OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Core API contact collections return JSON.
Front list contacts ↗
List contacts · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
page_token traversal supports up to 100 contacts per page.
Front list contacts ↗
Query Params · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
q supports updated_after/updated_before and documented timestamp sorting.
Front list contacts ↗
q; sort_by; sort_order · Checked 2026-10-16
Access cost barrier -
-
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges.
Front list contacts ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 10.0/10
Customer authorization without discretionary provider approval
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
The guide explicitly permits integrations for a single Front customer through a generated token.
Front token and OAuth access ↗
OAuth v Front API Tokens · Checked 2026-10-16
Downstream permission -
-
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
The reviewed technical documentation does not establish contractual permission for the declared downstream processing.
Front list contacts ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 2.5/10
Named operations in a limited domain
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Create Contact is documented with contacts:write; a separate update operation was not verified here.
Front create contact ↗
Create contact; contacts:write · Checked 2026-10-16
Custom application path 10.0/10
Customer applications using fixed APIs without provider selection
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
A customer/single-customer integration can use a token without public distribution.
Front token and OAuth access ↗
OAuth v Front API Tokens · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Contact updated-time filters support change polling.
Front list contacts ↗
q · Checked 2026-10-16
Limit visibility 10.0/10
Published numeric quotas and recovery instructions
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Plan/auth-specific budgets, quota headers and Retry-After recovery are published.
Front rate limits ↗
Standard rate limits; Monitor your rate limit; Additional rate-limiting · Checked 2026-10-16
CDC and deletion capture 5.0/10
Updates identified; deletion capture not established
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Updated contacts can be polled; hard-delete capture is unverified.
Front list contacts ↗
q updated_after · Checked 2026-10-16
Replay and gap recovery 2.5/10
Rebuild from a fresh snapshot; no historical replay established
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Repeat full contact pagination to rebuild the current authorized collection; no historical/deleted payload recovery established.
Front list contacts ↗
List contacts · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Contact response records leave through authorized token requests.
Front list contacts ↗
200 Array of contacts · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
No retrieval window or export charge at cancellation is established by these technical sources.
Front list contacts ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Portable contact records within token scope; whole-product history/files unresolved.
Front list contacts ↗
List contacts · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 5.0/10
Customer-editable native workflows or agent configurations
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Customer rules can respond to application events under documented native trigger constraints.
Front application triggers ↗
Using application triggers in rules; Limitations · Checked 2026-10-16
Rights to custom logic -
-
Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct.
Rights to native workflow artifacts and independent execution are not established.
Front list contacts ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Bearer tokens come from account settings or OAuth. A token selects global/shared/private resource namespaces, and teammates separately enable access to private resources.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
Company and team contact lists use page_token and limits up to 100. updated_after/updated_before filters and timestamp ordering support bounded contact polling.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer or single-customer integration token | API key | Customer | No | settings bearer token with selected resource/namespace permissions; private access needs teammate enablement | 2026-10-16 |
| Public integration OAuth | OAuth 2.0 | Integration provider | Not confirmed | public integrations require oauth unless provider grants an exception; exact review criteria unresolved | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
The rate-limit guide lists Starter 50, Professional 100 and Enterprise 200 requests/minute. Partner OAuth has a separate 120/minute company budget; this does not establish the complete fixed API fee schedule.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
Create Contact requires contacts:write. Contact custom-field updates can erase omitted fields, so retrieve current custom fields and preserve unaffected values before mutation.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Contact updated-time queries support repeatable polling and current-state rebuilding. A retained delete stream and durable historical replay were not established for this scope.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates identified; deletion capture not establishedFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Updated contacts can be polled; hard-delete capture is unverified. | Front list contacts ↗q updated_afterChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Rebuild from a fresh snapshot; no historical replay establishedFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Repeat full contact pagination to rebuild the current authorized collection; no historical/deleted payload recovery established. | Front list contacts ↗List contactsChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Authorized contact JSON is portable. Contacts do not establish complete conversations, attachments or native rule export; post-cancellation access remains unresolved.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
Customers can write integrations against the fixed Core API. Front also documents rule triggers, but native definition rights and independent execution remain unverified (external client code alone earns no native portability).
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Core API contact collections return JSON. | Front list contacts ↗List contactsChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. page_token traversal supports up to 100 contacts per page. | Front list contacts ↗Query ParamsChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. q supports updated_after/updated_before and documented timestamp sorting. | Front list contacts ↗q; sort_by; sort_orderChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Customer authorization without discretionary provider approvalFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. The guide explicitly permits integrations for a single Front customer through a generated token. | Front token and OAuth access ↗OAuth v Front API TokensChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges. | Front list contacts ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. The reviewed technical documentation does not establish contractual permission for the declared downstream processing. | Front list contacts ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| Which external write operations are documented? | Named operations in a limited domainFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Create Contact is documented with contacts:write; a separate update operation was not verified here. | Front create contact ↗Create contact; contacts:writeChecked 2026-10-16 |
| How can customers connect an application they build or choose? | Customer applications using fixed APIs without provider selectionFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. A customer/single-customer integration can use a token without public distribution. | Front token and OAuth access ↗OAuth v Front API TokensChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Contact updated-time filters support change polling. | Front list contacts ↗qChecked 2026-10-16 |
| How are integration limits disclosed? | Published numeric quotas and recovery instructionsFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Plan/auth-specific budgets, quota headers and Retry-After recovery are published. | Front rate limits ↗Standard rate limits; Monitor your rate limit; Additional rate-limitingChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Contact response records leave through authorized token requests. | Front list contacts ↗200 Array of contactsChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. No retrieval window or export charge at cancellation is established by these technical sources. | Front list contacts ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| How can customers define their own business logic? | Customer-editable native workflows or agent configurationsFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Customer rules can respond to application events under documented native trigger constraints. | Front application triggers ↗Using application triggers in rules; LimitationsChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -Front Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Rights to native workflow artifacts and independent execution are not established. | Front list contacts ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedFront Core API company/team contact collections and mutations; customer/single-customer API tokens and public OAuth distribution are distinct. Portable contact records within token scope; whole-product history/files unresolved. | Front list contacts ↗List contactsChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Lowest-plan API entitlement and fixed access fees
- Complete attachments/history and deletion recovery
- Native workflow rights and cancellation retrieval
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.