Skip to main content

​
About

The Goliath developer API lets your own code — servers, scripts, AI agents, or third-party tools — read and write the same data you work with in the app: contacts, properties, deals and pipelines, workflow automations, forms, and team settings. There is one HTTP endpoint. You never send GraphQL or build queries — instead you call a named operation from a fixed catalog (an operationId) with its variables, and Goliath executes a pre-authored, pre-reviewed request on your behalf. Every call runs as the key’s owning user, so your real organization permissions and visibility apply — the API can never see or touch anything you couldn’t see in the app yourself.
Live in productionThe developer API is live: create and scope a key in the app under Settings → API Keys and call the production endpoint below — no enrollment or approval step. The server also publishes its own always-current reference: GET /api/v1/help (no auth required) renders full documentation for every operation, generated from the running API.
Looking for something simpler?If all you need is programmatic skip tracing, the standalone Skip Trace API is a single-purpose REST endpoint with its own key. To receive data from Goliath instead of calling in, see the Contact Webhook Payload reference.

​
Generating an API key

  1. Open API Keys. From the app, go to Settings → API Keys (also reachable from the API Keys card on the Integrations page). Independent-operator seats cannot create API keys.
  2. Create a key. Keys are personal — each key belongs to your user and acts as you. Create one key per host or device so you can revoke them independently.
  3. Pick scopes. Each key carries one or more scopes (see below). ADMIN can only be granted to a key whose owner is a team admin.
  4. Store the secret. The key looks like gsk_.... Pass it as a Bearer token on every request and keep it in your secrets manager — never ship it in a browser, mobile app, or any client-side code.

​
Scopes

Scopes decide what kind of operation a key may run. Which specific records it may touch is a separate check — see Authorization for how organization ownership and the two kinds of 403 work.

​
Making a request

(POST /api/v1/graphql is the same endpoint under its original name and stays supported — despite that path, it does not accept GraphQL queries either.) A handled request always returns 200 with a GraphQL-style body:
Transport, authorization, and subscription problems use HTTP status codes instead:
Subscription accessAn organization without a usable plan receives 402 subscription_inactive before data operations execute. The Billing API reads, getMyProfile, and getIntegrationSetupUrls remain available for recovery, subject to their normal scopes. Repeated refused calls can return 429 rate_limited with Retry-After; stop the retry loop and restore the subscription in the app.

​
Result limits & truncation

Capped list/search operations declare a result cap — a maximum number of rows requested per call. If you send a limit larger than the cap, the gateway silently clamps it before execution: the operation runs with the capped limit and returns up to that many rows, without a limit error. The gateway does not trim the response after execution. Most list operations are fully pageable — they take an offset (or a cursor) and return a totalCount and/or hasMore, so you can walk the whole result set a page at a time. Prefer these when you need everything:
Some capped operations have no paginationThese have no offset/cursor, so rows beyond the cap can’t be retrieved:
  • listTeammates (default 20, cap 50) — searches active teammates; use listTeamMembers for the paginated roster, including suspended members.
  • listFormActivityLocations (cap 500) — returns no total; treat a full page (exactly the cap) as “possibly more, narrow it.”
  • searchCities and searchCounties (cap 10 each) — refine the search term, including the state, to find the location you need.
listAppointments and listMyTasks support forward cursor pagination (default 25, cap 50). When canFetchNext is true, keep the same filters and set cursor to the last returned row’s id. Repeat until false; restart without a cursor to revisit earlier rows. Their total is the unpaged match count.

​
Discovering operations

The full operation catalog is machine-readable — ideal for AI agents and for keeping your integration in sync:
  • The list returns one-line summaries of every operation.
  • The detail view returns the full variable schema, the exact response shape, and a copy-pasteable example for one operation.
  • authorized reflects your key’s scopes, so a caller sees exactly what it is allowed to run.
Operations behind an organization feature gate are omitted when unavailable to your key. Their detail endpoint returns 404 unknown_operation, and calling their id returns 400 unknown_operation.

​
Operation reference by area

The catalog is documented alongside each feature’s user guides:
  • Properties API — search properties, count signal events, author CONTACT/PROPERTY/DEAL filters, manage filter folders, and organize lists
  • Contacts API — read, create, update, and enrich contacts, find duplicate groups, and manage contact filters
  • Deals API — search and filter deals, read open-task counts, edit custom fields, and manage Scraper Health cards
  • Pipelines API — manage pipeline structure and read pipeline analytics
  • Workflows API — manage automations and runs across contact, deal, property, appointment, and event domains; set live sending schedules, bulk-enroll contacts, restore archived workflows, and apply task templates and sets
  • Content Templates API — manage message, task, and task-set templates and folders
  • Forms API — manage lead-capture forms and read form analytics
  • Communications API — read and triage inbox threads, read recordings and transcripts, manage suppressions, and render templates
  • Notifications API — read your notification feed and mark items read
  • Appointments API — check live calendar conflicts, schedule appointments, manage SMS reminders, and configure availability
  • Tasks API — create, reschedule, and complete CRM to-do tasks
  • Skip Trace API — run skip traces from your own systems
  • Bulk Tasks API — poll the status of long-running bulk jobs
  • Team API — roster, role changes, member suspension/restoration, invitations, live text/call counts, and nightly analytics
  • Account API — your profile, permissions, integration status and disconnection, and setup links
  • Billing API — subscription dates, plan allowances, AI usage warnings, credit balances, and fixed credit packs

​
Capabilities managed in the app

Use the app for capabilities outside the public operation catalog:
  • File uploads — importing contacts, properties, or skip-trace lists from a CSV.
  • Outbound SMS and email — send from the app, where a person supplies the required per-contact consent attestation. Workflow enrollment and automatic appointment reminders have their own operations described above.
The discovery endpoint is always the source of truth for what your key can call right now — if an operation isn’t listed there, don’t assume your key can call it.