OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Structured lead and contact records.
Close API overview ↗
Core concepts · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Lead collections can be traversed with pagination.
Close list leads ↗
List Leads · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Structured lead search predicates are documented.
Close advanced filtering ↗
Advanced Filtering · Checked 2026-10-16
Access cost barrier -
-
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges.
Close API overview ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 10.0/10
Customer authorization without discretionary provider approval
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Customers connect third-party tools using API keys or authorize OAuth.
Close API keys and OAuth permissions ↗
API keys and OAuth apps · Checked 2026-10-16
Downstream permission -
-
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
The reviewed technical documentation does not establish contractual permission for the declared downstream processing.
Close API overview ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 7.5/10
Create and update in one business domain
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Lead create and update operations are documented.
Close create lead ↗
Create Lead; update route separately reviewed · Checked 2026-10-16
Close update lead ↗
Update an existing lead · Checked 2026-10-16
Custom application path 10.0/10
Customer applications using fixed APIs without provider selection
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Customer-authorized applications use fixed REST interfaces.
Close API keys and OAuth permissions ↗
API keys and OAuth apps · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Webhooks and a queryable event log support change extraction.
Close event log ↗
Event format · Checked 2026-10-16
Limit visibility 7.5/10
Service-specific limits disclosed in runtime headers
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Endpoint budgets and rate-limit response headers guide backoff.
Close rate limits ↗
Rate limits and response headers · Checked 2026-10-16
CDC and deletion capture 7.5/10
Updates and deletion identities documented for the stated resources
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Events carry object ID and created/updated/deleted actions; payload access has role/time limits.
Close event log ↗
Event format · Checked 2026-10-16
Replay and gap recovery 7.5/10
Replay/change queries within a documented retention window
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
The log is queryable for 30 days; consolidation and one-hour non-admin payload visibility limit fidelity.
Close event log ↗
Event format; Event consolidation · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Lead JSON responses supply a customer-held record copy.
Close list leads ↗
List Leads responses · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
No retrieval window or export charge at cancellation is established by these technical sources.
Close API overview ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Documented lead records are portable; whole-product fidelity is unverified.
Close list leads ↗
List Leads response · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 5.0/10
Customer-editable native workflows or agent configurations
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Sequences define native automated steps and have create/update APIs.
Close native sequences ↗
Sequences; Create a Sequence; Update a Sequence · Checked 2026-10-16
Rights to custom logic -
-
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Rights to native workflow artifacts and independent execution are not established.
Close API overview ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Customers generate API keys for integrations or authorize OAuth applications. Both inherit user access; OAuth does not provide granular resource scopes.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
Lead lists support pagination, while advanced filtering supports structured searches. API records cover the declared CRM scope rather than every attachment or service configuration.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer user API key | HTTP Basic | Customer | No | customer creates a key; api key as basic username, blank password; inherits user permissions | 2026-10-16 |
| User-authorized OAuth application | OAuth 2.0 | Integration provider | Not confirmed | registered app client plus user authorization; production distribution review not established | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
Access-specific fixed fees and the lowest eligible plan were not established. Endpoint rate budgets use rate-limit headers and 429 backoff; concurrent requests need their own budget.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
Create Lead and Update Lead document customer-record mutations. PUT changes only supplied fields; safe retry after an ambiguous creation is not established.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Events identify created, updated and deleted objects for 30 days. Nearby updates can merge into one event, and non-admin object/previous payloads are visible for only one hour.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates and deletion identities documented for the stated resourcesClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Events carry object ID and created/updated/deleted actions; payload access has role/time limits. | Close event log ↗Event formatChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Replay/change queries within a documented retention windowClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. The log is queryable for 30 days; consolidation and one-hour non-admin payload visibility limit fidelity. | Close event log ↗Event format; Event consolidationChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Lead JSON can be retained as a portable record copy. The event log does not preserve every intermediate update (full files, native configuration and cancellation retrieval remain unverified).
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
The API exposes creation and editing of native Sequences as well as external integration code. Rights to export and execute native definitions independently were not established.
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Structured lead and contact records. | Close API overview ↗Core conceptsChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Lead collections can be traversed with pagination. | Close list leads ↗List LeadsChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Structured lead search predicates are documented. | Close advanced filtering ↗Advanced FilteringChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Customer authorization without discretionary provider approvalClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Customers connect third-party tools using API keys or authorize OAuth. | Close API keys and OAuth permissions ↗API keys and OAuth appsChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges. | Close API overview ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. The reviewed technical documentation does not establish contractual permission for the declared downstream processing. | Close API overview ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| Which external write operations are documented? | Create and update in one business domainClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Lead create and update operations are documented. | Close create lead ↗Create Lead; update route separately reviewedChecked 2026-10-16 Close update lead ↗Update an existing leadChecked 2026-10-16 |
| How can customers connect an application they build or choose? | Customer applications using fixed APIs without provider selectionClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Customer-authorized applications use fixed REST interfaces. | Close API keys and OAuth permissions ↗API keys and OAuth appsChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Webhooks and a queryable event log support change extraction. | Close event log ↗Event formatChecked 2026-10-16 |
| How are integration limits disclosed? | Service-specific limits disclosed in runtime headersClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Endpoint budgets and rate-limit response headers guide backoff. | Close rate limits ↗Rate limits and response headersChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Lead JSON responses supply a customer-held record copy. | Close list leads ↗List Leads responsesChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. No retrieval window or export charge at cancellation is established by these technical sources. | Close API overview ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| How can customers define their own business logic? | Customer-editable native workflows or agent configurationsClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Sequences define native automated steps and have create/update APIs. | Close native sequences ↗Sequences; Create a Sequence; Update a SequenceChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Rights to native workflow artifacts and independent execution are not established. | Close API overview ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedClose REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. Documented lead records are portable; whole-product fidelity is unverified. | Close list leads ↗List Leads responseChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Lowest-plan API entitlement and fixed access fees
- Complete attachments/history and deletion recovery
- Native workflow rights and cancellation retrieval
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.