Skip to main content

Get started with the OData API

How to authenticate, understand rate limits, and construct your first OData query in Prospect CRM.

Written by Arthur Ashdown

Use the OData API to query and update your Prospect CRM data using standard web technologies. This guide covers everything you need to know to authenticate, understand rate limits, and start building queries. You'll need a Personal Access Token (PAT) to use the API.

If you're already familiar with OData and just need endpoint and data model details, refer to the API documentation instead.

📌 Note: Setting up third-party or custom integrations, including bespoke development using the API, is not covered by Prospect CRM Support. Users are responsible for implementing and managing their own integrations. For further assistance, consult external developers or technical resources.


What is OData

OData is a REST-based protocol for querying and updating data, built on standard technologies such as HTTP, Atom/XML and JSON. It is standardised by OASIS and is ISO/IEC approved.

Because the OData specification is standardised, any OData feed responds in the same way to the defined OData functions. This means you can use a consistent approach to query your CRM data regardless of the tool or language you're using.


Authenticate with the API

To access the Prospect CRM OData service, you need a Personal Access Token (PAT). To generate a token:

  1. Go to Integrations, then click Custom API Integration (OData API).

  2. Open the My Tokens section.

  3. Follow the steps to generate your PAT token.

The OData service uses bearer authentication. You need to add a bearer authorisation header to every request using a valid access token:

Authorization: Bearer [YOUR_PAT_TOKEN]

Warning: Your access token allows the same level of read and write access to the database as your user login. Treat it like a password. Never share it with anyone. If a colleague needs a token, they must generate their own. You can revoke a token at any time from the My Tokens section.


Understand the rate limit

API access is limited to 1,200 requests every 10 minutes using a 'Sliding Window' algorithm. The rate limit applies to your overall CRM workspace, not per token. If you have multiple PAT tokens, all requests across all tokens count towards the same limit.

If you exceed the limit, the API returns a 429 response code. The API does not queue requests, so you must retry any request that receives a 429 response.

How the Sliding Window algorithm works

The algorithm keeps a rolling log of request timestamps for your workspace. For each incoming request, the system:

  1. Checks the list of recent request timestamps for your workspace.

  2. Removes any requests older than 10 minutes from the count.

  3. Counts the remaining requests.

  4. Allows the request if the count is under 1,200, or returns a 429 response code if the limit is reached.

🤓 Tip: Build a retry process into your integration to handle 429 responses automatically.


Construct a query

Every OData query is made up of three parts:

  • Base URL: where your data lives.

  • Entity: the type of CRM record you want to access.

  • Parameters: the OData functions that filter, sort, and shape the data returned.

Example query

https://crm-odata-v1.prospect365.com/Contacts?$select=Title,Forename,Surname,Email,StatusFlag&$filter=contains(email,'@prospectsoft.com') and StatusFlag eq 'A'&$expand=Leads($select=Description,Created,StatusFlag;$filter=StatusFlag eq 'A' and Status/DeadFlag eq 0;$expand=Status($select=Description))

Base URL

The base URL tells the API where to retrieve data from. The Prospect CRM OData base URL is:

https://crm-odata-v1.prospect365.com/

🤓 Tip: You can use the unsecured OData test service at http://services.odata.org/V4/OData/OData.svc/ to practise queries without needing to authenticate.

Entity

The entity is the type of CRM record you want to access. Entities are generally the plural of the table name. You append the entity name directly after the base URL:

https://crm-odata-v1.prospect365.com/Contacts

To retrieve a specific record by ID, append the ID in parentheses after the entity name:

https://crm-odata-v1.prospect365.com/Contacts(272970)

Running a query without any filters returns all records for that entity. Retrieving large data sets takes a long time to complete. Wherever possible, retrieve only the data you need using smaller, filtered queries. To handle large data sets efficiently, the API uses server-driven paging. Each response includes a page of results and an @odata.nextLink if more data is available. Continue making requests to the @odata.nextLink until all records are retrieved.

Parameters

Parameters are OData functions that you chain after the entity using &. They let you select, filter, sort, and limit the data returned. For example:

https://crm-odata-v1.prospect365.com/Contacts?$select=ContactId,Forename,Surname&$top=50

For a full list of available OData functions and how to use them, see Query the OData API.

Replicate a report query

To replicate a report query, you can inspect the report's syntax using your browser's developer tools. Follow these steps:

  1. Run the report in the Prospect365 application.

  2. Open the browser's developer tools and navigate to the "Network" tab.

  3. Locate the request made by the report to view its syntax.

  4. Copy the syntax for use in API queries.

This method allows you to understand the structure of the report and use it as a basis for constructing your own queries.


Troubleshoot

401 Unauthorised error

A 401 Unauthorised error usually indicates a problem with your token. To resolve it:

  1. Check that your token is included in the Authorization header.

  2. Confirm the header uses the correct format: Bearer [YOUR_PAT_TOKEN].

  3. Check the token for any typos or extra spaces.

  4. Confirm you are not including the token in the URL itself.

  5. Confirm that the endpoint you are targeting supports the HTTP method (PATCH/POST) you are using. For example, endpoints like Contacts support write operations when authenticated correctly.

If the error persists, revoke the token and generate a new one from Integrations, then click Custom API Integration (OData API).

Notepad Entries via the API

The Notepad entity in Prospect CRM is a versatile tool for managing notes and linking them to specific contacts or activities. This guide explains how to create a General Note and retrieve Notepad entries with specific activity types using the API.

To create a General Note, use the Notepad entity:

  1. Endpoint: Use the POST /Notepads endpoint.

  2. Required Fields: - Text: The body of the note (content of the note). - ContactId: Links the note to a specific contact. - DivisionId (optional but recommended): Ensures the note appears at the company level as well.

Using the Notepad entity avoids OData errors that occur when attempting to set note fields on the Contact type.

To retrieve Notepad entries associated with a specific Activity History type (e.g., "Customer Meeting"), follow these steps:

  1. Identify the Activity Type Code:

    • Use the GET /InteractionTypes endpoint to find the SpokeCode for the desired activity type.

    • Example query: GET /InteractionTypes?$filter=Description eq 'Customer Meeting'&$select=SpokeCode,Description - Note: The SpokeCode is tenant-specific.

  2. Filter Notepad Entries:

    • Use the GET /Notepads endpoint to filter entries by the SpokeCode retrieved in Step 1.

    • Example query: GET /Notepads?$filter=SpokeHistory/SpokeCode eq 'THE_CODE_FROM_STEP_1'&$select=Text,Created,ObjectType,ObjectId&$expand=CreatedByUser($select=UserName),SpokeHistory($expand=Spoke($select=Description))&$orderby=Created desc

Did this answer your question?