Insightly API: Endpoints, Limits & Use Cases
The Insightly API is a RESTful web service that lets developers read and write Insightly CRM data through documented endpoints, from contacts to opportunities, over secure HTTPS. It covers the core objects your team already uses, applies daily rate limits tied to your plan, and authenticates with a single API key. Most teams use it to sync records, automate workflows, and power reports that live in other tools.
Why our Insightly API guidance holds up:
We’re a vendor-neutral CRM agency with 30 specialists and over 1,200 integrations built and maintained across 14 platforms. We’ve connected Insightly to billing, marketing, and support systems on real projects, so this comes from practice, not the docs alone.
Need a hand with your Insightly API project?
Getting endpoints, limits, and auth right takes reps, and one botched sync can scramble records fast. If you’d rather skip the trial and error, get in touch for Insightly consulting shaped around your stack.
What is the Insightly API, and What Can you Build with It?
The Insightly API is a public REST interface for reading and writing your CRM records over HTTPS. You can build two-way syncs, custom dashboards, automated data entry, and integrations that push Insightly data into the tools your team relies on.
In practice, most builds fall into a few buckets. We see contact and lead syncs most often, then opportunity reporting and automated record creation from web forms.
If you’re still weighing the CRM itself, our guide to what Insightly does is a better place to start than the API. The API assumes you already know which objects matter to your workflow.
Every build talks to the same set of core objects. These are the endpoints you’ll touch most, each mapping to a record type inside Insightly.
| Object | Endpoint | Typical use |
|---|---|---|
| Contacts | /Contacts | Individual people records |
| Organisations | /Organisations | Company records |
| Opportunities | /Opportunities | Deals in the pipeline |
| Projects | /Projects | Post-sale delivery work |
| Leads | /Leads | Unqualified inbound interest |
| Tasks | /Tasks | Follow-ups and to-dos |
Worth knowing: the API mirrors your Insightly permissions, so a call only ever returns the records the key’s owner can already see. That makes it safer to expose, but a limited user account will quietly return partial data.
Is the Insightly API Open, Public, or Private?
The Insightly API is public but gated, not open. Any paying customer can call it with their own key, though access does depend on which Insightly pricing plans you’re on.
There’s no anonymous or open access, and scope always follows the account behind the key. Think of it as documented and available rather than free for anyone to poke at.
You won’t apply for partner approval to reach your own data. That keeps simple integrations quick to stand up.
The API Types Insightly Actually Offers
Insightly offers one API type that matters, a modern REST API that returns JSON. It skips the separate SOAP, Bulk, and Streaming APIs found on heavier tools, a gap our Insightly and Salesforce writeup calls out.
That single surface keeps things simple. REST covers your reads and writes, while webhooks push changes out to a URL you control.
| API style | Available in Insightly? | What to reach for instead |
|---|---|---|
| REST | Yes, the core v3.1 API | Use it for all reads and writes |
| SOAP | No | Use the REST endpoints |
| Bulk | No dedicated bulk API | Paginate and queue REST calls |
| Streaming | No streaming API | Use webhooks for event pushes |
How do you Turn on API Access Inside Insightly?
API access is on by default on paid Insightly plans, so there’s no feature to switch on. You grab your key from user settings, note your region URL, and start calling.
Smaller shops sometimes land on a tier that limits API use, so confirm fit if you run Insightly at a startup. The key itself sits under User Settings in your profile area.
Copy it once and store it somewhere safe. Treat it like a password, because it carries your full access.
Finding the API Version your Account Runs
Your Insightly API version lives right in the request URL, and the current one is v3.1. If a call points at an older path like v2.2 or v3.0, that number tells you which version your integration is speaking.
There’s no hidden setting to hunt for. Whatever version string sits in your base URL is the version you’re on, which makes audits quick.
How do you Authenticate with the Insightly API?
You authenticate with your API key over HTTPS using Basic Auth, where the key is the username and the password stays blank. Insightly encodes that into an Authorization header, so there’s no token exchange to manage.
This trips up developers arriving from CRMs that lean on OAuth. Our Insightly next to HubSpot piece covers more of those setup differences.
Why there’s no OAuth step
The standard API skips OAuth entirely, so there’s no consent screen or refresh cycle to build. You base64-encode the key, drop it in the header, and each call authenticates on its own, which means it does not use OAuth at any point.
How do you Send your First Insightly API Call?
Your first call is usually a GET against the Contacts endpoint to confirm the key works. A clean response with your records means auth, region, and version all line up.
Keep this first test read-only so nothing breaks, and if you’re unsure which records to pull, our rundown of Insightly’s core features maps the objects worth syncing. Once a GET returns data, writes will authenticate the same way.
A safe first request
- Copy your API key from user settings and base64-encode it for the header.
- Set your base URL to your region, for example api.your-pod.insightly.com/v3.1.
- Send a GET request to the /Contacts endpoint with the Authorization header.
- Check for a 200 response and a JSON list of records before writing anything.
If any step returns an error instead of data, the status code tells you which one to fix first. We cover those a little further down.
How do you Connect Insightly to Other Tools Through the API?
You connect Insightly to other tools by having each system read from and write to the API, through code or an integration service. Most teams sync contacts, deals, and activities so the CRM never drifts out of date.
Insightly’s own integrations documentation lists native connections to tools like QuickBooks, MailChimp, and Zapier, and its AppConnect layer extends that to over 1,000 additional integrations. For the ones that connect with the least effort, our list of Insightly integrations beats building each one by hand.
Code or a connector?
Direct API code gives you the most control over field mapping and edge cases. A connector trades some of that flexibility for speed, which suits teams without spare developer time.
Pick based on volume and how odd your data is. Clean, standard records favor a connector, while custom logic favors code.
Insightly API Rate Limits, Quotas, and Call Costs
Insightly caps API use two ways: a burst limit of 10 requests per second on every plan, and a rolling daily quota that scales with your tier. Per Insightly’s own API documentation, that daily allowance runs from 1,000 requests on the Free tier up to 100,000 on Enterprise, and you don’t pay per call since access rides on your subscription.
Cross either limit and the API returns a 429 response until the window resets. Staying inside the quota also protects the data behind Insightly’s ROI once integrations run, and in our work, mid-tier daily quotas handle steady syncs, while only heavy migrations force us to pace calls.
Reading the rate-limit headers
Every response carries headers that report your limit and your remaining calls. Watch them in your logs, and you’ll see a spike coming before it turns into a 429.
Rule of thumb: design as if every call counts, cache what rarely changes, and only pull fresh data when you truly need it. Teams that respect the quota from day one almost never hit a wall as they grow.
How do you Debug Common Insightly API Errors?
You debug Insightly API errors by reading the HTTP status code first, since it points straight at the cause, from a bad key to a tripped rate limit. Most issues fall into four buckets you’ll learn to spot fast.
Start with the status code, then the response body, then your own logs. That order solves most problems before you touch fixing Insightly errors at the app level.
Error #1: 401 Unauthorized
This means auth failed. Re-check that the API key is current and base64-encoded, and that you’re sending it as the Basic Auth username.
Error #2: 400 Bad Request
The request body is malformed. Validate your JSON and confirm every field name matches the object you’re writing to.
Error #3: 404 Not Found
The record or path doesn’t exist. Double-check the object ID and that your URL uses the right version and endpoint.
Error #4: 429 Too Many Requests
You’ve hit the quota. Slow the call rate, add backoff, and spread heavy jobs across a longer window.
| Status code | What it means | First thing to try |
|---|---|---|
| 400 | Bad request, malformed body | Check the JSON and field names |
| 401 | Authentication failed | Re-check the key and Basic Auth header |
| 403 | Not allowed for your plan or role | Confirm permissions and plan level |
| 404 | Record or endpoint not found | Verify the object ID and URL path |
| 429 | Too many requests | Slow down and respect the daily quota |
| 500 | Insightly-side error | Retry with backoff, then contact support |
Insightly API Security Basics Every Team Should Know
API security with Insightly starts with protecting the key, since it carries the same access as the user behind it. Treat it like a credential, scope it to a limited service account, and never ship it in client-side code.
- Least privilege run integrations under a user with only the access they need.
- Rotation regenerate the key on a schedule and whenever someone leaves.
- Transport call only over HTTPS so the key never travels in the clear.
- Storage keep keys in a secrets manager, not in code or spreadsheets.
These basics sit inside a bigger picture, which our overview of Insightly security lays out across the wider app. The API is only as safe as the account it runs under.
Keep in mind: a leaked API key is a data breach, not a minor slip, because it can read and change records at will. If a key ever lands somewhere public, revoke it first and investigate second.
When Should you Batch Calls Instead of Firing Them One by One?
You batch when you’re moving many records at once, because Insightly has no bulk API and thousands of single calls will hit your daily limit. The same care matters when you push scoring through Insightly’s AI features.
Batching here means paginating reads, queuing writes, and spacing requests to stay under quota. Two modes cover most needs.
Two ways to fire calls
Which one you choose depends on volume and timing. Real-time actions and bulk jobs pull in opposite directions.
Best for one-record, real-time actions like creating a contact from a form. Low volume, instant feedback, and easy to debug.
Best for nightly syncs and migrations. Loop with pagination, add short pauses, and log progress so a failure resumes cleanly.
How do you Test Insightly API Calls Without Touching Production?
Insightly doesn’t offer a separate sandbox, so the safest test route is a free trial account or a spare instance kept only for development. That gives you a real API to hit without risking live records.
We always dry-run writes against throwaway data before pointing a script at a client’s real CRM. A single bad loop can create hundreds of junk records in seconds.
Two safe test setups
Both give you a real API to hit without risking a client’s live data. Pick whichever your plan and time allow.
Spin up a free trial account as a throwaway instance. It behaves like production, so scripts you prove here will work live.
If a second instance isn’t possible, restrict early tests to GET calls. Reads can’t corrupt anything, so they’re safe to run against real data.
How do you Upgrade the API Version of an Insightly Integration?
You upgrade by pointing your calls at the newer version string in the URL, then testing every affected request before you switch for good. Because the version lives in the path, the change itself is small, but the fields behind it can shift.
Read the release notes for anything renamed or removed, and for larger cutovers our Insightly data migration work treats it like a mini data move. Run the new version against test data first.
Keep the old path ready as a fallback until you’re confident. Switch for good only once the new calls pass end to end.
How do you Keep an Insightly API Integration Running at Scale?
Keeping an integration healthy at scale comes down to monitoring, retries, and respect for the rate limit. The goal is an integration that recovers on its own instead of paging someone at every hiccup.
- Backoff retry failed calls with growing delays, not instant loops.
- Logging record every request and response so you can trace a bad sync.
- Alerting flag repeated 429s and 500s before users notice.
- Quota budget leave headroom under the daily limit for spikes.
Most of these habits overlap with wider CRM hygiene, which our notes on Insightly best practices cover in more depth. Good API discipline and good CRM discipline tend to be the same discipline.
Bottom line: a resilient Insightly integration assumes calls will fail and plans for it, rather than hoping they won’t. Build in retries, watch your quota, and log enough to debug at three in the morning without guessing.
Insightly API FAQ
Disclaimer: This article is for general guidance only and is not technical, legal, or professional advice. API behaviour, plan limits, and pricing can shift over time, so confirm the current specifics with Insightly before you build against them. SuvoCRM works as an independent, vendor-neutral consultancy that has no affiliation with Insightly and no endorsement from it.