# Open API overview

> The REST API behind AOZO: base URL, how requests look and what you can reach.

Canonical page: https://aozo.in/docs/api/overview
Last updated: 2026-11-12
Product: Open API
Section: Getting started

AOZO’s API is the same REST API that the AOZO apps use. You can read and write your own workspace data from your own systems: create leads from a website form, raise invoices from an order system, or sync tickets to another tool.

## The basics

| What | Value |
| --- | --- |
| Base URL | https://api.aozo.in |
| Format | JSON over HTTPS. Send Content-Type: application/json on requests with a body. |
| Authentication | A session token in the Authorization header. See Authentication. |
| Workspace | The X-Organization-Id header says which organisation you are acting on. |
| Lists | List endpoints return a JSON array. |
| Errors | A JSON object with an error message, for example {"error": "Lead name is required"}. |

![A request to the AOZO API with the method and URL, the Authorization header, the X-Organization-Id header and a JSON body, each numbered](https://aozo.in/images/docs/api-request-anatomy.webp)

## What you can reach

| Area | Path prefix | Guide |
| --- | --- | --- |
| Sign-in and profile | /api/auth | Authentication |
| CRM: leads, deals, contacts, companies, tasks, workflows | /api/crm | CRM API |
| Helpdesk: tickets, customers, knowledge base | /api/helpdesk | Helpdesk API |
| Accounting: invoices, payments, expenses, items | /api/accounting | Accounting API |
| Teams: members, attendance, leave, payslips | /api/teams | Teams and Projects API |
| Projects: projects, tasks, statuses | /api/project | Teams and Projects API |
| Inbound lead webhooks | /api/crm/lead-capture | Lead capture webhook |

## Who sees what

The API respects the same roles as the apps. Owners and admins see all records in the organisation. Other members see the leads and tickets assigned to them or created by them.

## Before you build

- Call the API from your server, not from a web page on another domain. Browsers on other domains are blocked by CORS.
- Treat your session token like a password. Never put it in client-side code or a public repository.
- Plan for errors and retries. See Errors and limits.

> **Tip:** Start with the Quickstart. It signs in, creates a lead and lists leads in three commands.