Agentic Fabriq
Kommo
BUSINESS · CRM & SUPPORT
Leads, contacts, pipelines and chat conversations in the CRM they connected.
Connecting Kommo in practice
Kommo allows "not more than 7 requests per second" and escalates rather than just throttling: repeated violations get the IP blocked, after which every call returns 403 instead of 429, so the failure mode looks like a permissions bug. Requests must also go to the account’s own subdomain rather than kommo.com, and an integration can only be installed by an account administrator.
Scopes that draw scrutiny
Access to account data based on the user rightsKommo’s own permission group wording. It is not a fixed grant: what the token can see depends on the rights of whoever authorised it, and an administrator’s grant is full.UsersPermission group covering the account’s user list, which is what makes X-Context-User-ID impersonation useful and also what makes it sensitive.FilesPermission group for the Files API. File storage is capped at 10 GB on a trial account, so this is also where a runaway agent hits a hard wall.Sending to external chatsPermission group that lets the integration send messages into external chats — a customer-facing write, not a CRM read.External chat historyRetrieves messages from external chats, so it exposes conversation content rather than just CRM fields.
Rate limits
- Not more than 7 requests per second; over the limit returns 429, and repeated violations block the IP so that every request returns 403.
- Maximum entities returned per request (leads, contacts, companies): 250.
- Maximum entities added or updated per request: 250, with 50 recommended. A 504 means reduce the batch and retry.
- Per account: 50 pipelines, 100 stages per pipeline including Closed and Won, 100 webhooks, 10 lists.
- Per integration: 100 sources. Complex lead addition accepts 40 custom field values per entity.
- Kommo AI sources: 100 each for `agent` and `suggested_reply` on paid accounts, 10 on trial, counted separately.
Who has to approve
Yes. "The integration can only be installed by administrators and authorized by different users", and an administrator’s grant is full access. An admin can revoke access from any installed integration for any user from the integration modal, which fires the Access revoked notification webhook you registered; users can only revoke the access they granted themselves. Where an administrator granted access, requests may carry an X-Context-User-ID header to run with a named user’s rights instead.
Worth knowing
- Access and refresh tokens keep working after the granting user is deactivated or removed from the account, so offboarding a person does not close the integration’s access.
- Widening the scopes your integration asks for does not upgrade existing installs: users who consented to the narrower set "will continue to work in a limited scope" until they grant access again.
- Long-lived tokens are for private integrations only, are created by an administrator with an expiry chosen between 1 day and 5 years, and are displayed exactly once.
- TLS 1.1 or 1.2 is required and SSLv3 is refused outright, which matters for older HTTP clients.
Checked against Limitations (2026-09-29), Permissions (2026-09-29), Long-lived token (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Kommo behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.