Zoho CRM API: Full Developer Review [2026]

Every CRM API evaluation comes down to scope versus depth: does the surface cover what your integration needs, and does it cover it well enough for production?

Zoho CRM's API is a mature REST surface, now on its eighth major version, with OAuth 2.0 authentication, a credit-based rate-limit system that scales from a free tier to unlimited daily credits, five official server-side SDKs, a Bulk API for asynchronous high-volume operations, a COQL query language for SQL-style record retrieval, and a Notification API for event-driven integrations.

The developer documentation is public, versioned across V6 through V8, and includes an official Postman collection. For a CRM serving 300,000+ businesses, that level of developer investment is expected.

But coverage of your own CRM data and coverage of the market data your pipeline needs are different capabilities.

Zoho CRM's API gives you programmatic access to the records, modules, workflows, and configuration inside your CRM instance. If you need to create contacts, update deals, trigger automations, query pipeline data, or sync records with external systems, the API handles it. It does not, however, provide B2B intelligence beyond your own CRM: no contact enrichment from external databases, no company attributes from external sources, no technographic profiles, no buyer intent signals, no org chart data, and no direct-dial phone number discovery. Those capabilities sit at a different layer of the stack.

This is where ZoomInfo, a GTM platform, enters the picture. Its Enterprise API is a REST suite covering search, enrichment, and AI intelligence across 500M contacts and 100M companies, with an MCP server for AI-agent workflows. The two APIs are layers of the same pipeline: Zoho CRM stores and manages your customer data, ZoomInfo enriches it with external intelligence.

This review covers the Zoho CRM API first (authentication, endpoints, webhooks, SDKs, rate limits, and pricing), then reviews ZoomInfo's API as the intelligence layer that picks up where your CRM's data boundary ends.

Zoho CRM API at a Glance

Zoho CRM API: What Works Well & What to Plan Around

Zoho CRM API: Authentication & Getting Started

API access starts with any Zoho CRM account, including the permanent free plan (up to 3 users, 5,000 API credits per day).

There is no separate developer signup, no enterprise gate, and no approval process. Zoho also offers a free Developer Edition, a full CRM instance for building and testing integrations without affecting production data.

Source: Zoho

Zoho CRM uses OAuth 2.0 exclusively for API authentication. There is no API-key option. Developers register a "connected application" in Zoho's developer console to get a Client ID and Client Secret, then implement the standard authorization code grant flow.

Two token characteristics matter for integration design:

• Access tokens expire after one hour and are scoped to specific API permissions defined during app registration.

• Refresh tokens live indefinitely until the end-user revokes them, so a proper token refresh flow keeps an integration running without re-authorization.

Tokens must be passed in the HTTP Authorization header. Zoho's documentation warns against exposing access tokens in client-side code or public repositories.

A basic authenticated request:

curl "https://www.zohoapis.com/crm/v8/Leads" \

-H "Authorization: Zoho-oauthtoken YOUR_ACCESS_TOKEN"

The response returns records in JSON format with standard HTTP status codes. For teams running multiple integrations against the same CRM instance, each registered connected application gets its own OAuth credentials and scoped permissions, giving you per-integration access control out of the box.

Zoho CRM API: Core Endpoints & Capabilities

Source: Zoho

The API covers nearly every data entity and configuration surface in the CRM. The API Directory provides a searchable, filterable table of every endpoint across V6, V7, and V8, with links to individual reference pages.

Records (Leads, Contacts, Accounts, Deals, and Custom Modules)

Source: Zoho

The records surface is the core of the API. Operations apply per module (Leads, Contacts, Accounts, Deals, or any custom module).

Operations available:

• Insert records: create up to 100 records per call

• Update records: modify existing records by ID

• Upsert records: create-or-update based on a unique field

• Delete, get, clone, and mass delete

• Convert Lead: move a lead to Contacts, Accounts, and Deals in a single call

• Mass Convert Leads: batch lead conversion

• Merge records: combine duplicates

• Mass change owner: reassign records in bulk

What you would build with this: a bidirectional CRM sync that pushes qualified leads from your marketing platform into Zoho CRM, converts them to contacts when they reach a deal stage, and writes deal updates back to your internal dashboard.

Search and Query

Two mechanisms cover data retrieval beyond simple record GETs:

Search Records API: Filter by criteria, phone number, email, or word match. Useful for real-time lookups (finding a contact by email during a form submission, for example).

COQL (CRM Object Query Language): A SQL-style SELECT interface for querying CRM data with familiar syntax. It supports up to 2,000 records per call and uses a LIMIT parameter for pagination. COQL is the right tool when you need complex filtering, field selection, or aggregation that the standard record-list endpoints don't support.

What you would build with this: a reporting pipeline that runs nightly COQL queries against your deal data, pulls records matching specific stage and date criteria, and feeds the results into a BI tool.

Bulk Operations (Asynchronous)

Source: Zoho

For high-volume data movement, the API provides asynchronous bulk endpoints:

• Bulk Read: start a background export job for large datasets. Submit criteria, receive a job ID, poll for completion, then download the result file.

• Bulk Write: upload large volumes of records in a single background job. Submit a CSV or JSON file, and the API processes it asynchronously.

The bulk endpoints serve data migrations, nightly syncs, and large-scale imports where the per-call limit of 100 records on standard insert/update endpoints would be impractical.

Configuration and Automation

The API extends beyond data operations into CRM configuration:

• Workflow rules: CRUD operations on automation rules

• Connected Workflows: manage cross-module workflow chains

• Cadences: enroll and unenroll records programmatically

• Webhooks: create, update, delete, and retrieve failure logs for outbound webhook actions

• Custom fields and custom modules: extend the CRM schema via API

• Layouts, picklist values, and module metadata

What you would build with this: a provisioning system that creates custom modules, fields, and workflow rules when onboarding a new team or business unit, without touching the CRM dashboard.

Administration and AI

• Users, Roles, Profiles, Territory management, Data sharing rules, and Audit log export

• Modules metadata and field metadata for dynamic schema discovery

• Recycle bin access

• Zia Assistant: a chat-based AI prompt API that queries your org's CRM data

• Zia data enrichment APIs for field-level enrichment configuration

Zoho CRM API: Webhooks & Events

Zoho CRM provides two event-driven mechanisms, each serving a different integration pattern.

Notification API (Inbound Event Subscriptions)

The Notification API works like a webhook subscription system. Developers enable a notification on any module and specify a callback URL; Zoho delivers an HTTP POST to that URL when the subscribed event fires.

Supported events: create, update, and delete at the record level. From API V6 onward, field-specific notifications let you trigger a callback only when a specific field changes (for example, only when a Deal's Stage field updates, ignoring all other field changes on the same record).

Each subscription has a configurable expiry time and a unique channel ID. You can disable subscriptions via the Disable Notifications API. The expiry requirement means your integration must handle subscription renewal, which adds operational overhead but also prevents orphaned subscriptions from accumulating.

Webhook Actions (Outbound via Workflow Rules)

Source: Zoho

Separately from the Notification API, Zoho CRM supports outbound webhook actions triggered by workflow rules. These have their own API endpoints: create, update, delete, and get webhook failures. The failure retrieval endpoint lets you check which deliveries failed and take corrective action.

Two things to plan around:

• Notification subscriptions expire. Unlike set-and-forget webhook configurations in many APIs, Zoho's Notification API requires you to manage subscription lifecycles. Build renewal logic into your integration.

• Retry behavior is not publicly documented. The documentation does not describe delivery guarantees, retry policies, or payload signing for either notification deliveries or webhook actions. Design your receiver to be idempotent regardless.

Zoho CRM API: SDKs, Docs & Rate Limits

SDKs & Libraries

Zoho publishes five official server-side SDKs:

• Java: Java SDK

• Python: Python SDK

• Node.js: Node.js SDK

• PHP: PHP SDK

• C#: C# SDK

Five languages covers the server-side languages most commonly used in CRM integrations well. Beyond the server SDKs, Zoho provides Web SDKs and Mobile SDKs for building embedded widgets and mobile applications that interact with CRM data.

Zoho also maintains Deluge, its own scripting language for custom functions that execute inside the CRM's automation engine. Deluge functions can call CRM integration tasks that consume the same API credit pool, which is worth tracking if your integration combines SDK-based external calls with internal Deluge automations.

Source: Zoho

Documentation & Developer Experience

Zoho CRM's developer documentation lives at zoho.com/crm/developer/docs and is well-structured:

• API Directory: A searchable, filterable table of every endpoint across V6, V7, and V8, with links to individual reference pages. The directory indicates which versions support each endpoint.

• Postman Collection: An official Postman workspace with ready-to-run requests for the REST APIs. This is the fastest path to confirming response shapes without writing code.

• Kaizen Series: Tutorials covering specific API patterns and integration use cases.

• Multi-version support: V6, V7, and V8 are all documented and cross-referenced.

• Developer sandbox: Available on Enterprise plan and above, letting you test API connections against a copy of production data.

• API usage dashboard: Built into the product for all paid plans, showing top API consumers, usage patterns, and per-method breakdowns.

• Developer Edition: A free CRM instance for developers building third-party integrations.

Developer support channels include the Zoho CRM Customer Forum and the Kaizen tutorial series. The documentation does not reference a dedicated developer Slack or Discord channel. No OpenAPI/Swagger spec download was identified in the docs, though the Postman collection partially fills that gap.

Rate Limits & Constraints

Zoho CRM uses a credit-based system with a rolling 24-hour window. Each API call deducts one or more credits depending on the operation.

Daily credit allowances by edition:

Selected credit costs:

• Most GET and metadata operations: 1 credit

• Insert/Update/Upsert: 1 credit per 10 records (max 10 credits per call)

• Convert Lead: 5 credits

• Mass Convert Leads: 200 credits

• Bulk Read initialization: 50 credits

• Bulk Write initialization: 500 credits

• Send Mail: 20 credits

• Merge Records: 50 credits

Concurrency limits (simultaneous calls per org/app):

A sub-concurrency limit of 10 applies across all editions for compute-heavy operations: COQL queries, Convert Lead, bulk insert/update/upsert with more than 10 records, Send Mail, Search from a function, and Composite API calls.

There are no per-minute or per-second rate limits. Limits rest on the concurrent request count and the rolling daily credit pool. This model rewards steady throughput over bursty traffic: you can sustain a high request rate as long as you stay within the concurrency cap and credit budget.

For organizations that exhaust their included credits, Zoho offers pay-as-you-go add-on credits purchasable from the in-app API Dashboard.

The super-admin can raise the credit limit, and Zoho bills monthly for credits consumed above the plan allowance. The per-credit overage price is not published; contact Zoho sales for specific figures.

Zoho CRM API Pricing & Access Costs

Zoho CRM bundles API access into every plan, including the Free Edition. There is no separate API add-on or developer tier. This matters: many CRM APIs gate programmatic access behind mid-tier or enterprise plans.

The effective API cost is the CRM subscription itself:

In practical terms: a 10-user Professional plan ($230/month) provides 55,000 daily credits. If your integration mostly uses record read/write operations at 1 credit each, that is 55,000 API calls per day, or roughly 1.65 million per month, included in the subscription cost.

Bulk operations cost more in credit terms. A Bulk Write initialization costs 500 credits, and a Bulk Read initialization costs 50. A pipeline that runs 10 bulk imports per day consumes 5,000 credits on initialization alone, before counting individual record operations.

For teams that exceed their plan's daily credit pool, add-on credits are available on a pay-as-you-go basis through the API Dashboard, billed monthly for actual consumption. The per-credit price is not published publicly.

Month-to-month billing is available (approximately 34-40% higher than annual rates), and there are no long-term contract requirements.

A 15-day free trial of the Enterprise plan (no credit card required) gives developers full access to evaluate the API before committing.

Where the Zoho CRM API Falls Short

These are scope decisions and practical constraints a developer should plan around, not product failures. Several reflect what a CRM API is (access to your own CRM data) and what it is not.

No external data enrichment. The API operates entirely within your CRM instance. There are no endpoints for looking up contacts from external databases, discovering direct-dial phone numbers, pulling company attributes, detecting technology stacks, or surfacing buyer intent signals. If your pipeline needs to enrich a CRM record with data not already in the CRM, you need a second API.

No org chart or corporate hierarchy intelligence. Zoho CRM supports parent-child account structures you create manually, but the API does not provide external org chart data, buying committee identification, or corporate hierarchy mapping from third-party sources.

Notification subscriptions expire. The Notification API requires a configurable expiry time on every subscription. There is no way to create a permanent event subscription. Your integration must handle renewal, and a missed renewal means missed events.

Webhook delivery guarantees are undocumented. The public docs do not describe retry behavior, backoff policies, or payload signing for notification deliveries or webhook actions. If your pipeline depends on guaranteed event delivery, you need to build your own reliability layer.

Concurrency limits are per-org, not per-key. If you run three integrations against the same CRM instance, they share the same concurrency cap (5 to 25 simultaneous calls depending on edition). Multiple OAuth applications do not increase the concurrency ceiling.

Credit costs are uneven across operations. A record read costs 1 credit. A Bulk Write initialization costs 500. A Mass Convert Leads call costs 200. For integration pipelines that mix these operations, credit budgeting requires planning against the actual operation mix, not just the call count.

No OpenAPI/Swagger spec. The documentation is well-organized and the Postman collection helps, but there is no downloadable OpenAPI specification for automated client generation. Developers building strongly-typed integrations must work from the SDK or construct their own types.

Overage pricing is not published. When your integration exceeds the daily credit pool, add-on credits are available, but the per-credit price requires contacting Zoho sales. For capacity planning, this is a blind spot until you have a quote.

ZoomInfo API: The Intelligence Layer Zoho CRM's Data Does Not Cover

Zoho CRM's API tells you everything about the records in your CRM.

ZoomInfo's API tells you everything about the people and companies that should be in it: who they are, what technology they use, whether they are researching your category, where they sit in the org chart, and how to reach them directly.

The two APIs sit at different layers. Zoho CRM stores and manages your customer data; ZoomInfo enriches that data with external B2B intelligence.

The gap between "what is in our CRM?" and "who should be in our CRM, and what do we know about them?" is where ZoomInfo's API fits. That intelligence comes from ZoomInfo's GTM Context Graph, which processes 1.5B+ data points daily by combining ZoomInfo's B2B data with your first-party data.

What the API Covers: Search, Enrichment, and AI Intelligence

ZoomInfo's Enterprise API is a REST suite served from https://api.zoominfo.com/gtm, organized into four areas documented in the interactive API reference:

Data API (Search & Enrich): Search endpoints cover Contacts, Companies, Intent, News, and Scoops, returning matched records without consuming credits.

Enrich endpoints unlock full payloads: business emails, direct dials, employment history, corporate hierarchy, org charts, technographics, and hashtag signals, accepting up to 25 records per call.

The underlying dataset spans 500M contacts, 100M companies, 135M+ verified phone numbers, and 200M+ verified business email addresses. The search-then-enrich pattern lets you filter freely, then pay only for the records you commit to.

Copilot API (AI Intelligence): Account Summary returns structured account intelligence with a free-form Q&A endpoint.

Find Similar Companies performs lookalike expansion.

Contact Recommendations returns AI-ranked buying-committee suggestions by motion (prospecting, deal acceleration, renewals).

Marketing and Platform APIs: CRUD endpoints for programmatic audience management, plus bidirectional engagement data via the Engagements API (currently in Beta).

The pairing with a CRM API is direct: search ZoomInfo for contacts matching your ICP (free, no credits consumed), enrich the ones worth pursuing, then push them into Zoho CRM via its record insertion endpoints.

Authentication, Rate Limits & Credits

Authentication uses OAuth 2.0 with PKCE via Okta, issuing 24-hour access tokens with rotating refresh tokens.

Three flows are supported: Authorization Code with PKCE (for web applications), Client Credentials (for server-to-server), and Refresh Token. Teams register applications through the ZoomInfo Developer Portal, where they generate credentials, define scopes, and test endpoints.

Rate limits are published by tier: Builder (5 req/sec), Standard (25 req/sec), and Scaling (35 req/sec), with per-hour and per-day sliding-window limits enforced simultaneously. Every response includes quota headers with remaining capacity, and 429 responses include a Retry-After header with exact backoff timing.

Credits follow a rolling 12-month window: enriching a record for the first time consumes one credit; re-enriching the same record within the year is free. Search and lookup operations are free and do not consume credits.

Webhooks, MCP & Developer Experience

Webhooks are available via the Agents API, tied to ZoomInfo's Agent Teams system. Event types cover bulk enrichment jobs completing, records changing, credit usage crossing thresholds, and new GTM signals (scoops, funding events, intent spikes) becoming available. Retry behavior and throttling are configurable per event type.

For developers building AI agents, ZoomInfo's MCP server at https://mcp.zoominfo.com/mcp exposes search, enrich, and account research as native tools for MCP-compatible assistants, currently supporting Claude and ChatGPT. The credit model carries over from the REST API.

ZoomInfo does not publish official SDKs, so you integrate over HTTP and own the auth-and-retry layer yourself. The interactive API reference supports live testing, and a Docs MCP server lets AI development tools generate integration code against the API spec.

Documentation lives at docs.zoominfo.com. ZoomInfo uses consumption-based pricing and has added API access to all relevant plans.

BDO Canada reported an 87% reduction in time spent updating internal data dashboards using the ZoomInfo API, with one analyst describing the integration as plug-and-play across any process. (ZoomInfo)

Final Verdict

Zoho CRM's API is a well-documented surface that gives developers programmatic access to a mature CRM platform.

The credit-based rate-limit system scales from a free tier to unlimited daily credits, five official SDKs cover the major server-side languages, the Postman collection and API Directory make evaluation fast, and multi-version support (V6 through V8) protects existing integrations during upgrades.

For a developer building CRM integrations (record sync, workflow automation, custom modules, pipeline queries), it is production-ready and included at every price point.

Choose the Zoho CRM API if your integration is CRM-first: syncing records between systems, automating workflows, building custom modules, querying pipeline data via COQL, or extending the CRM with embedded widgets. The free tier with 5,000 daily credits is enough to prototype, and the Professional or Enterprise tiers provide the credit headroom and concurrency for production pipelines.

Add the ZoomInfo API when the build needs to go beyond what is already in the CRM: discovering new contacts and companies, enriching records with direct dials and business emails, detecting buyer intent signals, mapping org charts, or powering AI agents with B2B intelligence.

The search-then-enrich pattern keeps enrichment costs focused on records that matter, and the MCP server extends the same intelligence to AI-agent workflows.

Start with the ZoomInfo Enterprise API or explore the developer docs to see the endpoint surface for yourself.

A developer who needs neither API should note that Zoho CRM's API does not provide external market intelligence, and ZoomInfo's API does not manage CRM records. If your pipeline requires both, the two are layers of the same stack, not competing surfaces.

FAQ

Is the Zoho CRM API free?

API access is included on every Zoho CRM plan, including the permanent free tier (up to 3 users). The free plan provides 5,000 API credits per day. Paid plans start at $14/user/month (Standard) with 50,000 base credits plus 250 per user. There is no separate API add-on or developer pricing tier. The 15-day free trial of the Enterprise plan gives full API access without a credit card.

Does Zoho CRM have a GraphQL API?

No. The primary API is REST (currently V8). Zoho CRM does offer COQL (CRM Object Query Language), a SQL-style query interface that supports SELECT statements against CRM data with up to 2,000 records per call. COQL provides some of the selective querying benefits of GraphQL, though through SQL syntax rather than a graph query language.

What is the Zoho CRM API rate limit?

Zoho CRM uses a credit-based system rather than a requests-per-second ceiling. Each operation costs a specific number of credits (1 for most reads, up to 500 for a Bulk Write initialization), drawn from a rolling 24-hour pool. The daily pool ranges from 5,000 credits on the free plan to unlimited on the Ultimate plan. Concurrency is capped separately: 5 to 25 simultaneous calls depending on edition, with a sub-concurrency limit of 10 for compute-heavy operations across all editions.

Are there official Zoho CRM SDKs?

Yes. Zoho publishes five official server-side SDKs: Java, Python, Node.js, PHP, and C#. Web SDKs and Mobile SDKs are also available for building embedded widgets and mobile apps. Zoho also maintains Deluge, a proprietary scripting language for custom functions that run inside the CRM's automation engine and consume from the same API credit pool.

Does the Zoho CRM API support webhooks?

Yes, through two mechanisms. The Notification API lets you subscribe to record-level events (create, update, delete) on any module, with field-specific filtering from V6 onward. Separately, webhook actions can be configured as workflow rule outputs, with API-managed CRUD and a failure retrieval endpoint. Notification subscriptions require a configurable expiry time (no permanent subscriptions), and retry behavior for both mechanisms is not publicly documented.

Can I use the Zoho CRM and ZoomInfo APIs together?

Yes, and the two APIs serve complementary roles. Zoho CRM's API manages your CRM data: records, workflows, pipelines, and automations.

ZoomInfo's API provides the external B2B intelligence that CRM data alone does not contain: contact discovery across 500M profiles, company enrichment with technographics and company attributes, direct-dial phone numbers, buyer intent signals, and AI-powered account research.

A practical pattern is to search ZoomInfo for contacts matching your ICP (free, no credits consumed), enrich the matches, then push verified contacts into Zoho CRM via its insert records endpoint.

The two APIs use different OAuth implementations (Zoho's own OAuth server vs. ZoomInfo's Okta-based PKCE flow) and different credit systems, so plan your integration to handle both authentication flows and track credits independently.