API & webhooks
The Pipemetry API: your forecast, in your stack.
Read your numbers programmatically. GET /v1/forecast,
/v1/opportunities, and /v1/accuracy, authenticated with a
per-workspace API key a workspace admin mints. Push events to your systems with HMAC-signed
webhooks. Or skip code entirely with a Google Sheets export link.
14-day full-Pro trial, no card · Read-only, rate-limited, revocable keys
One request
curl -H "Authorization: Bearer pm_live_…" \
https://app.pipemetry.com/v1/forecast| Method | Endpoint | Returns |
|---|---|---|
| GET | /v1/forecast | The forecast roll-up — commit, best case, and the projected total with its range. |
| GET | /v1/opportunities | Your opportunities with the fields the forecast is built from, plus a full-cohort win-rate summary: win_rate, settled_won, settled_lost. |
| GET | /v1/accuracy | Accuracy scorecards — MAPE and bias — for closed periods. |
A read API for your numbers
GET your forecast, opportunities, and accuracy
Read your Pipemetry numbers programmatically over a stable JSON API. Every request is authenticated with a per-workspace API key in a Bearer header, is rate-limited to 120 requests/min per client, and is scoped to what the key’s member can see — so a key can only ever read the data that member could read in the app.
- Three read endpoints: forecast, opportunities, accuracy
- Bearer-token auth over HTTPS
- Rate-limited to 120 requests/min per client, scoped to the member’s permissions
- Opportunities responses carry a win-rate block — win_rate, settled_won, settled_lost — computed over every settled deal the key can see, never just the returned page
- Read-only — the API never writes to your CRM or your data
Keys you control
API keys — minted by an admin, shown once, stored hashed
A workspace admin mints a pm_live_… key from settings. The secret is shown exactly once at creation and stored only as a SHA-256 hash — Pipemetry can never reveal it again — and it’s revocable at any time. Rotate a key you believe is exposed and every request made with the old one stops working.
- Per-workspace pm_live_ keys, minted by an org admin
- Shown once; stored only as a SHA-256 hash
- Revoke or rotate at any time
- A leaked key can be killed without touching your data
Outbound webhooks
HMAC-signed events, pushed to your endpoint
Register a URL and Pipemetry POSTs a signed event envelope to it when something changes, so your own systems can react without polling. Each delivery carries a Stripe-style t=<timestamp>,v1=<hmac> signature you verify with your endpoint’s secret, and outbound delivery is guarded against server-side request forgery (SSRF). This is the webhooks home — there’s no separate page.
- Register your own URL; Pipemetry POSTs signed envelopes
- HMAC-SHA256 signature (t=…,v1=…) — verify authenticity
- SSRF-guarded delivery from our network
- React the moment the forecast moves — no polling
No code needed
Google Sheets & Excel export tokens
Not everything needs a script. A workspace admin can mint a signed, scoped, expiring export link and pull a live grid straight into a Google Sheet with =IMPORTDATA(), or into Excel via Power Query. See the Google Sheets integration for the full walk-through.
- Signed, scoped, expiring export links per grid
- IMPORTDATA-compatible — refreshes on Google’s schedule
- Excel via Power Query on the same link
- Read-only and revocable, like an API key
Honest limits
What the API does — and doesn’t — do
The API is read-only today: it returns your forecast, opportunities, and accuracy, and it does not write back to your CRM. Reads are rate-limited to 120 requests/min per client, and a 429 response carries Retry-After: 60 plus X-RateLimit-Limit/X-RateLimit-Remaining headers so you can pace yourself. Plan availability is enabled per workspace by an admin — check pricing or ask us to confirm which plan includes it before you build on it.
- Read-only — no write-back to your CRM
- Rate-limited to 120 requests/min per client
- Enabled by an org admin from workspace settings
- Confirm plan availability before you build on it
Built to be inspected
The API is the same transparency principle as the rest of Pipemetry, pointed at your data on the way out. Keys are hashed and revocable, webhooks are signed and SSRF-guarded, and export links expire — read how we secure the API, webhooks, and export tokens. Prefer to pull numbers into a spreadsheet? Use the Google Sheets & Excel links instead of code.
API & webhooks FAQ
How do I get an API key?
A workspace admin mints a pm_live_ key from workspace settings. The secret is shown only once at creation — copy it then, because Pipemetry stores only a SHA-256 hash and can’t show it again. You can revoke or rotate the key at any time.
How is the API authenticated?
With the API key in a Bearer header over HTTPS. Each request resolves to the key’s workspace and is scoped to what that member can see, so a key can only ever read the data that member could read in the app.
Is the API rate-limited?
Yes. Read requests are limited to 120 per minute per client. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining headers so you can pace yourself, and a 429 response includes Retry-After: 60. Design your integration to cache and back off rather than poll aggressively.
Can the API write back to my CRM?
No. The API is read-only: it returns your forecast, opportunities, and accuracy, and never writes to your CRM or changes your data. The same is true of the Google Sheets and Excel export links.
How do webhooks prove they came from Pipemetry?
Every webhook delivery carries a Stripe-style HMAC-SHA256 signature — t=<timestamp>,v1=<hmac> — that you verify with your endpoint’s signing secret. Delivery is also guarded against server-side request forgery, so a registered URL can’t be used to reach internal addresses.
Which plan includes the API and webhooks?
API access, webhooks, and export links are enabled per workspace by an org admin. Which plan includes them can depend on your account — see the pricing page or contact us to confirm before you build on it, so we don’t over-promise a capability your plan doesn’t carry.
Own your forecast — on the way out, too.
Connect Salesforce or HubSpot, then read your numbers over the API. See the full product or what it costs.