Agents & API

Seedling is built so an AI agent can help run your business, not just read from it. The same data your team works with is reachable over a REST API and an MCP server, using scoped bearer tokens and standard JSON over HTTPS. Both are on every plan, including free. Free plans get a small daily budget, enough to connect an agent and watch it work. Paid plans raise it for agents that run all day.

What an agent can actually do once it is connected:

• See the business. Tasks, projects, customers, calendar, invoices, products and bookings.
• Do the work. Create and update tasks and projects, add and update customers, book calendar time, and turn meeting notes into tasks.
• Stay inside the lines. Every gated write is checked against policy before it runs.
• Hand back to you. Held actions land in your review queue, and the Agent Command Center shows what your agents are doing and what they remember.

Connect your agent (step by step)

Seedling is tool-agnostic. Any agent that can send HTTPS requests with a bearer token can read and (with the right key) write your org data. Here is the recommended path from zero to a working automation.

Step 1. Enable API access and create a key

1. Open Settings → Advanced → API Keys.
2. Turn on Enable API access for this organization.
3. Create a key with a label (e.g. Claude ops agent) and choose Read only or Read and write. Each key is scoped to one organization and carries only the abilities you grant it, so an agent that should only report never gets the ability to write.
4. Copy the token immediately. It is shown only once.

Step 2. Verify the connection

REST base URL: https://staging.seedlingcrm.com/api · MCP endpoint: https://staging.seedlingcrm.com/mcp/seedling · Header: Authorization: Bearer <your-token>

Call the discovery endpoint to confirm org context, scopes, and available endpoints:

curl -s -H "Authorization: Bearer YOUR_TOKEN" \
  https://staging.seedlingcrm.com/api/v1/me

You should see JSON with your organization, plan capabilities, token abilities, and endpoint families. Log in to use the browser playground.

Step 3. Let your agent read (and optionally write)

Point your agent at the OpenAPI spec or the endpoint list from GET /api/v1/me. Common starting points:

• GET /api/v1/tasks: list and filter tasks
• GET /api/v1/customers: CRM with search and incremental sync
• GET /api/v1/calendar: unified calendar feed
• POST /api/v1/tasks: create a task (requires a read-write key, and is subject to SafeNode policy)

Step 4. Understand write protection (SafeNode, included)

When you use a read and write key, Seedling evaluates each gated write through SafeNode before it runs. This is the part legacy CRMs do not have: an agent can be given real write access without being given a blank cheque. You stay in Seedling for review, and no separate SafeNode signup is required.

• Allow: the write completes normally.
• Review: Seedling returns HTTP 202 with pending_review, and you approve or deny it in your org’s review queue.
• Deny: HTTP 403 with a policy reason, and nothing is changed.

Every one of those decisions is recorded, so you can answer “what did the agent do, and who let it?” later.

Agent setup examples

Pick the path that matches your stack. All paths use the same Seedling API key and base URL.

curl or any HTTP client

Works everywhere: scripts, cron jobs, serverless functions, or quick tests.

# Read
curl -s -H "Authorization: Bearer YOUR_TOKEN" \
  "https://staging.seedlingcrm.com/api/v1/tasks?status=todo"

# Write (gated by SafeNode policy)
curl -s -X POST \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Follow up with Acme","status":"todo"}' \
  "https://staging.seedlingcrm.com/api/v1/tasks"

Claude Agent SDK (TypeScript / Python)

The Claude Agent SDK runs an agent loop with tools. Give your agent HTTP tools (or a thin wrapper) that call Seedling with your bearer token.

1. Store SEEDLING_API_TOKEN and SEEDLING_API_BASE=https://staging.seedlingcrm.com/api in your agent environment, never in client-side code.
2. On startup, call GET /api/v1/me so the agent knows org context and allowed scopes.
3. Register tools such as list_tasks, create_task, search_customers that map to Seedling REST paths.
4. For writes, handle 202 pending_review by telling the user to approve in Seedling, or poll the review queue if you build that into your workflow.

Tip: download the OpenAPI spec (below) and use it to generate typed clients or MCP tool definitions for your agent.

MCP: Claude, Cursor, and IDE agents

Seedling speaks MCP directly at https://staging.seedlingcrm.com/mcp/seedling, so a client that supports MCP servers can connect with the same bearer token and get a catalog of Seedling tools without you writing any glue. The organization comes from the token, so an agent never has to be told which org it is in, and can never reach another one.

Writes arriving over MCP go through exactly the same SafeNode gates as REST writes. An agent that tries something risky gets a pending-review response, not a silent change. Use a read-only key while you are exploring, then switch to read-write once you trust the workflow.

MCP has its own per-minute ceiling, set higher than the REST one on purpose, because one agent turn fires many tool calls. Both share your plan’s daily request budget.

Zapier, Make, n8n

Use the Webhooks / HTTP Request action with your bearer token. Trigger on schedules or external events, read Seedling data, and POST updates when needed. Writes from automations are subject to the same SafeNode gates as agent writes.

Optional: custom SafeNode policies (advanced)

Default policies are managed by Seedling for every organization. If you operate your own SafeNode workspace and want finer-grained rules, action types and context fields are documented in docs/seedling-api/safenode-action-catalog.md (repo). Match policies to your Seedling organization id from GET /api/v1/me. Learn more at safenode.tech.

Docs & playground

Full reference and a live browser playground are in the app (login required):

• Seedling API docs & browser playground: try GET requests with your key
• Full API reference (OpenAPI): every path, scope, and error code
• Download OpenAPI spec: for codegen, Postman, or MCP tools

Log in to open the playground and manage API keys.

What you can access

• Tasks & projects: list, create, update, delete (writes require a read-write key)
• Customers: CRM data with search, tags, and incremental sync via updated_since
• Calendar: unified feed plus generic events
• Invoices, products, bookings: read-only lists and detail
• Expenses & work logs: when your plan includes those features
• Team members: active roster for assignment context
• Meeting ingests: POST transcripts and extracted tasks (write scope)

Authentication & scopes

Each API key is tied to one organization. Keys use Sanctum bearer tokens with abilities such as tasks.read, tasks.write, customers.read, calendar.read, and others. Read-only keys cannot create or update data.

Two route shapes exist for every resource:

• Implicit org: /api/v1/tasks (organization inferred from the key, and recommended)
• Explicit org: /api/v1/organizations/{slug}/tasks (slug must match the key’s org)

Rate limits & errors

• Rate limit: set by your plan, per organization, with a separate and higher ceiling for MCP. Responses include X-RateLimit-Limit and X-RateLimit-Remaining. See your plan on the pricing page.
• Daily budget: the REST API and MCP share one daily request allowance, which resets at midnight in your organization’s timezone.
• Errors: JSON envelope { "success": false, "error": { "code": "...", "message": "..." } }
• Throttled: HTTP 429 with error.code of rate_limited
• Pending review: HTTP 202 with error.code of pending_review, meaning the action is queued for your approval

Keeping docs up to date

The OpenAPI specification is the source of truth for the full API reference. When new endpoints ship, the spec is updated in the repository and served automatically at the OpenAPI download URL. The browser playground endpoint list is generated from registered routes, so new GET endpoints appear there without manual edits.

Also see Account & Plans for what each plan includes, and Settings & Organization for org configuration.