Everything an AI agent can do with the Pipedrive API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints36
API versionv2
Last updated23 June 2026
Orientation

How the Pipedrive API works.

The Pipedrive API is how an app or AI agent works with a sales pipeline: creating a deal, looking up the person or organization behind it, logging an activity, or converting a lead. Access is granted through an OAuth access token or a personal API token, and an OAuth token carries scopes that decide which areas a call can read or change. Pipedrive runs a current generation of the API alongside an older one, and it can push a notification to a registered endpoint whenever a record changes.

36Endpoints
7Capability groups
17Read
19Write
9Permissions
Authentication
Pipedrive authenticates a call two ways. An installed app uses OAuth 2.0: the authorization-code flow returns a Bearer access token that lasts 60 minutes and a refresh token that lasts 60 days, plus an api_domain naming the company's own API host. A single account can instead use a personal API token, a long-lived key tied to one user. Either way, requests go to the company-specific domain.
Permissions
An OAuth app requests scopes, and each scope opens a set of endpoints. Most areas come in a read-only and a full pair, like deals:read and deals:full or contacts:read and contacts:full, where the read scope cannot write. Some capabilities are their own scope, like search:read for cross-account search and admin for account-wide settings. A personal API token instead carries that user's own permissions.
Rate limits
Pipedrive meters API use by a daily token budget shared across the whole account, not a fixed request count. Each call costs tokens by weight, so a single read costs 2, a list 20, an update 10, and a search 40, and version 2 methods cost less than their version 1 equivalents. A separate burst limit caps how many requests one user can send in any two-second window. Going over either returns HTTP 429.
Versioning
Pipedrive carries two API versions in parallel. Version 2 is the current REST API for deals, persons, organizations, activities, products, pipelines, and stages, with cursor pagination, PATCH updates, and nested custom fields. Version 1 still serves resources version 2 has not replaced, like notes and most of leads. A method is pinned by the /api/v1 or /api/v2 segment in its path.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Pipedrive determines what it can reach. There is a route for making calls and a route for receiving events, and each is governed by the token behind it and the scopes that token carries.

Ways to connect

REST API

The REST API takes JSON request bodies and returns JSON, and a call goes to the company's own host (the api_domain returned at install, like {company}.pipedrive.com). Version 2 paths under /api/v2 use cursor pagination and PATCH updates; version 1 paths under /api/v1 serve the resources version 2 has not yet replaced. A request authenticates with an OAuth Bearer token or a personal API token.

Best forConnecting an app or AI agent to Pipedrive.
Governed byThe token and the scopes it carries.
Docs ↗

Webhooks

Pipedrive POSTs a JSON payload to a registered URL when an event happens, named as an action and an object like added.deal or updated.person, with wildcards such as *.deal supported. Webhooks are created with POST /api/v1/webhooks and default to the v2 format. The receiving endpoint can require HTTP basic auth. A failed delivery is retried at 3, 30, and 150 seconds, and 10 failures pause the hook for 30 minutes.

Best forReceiving Pipedrive events at an app or AI agent.
Governed byThe webhooks scope to register, and the basic-auth credentials on the endpoint.
Docs ↗
Authentication

OAuth 2.0

An app a customer installs uses the OAuth 2.0 authorization-code flow. The customer approves a set of scopes, and the app exchanges the resulting code for a Bearer access token that lasts 60 minutes and a refresh token that lasts 60 days of inactivity. The token response also returns an api_domain, the company-specific host every later call must use.

TokenOAuth Bearer access token (+ refresh token)
Best forMulti-account apps and anything in the Pipedrive Marketplace.
Docs ↗

Personal API token

A single account can call the API with a personal API token, a long-lived key tied to one user and found in that user's settings. It carries that user's own permissions rather than a requested set of scopes, so it can reach whatever the user can. It suits a single-company script or internal integration, not a distributed app.

TokenPersonal API token (api_token)
Best forA single-account script or internal integration.
Docs ↗
Capability map

What an AI agent can do in Pipedrive.

The Pipedrive API is split into the parts of a sales pipeline an agent can act on, like deals, the people and companies behind them, activities, and leads. Each area has its own methods, and a write can move a deal, change a contact, or delete a record.

Endpoint reference

Every Pipedrive API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Deals

Methods for working with deals, the ongoing sales tied to a person or organization.6

Read-only. A list call costs 20 tokens on the daily budget.

Acts ondeal
Permission (capability)deals:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit20 tokens

Read-only. A single read costs 2 tokens.

Acts ondeal
Permission (capability)deals:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit2 tokens

Needs the full deals scope; the read scope cannot create.

Acts ondeal
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventadded.deal
Rate limit10 tokens

Version 2 uses PATCH, not PUT. An update costs 10 tokens.

Acts ondeal
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventupdated.deal
Rate limit10 tokens

Removes the deal. A delete costs 6 tokens.

Acts ondeal
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventdeleted.deal
Rate limit6 tokens

Uses the narrower search:read scope. A search costs 40 tokens, and the Search API is capped at 10 requests per two seconds.

Acts ondeal
Permission (capability)search:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit40 tokens

Persons (contacts)

Methods for working with persons, the individual contacts behind deals.6

Read-only. A list call costs 20 tokens.

Acts onperson
Permission (capability)contacts:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit20 tokens

Read-only. A single read costs 2 tokens.

Acts onperson
Permission (capability)contacts:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit2 tokens

Needs the full contacts scope, which covers both persons and organizations.

Acts onperson
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventadded.person
Rate limit10 tokens

Version 2 uses PATCH. An update costs 10 tokens.

Acts onperson
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventupdated.person
Rate limit10 tokens

Removes the contact. A delete costs 6 tokens.

Acts onperson
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit6 tokens

Uses search:read. A search costs 40 tokens, capped at 10 requests per two seconds.

Acts onperson
Permission (capability)search:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit40 tokens

Organizations (companies)

Methods for working with organizations, the companies contacts and deals belong to.6

Read-only. Organizations share the contacts scope with persons. A list costs 20 tokens.

Acts onorganization
Permission (capability)contacts:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit20 tokens

Read-only. A single read costs 2 tokens.

Acts onorganization
Permission (capability)contacts:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit2 tokens

Needs the full contacts scope.

Acts onorganization
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventadded.organization
Rate limit10 tokens

Version 2 uses PATCH. An update costs 10 tokens.

Acts onorganization
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventupdated.organization
Rate limit10 tokens

Removes the company record. A delete costs 6 tokens.

Acts onorganization
Permission (capability)contacts:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit6 tokens

Uses search:read. A search costs 40 tokens, capped at 10 requests per two seconds.

Acts onorganization
Permission (capability)search:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit40 tokens

Activities

Methods for working with activities, the calls, meetings, and tasks logged against records.5

Read-only. A list costs 20 tokens.

Acts onactivity
Permission (capability)activities:read
VersionIntroduced 2024-12-19
Webhook eventNone
Rate limit20 tokens

Read-only. A single read costs 2 tokens.

Acts onactivity
Permission (capability)activities:read
VersionIntroduced 2024-12-19
Webhook eventNone
Rate limit2 tokens

Needs the full activities scope.

Acts onactivity
Permission (capability)activities:full
VersionIntroduced 2024-12-19
Webhook eventadded.activity
Rate limit10 tokens

Version 2 uses PATCH. An update costs 10 tokens.

Acts onactivity
Permission (capability)activities:full
VersionIntroduced 2024-12-19
Webhook eventupdated.activity
Rate limit10 tokens

Removes the activity. A delete costs 6 tokens.

Acts onactivity
Permission (capability)activities:full
VersionIntroduced 2024-12-19
Webhook eventNone
Rate limit6 tokens

Leads

Methods for working with leads, the early inbox of potential deals before qualification.7

Read-only. Most lead endpoints remain on version 1.

Acts onlead
Permission (capability)leads:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit20 tokens

Read-only. A single read costs 2 tokens.

Acts onlead
Permission (capability)leads:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit2 tokens

Needs the full leads scope.

Acts onlead
Permission (capability)leads:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10 tokens

Leads use PATCH on version 1. An update costs 10 tokens.

Acts onlead
Permission (capability)leads:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10 tokens

Removes the lead. A delete costs 6 tokens.

Acts onlead
Permission (capability)leads:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit6 tokens

The search endpoint moved to version 2 and uses search:read. A search costs 40 tokens.

Acts onlead
Permission (capability)search:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit40 tokens

Conversion runs asynchronously; a status endpoint reports when the deal exists.

Acts onlead
Permission (capability)leads:full
VersionAvailable since the API’s base version
Webhook eventadded.deal
Rate limit10 tokens

Notes

Methods for working with notes attached to deals, persons, and organizations.4

Notes stay on version 1 and are reachable under the deals and contacts read scopes.

Acts onnote
Permission (capability)deals:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit20 tokens

Needs the full scope of the record the note attaches to, like deals:full or contacts:full.

Acts onnote
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10 tokens

Notes are version 1, which uses PUT, not PATCH.

Acts onnote
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10 tokens

Removes the note. A delete costs 6 tokens.

Acts onnote
Permission (capability)deals:full
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit6 tokens

Pipelines & stages

Methods for reading the pipelines and stages a deal moves through.2

Read-only, reachable under the deals read scope.

Acts onpipeline
Permission (capability)deals:read
VersionIntroduced 2024-12-02
Webhook eventNone
Rate limit20 tokens

Read-only. Creating or changing stages instead needs the admin scope.

Acts onstage
Permission (capability)deals:read
VersionIntroduced 2024-12-02
Webhook eventNone
Rate limit20 tokens
No endpoints match those filters.
Webhooks

Webhook events.

Pipedrive can notify an app when something changes in an account, like a deal being added or a person being updated. It sends a POST describing the action and the object that changed, so an integration learns about activity without polling.

EventWhat it signalsTriggered by
added.dealA deal was created. The payload carries the new deal record./api/v2/deals
updated.dealA deal changed, like a stage move, a value change, or a status change to won or lost./api/v2/deals/:id
deleted.dealA deal was deleted./api/v2/deals/:id
added.personA person (contact) was created./api/v2/persons
updated.personA person (contact) changed./api/v2/persons/:id
added.organizationAn organization (company) was created./api/v2/organizations
updated.organizationAn organization (company) changed./api/v2/organizations/:id
added.activityAn activity, like a call, meeting, or task, was created./api/v2/activities
updated.activityAn activity changed, for example it was marked done./api/v2/activities/:id
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Pipedrive limits API use two ways at once: a shared daily budget measured in tokens, where each call costs an amount set by how heavy it is, and a short burst ceiling on how many requests one user can make every two seconds.

Request rate

Pipedrive limits API use by a shared daily token budget rather than a flat request count. The budget is 30,000 base tokens multiplied by the plan (Lite 1x, Growth 2x, Premium 5x, Ultimate 7x) and by the number of seats, plus any purchased top-ups, and it resets at midnight in the server's timezone. Each call costs tokens by weight: a single read costs 2, a list 20, an update 10, a delete 6, and a search 40, and version 2 methods cost less than version 1. On top of the daily budget, a per-user burst limit caps requests in a rolling two-second window, from 20 per window on Lite up to 120 on Ultimate for API-token apps and higher for OAuth apps, with the Search API held to 10 per two seconds on every plan. Exhausting the daily budget or the burst window returns HTTP 429.

Pagination

Version 2 list endpoints use cursor pagination: a response returns a next_cursor, which the next request passes back as the cursor parameter, with limit setting the page size. This replaces the offset-based pagination of version 1, which used start and limit. Search endpoints return ranked matches and page the same cursor way in version 2.

Request size

The daily token budget, not a row count, is the real ceiling on how much can be read, since each list and search call deducts its token cost from the shared budget. The two-second burst window is the short-term cap. Webhook deliveries are retried at 3, 30, and 150 seconds, and a webhook that fails 10 times is paused for 30 minutes.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400bad_requestThe request was malformed or a parameter was invalid. The body returns success:false with an error and error_info message.Read the error and error_info, fix the parameters, and resend. The request is not retryable as-is.
401unauthorizedNo valid token was provided, or the OAuth access token expired (it lasts 60 minutes).Refresh the OAuth access token with the refresh token, or check the API token, then retry.
403forbiddenThe token lacks the scope or permission for this request, or an account limit was hit (the code reads feature_capping_*_limit).Grant the needed scope, use a token whose user has the permission, or address the account limit.
404not_foundThe requested object does not exist, or is not visible to this token.Verify the id, and confirm the token's user can see the record.
410goneThe requested resource is no longer available, for example a deprecated version 1 endpoint that has been removed.Move to the version 2 equivalent of the method.
429too_many_requestsA rate limit was hit: either the shared daily token budget is exhausted or the per-user two-second burst window is over its ceiling.Back off and retry using the x-ratelimit-reset header, and smooth request volume; if the daily budget is gone, wait for the midnight reset.
500internal_server_errorAn error on Pipedrive's side. It is rare.Retry with backoff, and contact Pipedrive support if it persists.
Versioning & freshness

Version history.

Pipedrive runs two API generations side by side. Version 2 is the current REST API, rebuilt for speed and lower token cost, and version 1 still serves the resources version 2 has not yet replaced.

Version history

What changed, and when

Latest versionv2
v2Current version
API v2 stable (current)

Version 2 is the current REST API, rebuilt for higher performance and lower token cost. It covers deals, persons, organizations, products, pipelines, stages, and activities, with cursor-based pagination, PATCH updates, true/false booleans, RFC 3339 timestamps, and custom fields moved into a nested object.

What changed
  • Activities v2 endpoints moved from public beta to stable.
  • Version 2 methods carry lower token costs than their version 1 equivalents.
  • Offset pagination replaced by cursor pagination on version 2 lists.
2024-12-19Feature update
Activities API v2 in public beta

New version 2 endpoints for the Activities API were introduced in public beta.

What changed
  • GET, POST, PATCH, and DELETE for activities added under /api/v2/activities.
2024-12-02Feature update
Products, Pipelines, and Stages v2

Production-ready version 2 endpoints for the Products, Pipelines, and Stages APIs were released.

What changed
  • Version 2 CRUD endpoints added for products, pipelines, and stages.
2025-12-31Requires migration
Selected v1 endpoints deprecated

A set of version 1 endpoints replaced by version 2 was scheduled for deprecation, with access no longer guaranteed after this date.

What changed
  • Deprecated version 1 endpoints remain accessible until the end of 2025.
  • Integrations are directed to move to the version 2 equivalents.

Prefer the version 2 method where one exists, and fall back to version 1 for resources it does not yet cover.

Pipedrive API changelog ↗
Questions

Pipedrive API, answered.

What is the difference between Pipedrive API v1 and v2?+
Version 2 is the current REST API, rebuilt for speed and lower token cost. It covers deals, persons, organizations, activities, products, pipelines, and stages, and it uses cursor pagination, PATCH for updates, true/false booleans, and a nested custom_fields object. Version 1 still serves resources version 2 has not yet replaced, like notes and most lead endpoints. Where both exist, the version 2 method is preferred.
How does Pipedrive authenticate API requests?+
Two ways. An app installed by a customer uses OAuth 2.0: the authorization-code flow returns a Bearer access token good for 60 minutes and a refresh token good for 60 days of inactivity, along with an api_domain that names the company's own API host. A single user can instead use a personal API token, a long-lived key passed with the request. Both are scoped to one company account.
How do Pipedrive OAuth scopes work?+
An app requests scopes at install time, and each scope opens a defined set of endpoints. Most areas come as a read-only and a full pair, so deals:read can list and view deals but only deals:full can create, update, or delete them, and the same split applies to contacts, activities, leads, and products. Separate scopes cover cross-account search (search:read) and account-wide settings (admin). Pipedrive's marketplace review checks that an app does not request more than it needs.
How is the API rate limit calculated?+
Pipedrive uses a daily token budget shared by the whole account, computed as 30,000 base tokens times the plan multiplier times the number of seats, plus top-ups, resetting at midnight server time. Each call costs tokens by weight, for example 2 for a single read, 20 for a list, and 40 for a search, and version 2 methods cost less. A separate per-user burst limit caps requests in any two-second window. Hitting either returns HTTP 429.
How do Pipedrive webhooks work?+
A webhook is registered with a POST to /api/v1/webhooks naming an event, written as an action and an object like added.deal, updated.person, or deleted.deal, with wildcards such as *.deal allowed. When that event happens, Pipedrive sends a POST with JSON describing the change to the registered URL, which can require HTTP basic auth. A failed delivery is retried at 3, 30, and 150 seconds, and 10 failures pause the webhook for 30 minutes.
Does Pipedrive have an official MCP server for AI agents?+
No. As of this writing Pipedrive does not publish a first-party Model Context Protocol server. The MCP servers that connect Pipedrive to AI agents are third-party, built on top of the public REST API. An agent reaches Pipedrive through the REST API directly, governed by the OAuth scopes or the API token behind the call.
Related

More crm API guides for agents

What is Bollard AI?

Control what every AI agent can do in Pipedrive.

Bollard AI sits between a team's AI agents and Pipedrive. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Pipedrive token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Pipedrive
Sales Follow-up Agent
View deals ResourceOffReadFull use
Delete deals ActionOffReadFull use
Activities ResourceOffReadFull use
Persons ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Pipedrive