Written by: Doug Camplejohn, CEO & Co-Founder, Coffee | Last updated: September 5, 2026
Key Takeaways for Technical Evaluators
- Attio CRM ships comprehensive public API documentation that covers REST endpoints, authentication, webhooks, and published rate limits.
- The docs are open without sign-in and include an interactive explorer, an OpenAPI spec, and multi-language code examples.
- Attio supports API keys for single-workspace integrations and OAuth 2.0 for multi-workspace apps, with clear scopes and security guidance.
- The API is pleasant to build on, yet it still backs a passive CRM that depends on humans for data entry and data quality.
- Teams that want to remove manual CRM data entry entirely can explore Coffee’s pricing and plans.
Why API Documentation Quality Shapes CRM Integration Success
API documentation quality directly affects how safely and quickly you can integrate a CRM. Strong docs signal engineering maturity and a vendor that treats developers as core users. Weak docs increase integration risk and slow every project that touches the CRM.
This guide walks through Attio’s documentation structure, authentication, key endpoints, rate limits, and MCP support, then compares Attio with Salesforce and HubSpot. It closes by showing why any passive CRM API, including Attio’s, still leaves the core data-quality problem unsolved and how Coffee’s agent-led model addresses that gap.
How Attio Organizes Its Public API Documentation
Attio’s public documentation lives on Mintlify and splits into five sections: Docs, App SDK, REST API, MCP, and SQL. This layout gives developers a clear map of every integration surface before they write a single line of code.
The REST API documentation covers authentication, rate limits, filtering and sorting, pagination, attribute types, and per-endpoint operation pages. Each endpoint page includes code examples in cURL, Python, JavaScript, PHP, Go, Java, and Ruby. The REST docs also include an interactive API explorer and an in-page AI assistant (“Ask Assistant”) that help developers test calls quickly.
The documentation is publicly accessible without sign-in. Evaluators can inspect the full API surface and example calls before creating an account or requesting access.
Authentication Options: Workspace Tokens and OAuth 2.0
Attio offers two authentication methods that map cleanly to common integration patterns.
Workspace access tokens (API keys) support single-workspace internal integrations. Teams generate them in Settings → Developers → Access tokens. Tokens start with sk_ and remain valid until explicitly revoked. Tokens carry no scopes by default, so developers must add scopes such as record_permission:read-write, list_entry:read, and webhook:read-write when creating them.
OAuth 2.0 supports multi-workspace applications. Attio implements the Authorization Code Grant (RFC 6749), with app registration handled in the developer dashboard at build.attio.com. Users authorize at https://app.attio.com/authorize, and the app exchanges the authorization code for a Bearer token via POST to https://app.attio.com/oauth/token.
A basic authenticated request uses the Bearer token like this example:
curl -X GET "https://api.attio.com/v2/objects" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json"Attio’s security guidance recommends one token per integration, storage in a secrets manager, no exposure in browsers or Git, and prompt revocation when tokens are no longer needed.
Core Endpoints and What They Enable
Attio’s endpoint catalogue sits under the /v2/ base path and covers several resource groups.
- Objects and records: Full CRUD and upsert across standard objects such as People, Companies, and Deals, plus custom objects. Custom objects created in the workspace follow the same query patterns as standard objects.
- Lists and list entries: Process and grouping management, with entries that carry process-specific data. A single record can appear in multiple lists without duplication.
- Notes, tasks, comments, and threads: Collaboration features exposed through the API.
- Files, meetings, and call recordings: Including access to Attio’s Call Intelligence data.
- Webhooks: Event-driven integrations with at-least-once delivery guarantees and HMAC SHA-256 signing.
The API supports filtering and sorting on both GET and POST endpoints with compound conditions and offers both limit/offset and cursor-based pagination. To illustrate record creation, here is a minimal POST request that adds a person with an email address:
curl -X POST "https://api.attio.com/v2/objects/people/records" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "data": { "values": { "email_addresses": [ { "email_address": "jane@example.com" } ] } } }'Attio publishes an OpenAPI specification that teams can import into Postman or use for client generation. Attio does not ship an official REST client SDK, yet the OpenAPI spec keeps client creation straightforward.
Rate Limits and Design Considerations for Integrations
Attio documents workspace-wide limits of 100 reads per second and 25 writes per second. When requests exceed these limits, the API returns HTTP 429 with a Retry-After header that usually points to the next second.
List records and list entries endpoints add a complexity-based rate limit. Each query receives a complexity score based on filters, sorts, and the total record or entry count. Scores accumulate across apps and tokens in a sliding ten-second window shared by the workspace.
This model creates two distinct 429 responses that need different handling:
- If a single query’s complexity score exceeds the per-query limit, identical retries keep failing. The fix is to simplify the query by reducing filters, sorts, or dataset size.
- If the summed windowed score exceeds the limit, waiting allows the window to reset. Code must distinguish this case to avoid unnecessary query changes.
These limits have direct design consequences. At the 25 writes-per-second ceiling, a 100,000-record sync requires at least 67 minutes of sustained writes, assuming no errors or retries. Integrations should batch writes and plan sync windows accordingly.
Webhook handling introduces a separate concern. Webhook signatures must be verified using the HMAC SHA-256 value in the Attio-Signature header, computed against the raw body. Re-serializing JSON changes key ordering and breaks verification.
How Attio Uses MCP for AI-Driven Access
Attio extends beyond REST by operating a hosted MCP server for AI tools. The server at https://mcp.attio.com/mcp reached general availability in February 2026. Assistants such as Claude, ChatGPT, and Cursor can query and modify Attio data using natural language with OAuth-based authentication, so MCP connections do not require API keys.
The MCP server exposes 37 structured tools across nine categories, including records, lists, comments, notes, tasks, meetings, emails, workspace management, and reporting. MCP rate limits are tier-based per workspace, with separate limits for read, write, search, semantic search, and reporting tools.
Several limitations shape when MCP fits. MCP does not expose webhook tools, cannot create objects or attributes, and requires interactive OAuth. These constraints keep MCP focused on interactive AI sessions, while the REST API remains the right choice for deterministic, unattended, or webhook-triggered automation. MCP also includes access to emails and call recordings that are not available through the public REST API.
How Attio Compares to Salesforce and HubSpot for Developers
Documentation structure and clarity: Attio’s docs feel compact and modern, with five clear sections and no sign-in requirement. Salesforce’s documentation spans many versioned guides for REST, SOAP, Bulk, Tooling, Metadata, Streaming, and Pub/Sub, across API versions 30.0 through 68.0. It is powerful yet demands heavy navigation. HubSpot now uses date-based API versioning such as /crm/objects/2026-03/contacts and exposes a machine-readable llms.txt index for discovery.
Authentication simplicity: Attio offers API keys for single-workspace use and OAuth 2.0 for multi-workspace apps, both as Bearer tokens with explicit scope docs. Salesforce relies on OAuth 2.0 with multiple flows and connected-app configuration, which increases setup time. HubSpot uses OAuth 2.0 for multi-account apps and static access tokens for private, single-account integrations.
Rate limits: As noted in the rate limits section, Attio publishes workspace-wide limits with additional complexity scoring on list endpoints. Salesforce’s limits vary by API type and edition, with composite requests that batch up to 25 subrequests. HubSpot applies tier-based limits that depend on plan and API family.
Feature set: Attio covers full CRUD on records, lists, notes, tasks, files, meetings, and call recordings. It omits B2B data intelligence endpoints such as external enrichment, buyer intent, or org chart resolution. Salesforce spans metadata, streaming, and platform events, while HubSpot offers broad CRM coverage across marketing, sales, and service APIs.
Attio’s documentation stands out as especially developer-friendly for modern REST work. All three platforms, however, expose APIs for passive databases that still rely on humans to keep CRM data current.
Common Integration Pitfalls With Attio’s API
- Ignoring rate limits: Exceeding 100 reads per second or 25 writes per second triggers 429 responses. Design batching and backoff from the start.
- Mishandling the two types of 429 responses: A query that exceeds the complexity score keeps failing if retried unchanged, while a windowed-limit 429 resolves after waiting.
- Skipping webhook signature verification: Attio signs every webhook with HMAC SHA-256. Verification must use the raw body, because re-serialization breaks the signature.
- Assuming uniform pagination: Some endpoints use limit/offset and others use cursor-based pagination. Filters and limits must remain identical between cursor calls.
- Writing referenced records in the wrong order: A person that references a non-existent company fails. Write companies first, then people.
- Using
$neqinstead of$not: Attio omits a$neqoperator, so conditions must wrap in$not.
Why Coffee’s Agent-Led CRM Solves the Data-Quality Problem
Attio’s API documentation makes integration work smooth, yet the system still depends on humans to enter and maintain data. 71% of sales reps report spending too much time on data entry, which leaves only 35% of their time for selling. A polished API accelerates tooling, but it keeps the manual data-entry burden in place.
Coffee introduces an autonomous CRM Agent that removes that burden. Unlike passive CRMs that rely on humans to populate records, Coffee automatically captures tasks, connects data streams, and logs interactions by scanning emails and calendars. The agent focuses on getting high-quality data into the system so downstream insights stay accurate.
Coffee operates in two models: a standalone AI-first CRM for small to mid-sized businesses and a Companion App that layers the agent on top of existing Salesforce or HubSpot instances. For teams already committed to those platforms, Coffee handles the “data in” work so the system of record stays accurate without human effort. This API flexibility matters to technical teams; one customer generating tens of millions in revenue used Coffee’s API to script bespoke prompts for custom briefings while the agent handled all data entry automatically.
The agent-led advantages show up in daily workflows:
- Automatic data entry and enrichment: Coffee scans emails and calendars to populate records, saving reps 8–12 hours per week without manual updates.
- Unified structured and unstructured data: Coffee brings email text, call transcripts, and structured fields into a single view that preserves historical context.
- Pipeline intelligence: Because the agent maintains clean data, pipeline analysis stays accurate without CSV exports or manual reviews.
Teams that want to remove manual CRM data entry can see how Coffee eliminates data-entry work.
Conclusion: Attio’s Strong API vs Coffee’s Agent-First Architecture
Attio CRM delivers public API documentation that is comprehensive, well-structured, and friendly for developers. The docs cover authentication with API keys and OAuth 2.0, CRUD endpoints for records, lists, notes, tasks, files, meetings, and call recordings, webhooks with at-least-once delivery, published rate limits, an OpenAPI spec, and MCP support through a hosted server at https://mcp.attio.com/mcp. For technical evaluators focused on integration complexity, Attio performs well.
The core limitation sits in the architecture. Attio’s API exposes a passive database that still depends on humans for data entry, which keeps the data-quality problem in place and costs sales teams hours every week. Better integrations move data faster, yet they still start from human-entered records.
Coffee’s agent-led approach addresses that root cause. The agent handles data input automatically, unifies structured and unstructured information, and surfaces accurate insights while still offering flexible APIs for custom work. Teams that want an AI-first CRM experience without the manual data-entry burden can start a Coffee trial.
Frequently Asked Questions
Does Attio offer a free tier with API access?
Yes. Attio includes API and webhook access on all plans, including the free tier with 3 seats, 50,000 records, and 3 custom objects. There is no separate API pricing and no per-call metering for standard REST API calls. SQL access is plan-gated, and custom objects increase from 3 on Free to unlimited on Enterprise. AI features like Ask Attio and workflow automation blocks consume credits that vary by subscription tier.
What is the difference between Attio’s MCP server and its REST API?
Attio’s REST API and MCP server target different integration styles. The REST API supports deterministic, programmatic automation such as scheduled syncs, webhook-triggered workflows, and integrations built with tools like n8n or Zapier. It is the right choice for unattended, high-volume operations.
The MCP server, hosted at mcp.attio.com, focuses on interactive AI sessions where assistants call structured tools using natural language. As covered in the MCP section, MCP exposes a set of tools for reading and updating data but cannot create objects, handle webhooks, or run with headless authentication. Teams typically pair MCP for live, judgment-heavy AI work with the REST API for classical integrations.
How does Coffee differ from building integrations on top of Attio’s API?
Integrations on Attio’s API automate data movement between systems while still depending on humans to create that data. Sales reps must take notes, log calls, and update deal stages before any integration can sync those updates elsewhere.
Coffee’s agent removes that manual step. By connecting to Google Workspace or Microsoft 365, the Coffee Agent automatically creates contacts and companies, logs activities, enriches records with job titles and funding data, joins calls to record and transcribe them, and generates post-meeting summaries and follow-up drafts without human input. Coffee also offers API access for custom integrations and can run as a standalone CRM or as a Companion App on top of Salesforce or HubSpot.
What are the most common mistakes developers make when integrating with Attio’s API?
The most frequent mistakes involve rate limits, webhooks, pagination, and write ordering. Developers often treat all 429 responses the same, skip or misimplement webhook signature verification, assume uniform pagination, or ignore the need to write referenced records in the correct order. The Common Pitfalls section above explains each of these issues in detail and shows how to avoid them.
Is Coffee compatible with teams that want to keep Salesforce or HubSpot as their system of record?
Yes. Coffee runs in two modes. The Standalone CRM replaces legacy platforms for small to mid-sized businesses that have outgrown spreadsheets but find traditional CRMs expensive and maintenance-heavy. The Companion App deploys the Coffee Agent as an intelligent layer on top of an existing Salesforce or HubSpot setup.
After a simple authentication, the agent syncs data, enriches records, and writes insights such as call summaries, next steps, and activity logs back to the primary CRM. Teams keep their existing workflows, quotas, forecasting, and required fields while removing the manual data-entry work that harms data quality. Coffee understands Salesforce and HubSpot deeply, including custom fields, forecasting hierarchies, and required field validation that simpler CRM agents often mishandle.
