities | List activities (calls, notes, follow-ups) |
POST/activities | Log one — contactId, type, ts, payload |
401 | Missing, malformed, or revoked key |
403 | Plan doesn't include this access (read-only key writing, or no API access on the plan) |
404 | No such record in this workspace |
429 | Rate limit — honor Retry-After |
Every error body is {"error": "a plain-English sentence"}.
fetch is the SDK. Tell us if you disagree.