API review

Twenty API review

Open-source (AGPL), API-first CRM: per-workspace generated REST + GraphQL APIs (core and metadata), 60-record batch calls with GraphQL batch upsert, HMAC-signed webhooks, a native MCP server, Cloud from $9/user/month or free self-hosted. Best for teams that want to own/self-host their CRM and still get REST, GraphQL, webhooks and MCP.

Verified 25 Oct 2026 · 6 endpoints listed · Official MCP server

See pricing

Twenty API docs

What a call costs

The actions you pay for, as Twenty prices them.

Action	Cost	Per
Standard workflow step (search, create or update records)	$0.0001	per step (10,000 per credit)
App logic function run	$0.0001 + $0.0001 per second of runtime	per invocation
AI usage	model provider's published token rates, converted to credits	per action
Extra credit packs	bought in Settings > Billing > Increase (price per pack not published)	per pack

Pricing, plan by plan

US dollars, as Twenty's pricing page shows them on 25 Oct 2026. Monthly and annual billing are shown apart.

Free tier Self-hosted Free: $0 with all Pro features (community support). No free cloud plan. Cloud trial: the pricing page says '30-day trial... without credit card', but in the app (2026-10-25) the 30-day trial needs a card; without a card you get a 7-day Pro trial ('Basic without credit card · 7 days') with 0.5 trial credits

Cloud Pro

$12/mo

billed monthly

$9/mo

billed annually

per user/month; credits depend on billing cycle, not plan: 5/month on monthly billing, 50/year on yearly (1 credit = $1 of usage; unused credits roll over, capped at one period); in-app check: 1 seat x $12 = $12/month

API included

Plan details

usage credits for workflows/AI

Cloud Organization

$25/mo

billed monthly

$19/mo

billed annually

per user/month; adds row-level permissions, SAML/OIDC SSO, custom domain, audit logs, encryption key rotation, priority support, 100 API calls/min; same cycle-based credits

API included

Enterprise

Custom quote

from $50k/year; single-tenant isolation, IP allow-listing, SCIM, security review & DPA, dedicated support & SLA; API calls custom

API included

Self-hosted Organization

$25/mo

billed monthly

$19/mo

billed annually

per user/month Organization key for self-hosted instances (SSO, row-level permissions, private source code, unlimited workspaces)

API included

Rate limits

Sources differ: the API page and import guide say 100 requests/minute and 60 records per batch call (~6,000 records/min, 600 ms between sustained calls, back off on 429); the pricing table says API calls 50/minute on Pro, 100/minute on Organization, custom on Enterprise.

Limit	Cloud Pro	Cloud Organization	Enterprise
Per Minute	50	100	Custom

How to get an API key

Twenty uses API key. The steps below follow Twenty's own docs.

Create a Twenty account. API access starts on the Cloud Pro plan.
Settings > Developers > API > + Create key: name, role (default Admin) and expiration (default Never); the key (a ~444-character JWT in our test) is shown once. Roles can be assigned under Settings > Members > Roles. OAuth for third-party apps
Send it with every request: header: Authorization: Bearer <api_key>.
Make a first call: Create records (e.g. POST /rest/people, /rest/companies); REST and GraphQL both batch up to 60 records per request. Unique fields (People email, Companies domain) reject duplicates with 400. Keep the key in an environment variable, never in the command.
```
curl -X POST "https://api.twenty.com/rest/{objectPlural}" \
  -H "Authorization: Bearer $TWENTY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
```

Where the docs live

What	Where
Documentation	docs.twenty.com
API reference	docs.twenty.com/developers/extend/api
OpenAPI spec	twenty.com/llms.txt
llms.txt	docs.twenty.com/llms.txt
Changelog	twenty.com/releases
Base URL	`https://api.twenty.com`
MCP server	`https://{your-workspace-url}/mcp`
SDKs	twenty-sdk (Apps SDK, not a data-API client)

Strengths and limits

Where it fits

Teams that want to own/self-host their CRM and still get REST, GraphQL, webhooks and MCP
Unique email (People) and domain (Companies) enforced at the database level, so API upserts cannot create duplicates
Unlimited custom objects and fields on every plan
Agent access via the workspace's own /mcp endpoint (OAuth 2.1 or API key)

Where it falls short

High-volume syncs: 50 requests/minute on Cloud Pro (100 on Organization), 60 records per batch
Teams that need hundreds of pre-built integrations or a native HubSpot importer
Free cloud use: no free cloud plan; free only when self-hosted

Worth knowing

Rate-limit sources conflict (docs 100/min vs pricing table 50/min on Pro). Sources: docs.twenty.com/user-guide/data-migration/how-tos/import-data-via-api; twenty.com/pricing
Base URL: the docs give api.twenty.com (Cloud) and {your-domain} (self-host), with /rest, /graphql, /rest/metadata and /metadata as path prefixes; twenty.com/llms.txt gives {workspace}.twenty.com/rest. Our test: both api.twenty.com and onegtmlab.twenty.com returned the same data with the same key.
Soft-deleted records (UI: Command Menu > See deleted records) still count for uniqueness and are restored by a matching import. But a REST DELETE with an API key was a permanent delete in our test, so the domain was free immediately.
Contact auto-creation from email sync also creates companies from email domains (unique domain prevents duplicates, but junk companies are possible). Source: docs.twenty.com user-guide calendar-emails overview
Webhooks are created in the UI (Settings > Developers > Webhooks), fire on every create/update/delete of every object (no event filtering yet), and are signed. The inbound workflow webhook trigger is a unique URL; its setup page documents no authentication, so treat the URL as the secret or call the REST API with a key. Sources: docs.twenty.com/developers/extend/webhooks; docs.twenty.com/user-guide/workflows/how-tos/connect-to-other-tools/set-up-a-webhook-trigger

4 moreShow fewer

Batch-size sources differ: the API page and import guide say up to 60 records per call; the Apps good-practices page's example is 'a createMany with upsert: true carrying 200 records is one request' with a 500 requests/minute per-app budget. Test the real cap. Sources: docs.twenty.com/developers/extend/api; docs.twenty.com/developers/extend/apps/getting-started/good-practices
Companies' domain is the composite field domainName.primaryLinkUrl in the API payload, not a flat 'domain'.
Trial: without a card the cloud trial is 7 days of Pro; the 30-day trial advertised on the pricing page needs a card in-app.
Integrations: Zapier is listed as a native connection method; Make and n8n are named only as no-code tools that reach Twenty through webhooks and the API (no native app verified). Sources: docs.twenty.com/getting-started/core-concepts/calendar-and-email; docs.twenty.com/llms-full.txt (webhook trigger guide)

Our take

We evaluated Twenty as a CRM for our own team: in our comparison of free CRMs, the self-hosted edition, free with all Pro features, was the fallback after Attio. What we value is that unique emails on people and unique domains on companies are enforced at database level, since duplicate-free records are a hard requirement for us.

Who should use it

Use Twenty for: Teams that want to own/self-host their CRM and still get REST, GraphQL, webhooks and MCP
Look elsewhere for: High-volume syncs: 50 requests/minute on Cloud Pro (100 on Organization), 60 records per batch

If Twenty is not the answer

Other CRM tools in this directory, each with its own review.

HubSpot

CRM

From $20/moOfficial MCP

Best for system of record for contacts/companies/deals when the client already runs HubSpot.

HubSpot API review

Attio

CRM

Free planOfficial MCP

Best for start-ups and agencies wanting a free/cheap CRM with API, webhooks and MCP on every plan.

Attio API review

CRM

From $9/moOfficial MCP

Best for inside-sales teams that call and email from the CRM.

Close API review

Before you build

Four things to settle first, each read off Twenty's own pages.

Confirm the API is on your planAPI access starts on the Cloud Pro plan. Free tier: Self-hosted Free: $0 with all Pro features (community support).
Keep the key out of your codeAPI key. It is sent as: header: Authorization: Bearer <api_key>.
Design around the rate limitSources differ: the API page and import guide say 100 requests/minute and 60 records per batch call (~6,000 records/min, 600 ms between sustained calls, back off on 429); the pricing table says API calls 50/minute on Pro, 100/minute on Organization, custom on Enterprise.
Know the catch before you scaleRate-limit sources conflict (docs 100/min vs pricing table 50/min on Pro). Sources: docs.twenty.com/user-guide/data-migration/how-tos/import-data-via-api; twenty.com/pricing

Want us to build it for you?

Tell us what you want Twenty to do in your stack. We will show you how we would wire it into your data, outbound or CRM, and what we would check first.

Book a call

See case studies

Read from twenty.com/pricing and docs.twenty.com/developers/extend/api. Verified 25 Oct 2026.

All 6 endpointsFor developers: method, path, what it does and what it costs.

Base URL: api.twenty.com

Bulk and async: Batch up to 60 records per REST/GraphQL call; GraphQL batch upsert; CSV import recommended under 10k-50k rows. Source: docs.twenty.com/user-guide/data-migration/how-tos/import-data-via-api

Webhooks: Yes, created in the UI (Settings > Developers > Webhooks; no documented API endpoint). POST on every create/update/delete of any object, custom objects included; no event filtering yet; payload {event, data, timestamp}; HMAC-SHA256 in X-Twenty-Webhook-Signature over '{timestamp}:{JSON payload}' with X-Twenty-Webhook-Timestamp; non-2xx is logged as a failure. Inbound: workflow webhook trigger URL. Source: docs.twenty.com/developers/extend/webhooks

Filter endpoints

6 endpoints

Method	Path	What it does	Cost
POST	`/rest/{objectPlural}`	Create records (e.g. POST /rest/people, /rest/companies); REST and GraphQL both batch up to 60 records per request. Unique fields (People email, Companies domain) reject duplicates with 400	none
GET	`/rest/{objectPlural}`	List/filter records with fields and depth params	none
POST	`/graphql`	GraphQL batch upsert: plural create mutations (createPeople, createCompanies,...) with upsert: true update the record matched on a unique field (email, domain or any field marked Unique) instead of creating a duplicate	none
POST	`/rest/metadata/objects`	Create (POST) or list (GET) custom objects programmatically (Metadata API; GraphQL equivalent at /metadata)	none
POST	`/rest/metadata/fields`	Create fields (and relations) on an object programmatically (Metadata API)	none
DELETE	`/rest/{objectPlural}/{id}`	Delete a record. In our test with an API key this was a PERMANENT delete: no soft-deleted row remained and the unique domain was immediately free	none