Attio

Attio node reference - all 65 operations, the credential it needs, and a worked example.

Attio REST API (CRM). 65 operations: records on any object (create, upsert, get, update, delete, query, cross-object search); lists and list entries including pipeline-stage moves; notes; tasks; comments and threads; read-only schema discovery (objects, attributes, select options, statuses); workspace members, token introspection and read-only SQL; record files; meetings, call recordings and transcripts; and webhook management.

Credential: Attio API token - see Credentials.

Scopes

Each operation below lists the scope it needs. Scopes are ticked under Scopes when the access token is created in Workspace settings -> Developers -> New access token, and editable afterwards from the same page. Attio's authentication guide is explicit that a single-workspace API key and an OAuth access token use the SAME scopes, so this table applies whichever kind of token is stored - and neither kind carries any scope by default, which is why a brand-new token 403s on its first call. Attio also composes scopes across resources: reading a task needs task:read for the task, record_permission:read plus object_configuration:read for the records it links to, and user_management:read for its assignee, so every scope a row names is required. If a run fails with a permission error, the node names the missing scope in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (65)

Records

Operation	What it does	Scope
`upsertPerson`	Create / update person (match on email)	`record_permission:read-write + object_configuration:read`
`createRecord`	Create record	`record_permission:read-write + object_configuration:read`
`upsertRecord`	Upsert record (match on an attribute)	`record_permission:read-write + object_configuration:read`
`getRecord`	Get record	`record_permission:read + object_configuration:read`
`updateRecord`	Update record (append multiselect)	`record_permission:read-write + object_configuration:read`
`updateRecordOverwrite`	Update record (overwrite multiselect)	`record_permission:read-write + object_configuration:read`
`deleteRecord`	Delete record	`object_configuration:read + record_permission:read-write`
`queryRecords`	Query records (filter / sort / paginate)	`record_permission:read + object_configuration:read`
`searchRecords`	Search records (attribute contains)	`record_permission:read + object_configuration:read`
`searchAllRecords`	Search across objects (full text)	`record_permission:read + object_configuration:read`
`listRecordAttributeValues`	List a record's attribute values	`record_permission:read + object_configuration:read`
`listRecordEntries`	List the lists a record belongs to	`record_permission:read + object_configuration:read + list_entry:read`

Lists

Operation	What it does	Scope
`listLists`	List all lists	`list_configuration:read`
`createList`	Create list	`list_configuration:read-write`
`getList`	Get list	`list_configuration:read`
`updateList`	Update list	`list_configuration:read-write`
`listListViews`	List views on a list	`list_configuration:read`

List entries

Operation	What it does	Scope
`addToList`	Add record to list	`list_entry:read-write + list_configuration:read`
`upsertListEntry`	Upsert list entry (match on parent record)	`list_entry:read-write + list_configuration:read`
`queryListEntries`	Query list entries (pipeline stages)	`list_entry:read + list_configuration:read`
`getListEntry`	Get list entry	`list_entry:read + list_configuration:read`
`updateListEntry`	Update list entry (append multiselect)	`list_entry:read-write + list_configuration:read`
`updateListEntryOverwrite`	Update list entry (overwrite multiselect)	`list_entry:read-write + list_configuration:read`
`deleteListEntry`	Remove record from list	`list_entry:read-write + list_configuration:read`
`listEntryAttributeValues`	List a list entry's attribute values	`list_entry:read + list_configuration:read`

Notes

Operation	What it does	Scope
`createNote`	Create note	`note:read-write + object_configuration:read + record_permission:read`
`listNotes`	List notes	`note:read + object_configuration:read + record_permission:read`
`getNote`	Get note	`note:read + object_configuration:read + record_permission:read`
`deleteNote`	Delete note	`note:read-write`

Tasks

Operation	What it does	Scope
`createTask`	Create task	`task:read-write + object_configuration:read + record_permission:read + user_management:read`
`listTasks`	List tasks	`task:read + object_configuration:read + record_permission:read + user_management:read`
`getTask`	Get task	`task:read + object_configuration:read + record_permission:read + user_management:read`
`updateTask`	Update task (complete / reschedule / reassign)	`task:read-write + object_configuration:read + record_permission:read + user_management:read`
`deleteTask`	Delete task	`task:read-write`

Comments & threads

Operation	What it does	Scope
`createComment`	Create comment	`comment:read-write`
`getComment`	Get comment	`comment:read`
`deleteComment`	Delete comment	`comment:read-write`
`listThreads`	List comment threads	`comment:read`
`getThread`	Get thread with its comments	`comment:read`

Schema (read-only)

Operation	What it does	Scope
`listObjects`	List objects	`object_configuration:read`
`getObject`	Get object	`object_configuration:read`
`listObjectViews`	List views on an object	`object_configuration:read`
`listAttributes`	List attributes	(any valid token — Attio states no scope requirement for the attribute reads)
`getAttribute`	Get attribute	(any valid token — Attio states no scope requirement for the attribute reads)
`listSelectOptions`	List select options	(any valid token — Attio states no scope requirement for the attribute reads)
`listStatuses`	List statuses	(any valid token — Attio states no scope requirement for the attribute reads)

Workspace & meta

Operation	What it does	Scope
`listWorkspaceMembers`	List workspace members	`user_management:read`
`getWorkspaceMember`	Get workspace member	`user_management:read`
`identifySelf`	Identify token & workspace	(any valid token — this is the token-introspection endpoint and reports which scopes the token actually has)
`runSql`	Run a read-only SQL query	`record_permission:read + object_configuration:read`

Files

Operation	What it does	Scope
`listFiles`	List a record's files	`object_configuration:read + record_permission:read + file:read`
`createFileEntry`	Create folder / connect external file	`file:read-write + object_configuration:read + record_permission:read`
`getFile`	Get file	`file:read + object_configuration:read + record_permission:read`
`getFileDownloadUrl`	Get file download URL	`object_configuration:read + record_permission:read + file:read`
`deleteFile`	Delete file	`file:read-write + object_configuration:read + record_permission:read`

Meetings & call recordings

Operation	What it does	Scope
`listMeetings`	List meetings	`meeting:read + record_permission:read`
`getMeeting`	Get meeting	`meeting:read + record_permission:read`
`listCallRecordings`	List call recordings	`meeting:read + call_recording:read`
`getCallRecording`	Get call recording	`meeting:read + call_recording:read`
`getCallTranscript`	Get call transcript	`meeting:read + call_recording:read`

Webhooks

Operation	What it does	Scope
`listWebhooks`	List webhooks	`webhook:read`
`createWebhook`	Create webhook	`webhook:read-write`
`getWebhook`	Get webhook	`webhook:read`
`updateWebhook`	Update webhook	`webhook:read-write`
`deleteWebhook`	Delete webhook	`webhook:read-write`

Example

Upsert a person so a webhook that fires twice does not duplicate them

The node's default operation. Attio is schema-flexible — objects and their attributes are workspace-defined — so almost everything here is generic over an object slug and takes attribute values as JSON. upsertPerson is the one exception, kept because it shipped before that model and saved workflows use it.

Set Operation to upsertPerson, then fill in:

Field	Value	Notes
`email`	`{{ myTrigger.email }}`	The matching key for the upsert
`firstName`	`{{ myTrigger.firstName }}`
`lastName`	`{{ myTrigger.lastName }}`
`valuesJson`	`{"job_title": "{{ myTrigger.title }}"}`	Keyed by YOUR workspace's attribute slugs — they are not knowable at build time, which is why this is JSON rather than named fields

Sets {{person.id}} and {{person.record}}. Attio tokens carry no scopes by default, so a brand-new token 403s on everything until each family is ticked.

On this page