All integrations

Firmao

BUSINESS · CRM & SUPPORT

Customers, contacts, projects, tasks, offers, and transactions in the CRM they connected.

Connecting Firmao in practice

Firmao’s API is switched off until someone enables it in the company settings tab, and the specification is published only as a PDF download — there is no HTML reference, no OpenAPI document and no endpoint list a tool can read, so the integration surface has to be transcribed by hand.

Who has to approve

The API is "activated with a single click in the company settings tab", so it is a company-level switch rather than a per-user consent: until whoever administers the Firmao account turns it on, no credential works at all.

Worth knowing

  • The only published specification is a PDF on the API page, and Firmao points integrators at contact@firmao.io for anything it does not cover. Nothing about rate limits or authentication appears on a public page.
  • The old firmao.net domain 301-redirects to firmao.io, so bookmarked documentation links and any hardcoded host from an older integration need rewriting.

Checked against Firmao API (2026-09-29), Firmao API (English) (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

firmao_delete_by_objecttype_by_idWRITE

Delete object via DELETE /{objectType}/{id}

api
firmao_get_contactsREAD

List contacts via GET /contacts

api
firmao_get_customergroupsREAD

List customer groups via GET /customergroups

api
firmao_get_customersREAD

List customers via GET /customers

api
firmao_get_documentsREAD

List documents via GET /documents

api
firmao_get_invoicenumbersREAD

List invoice numbers via GET /invoicenumbers

api
firmao_get_invoicenumbers_nextREAD

Get next invoice number via GET /invoicenumbers/next

api
firmao_get_offersREAD

List offers via GET /offers

api
firmao_get_productsREAD

List products via GET /products

api
firmao_get_projectsREAD

List projects via GET /projects

api
firmao_get_salesnotesREAD

List sales notes via GET /salesnotes

api
firmao_get_storagedocsREAD

List storage docs via GET /storagedocs

api
firmao_get_tasksREAD

List tasks via GET /tasks

api
firmao_get_transactionentriesREAD

List transaction entries via GET /transactionentries

api
firmao_get_transactionsREAD

List transactions via GET /transactions

api
firmao_post_agreementsWRITE

Create agreement via POST /agreements

api
firmao_post_contactsWRITE

Create contact via POST /contacts

api
firmao_post_customersWRITE

Create customer via POST /customers

api
firmao_post_offersWRITE

Create offer via POST /offers

api
firmao_post_productsWRITE

Create product via POST /products

api
firmao_post_projectsWRITE

Create project via POST /projects

api
firmao_post_salesnotesWRITE

Create salesnote via POST /salesnotes

api
firmao_post_tasksWRITE

Create task via POST /tasks

api
firmao_post_timeentriesWRITE

Create time entry via POST /timeentries

api
firmao_post_transactionsWRITE

Create transaction via POST /transactions

api
firmao_put_by_objecttype_by_idWRITE

Update object via PUT /{objectType}/{id}

api
firmao_put_customers_by_idWRITE

Update customer via PUT /customers/{id}

api
firmao_put_products_by_idWRITE

Update product via PUT /products/{id}

api
firmao_put_timeentries_by_idWRITE

Update time entry via PUT /timeentries/{id}

api

Put Firmao behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.