Twenty CRM

Twenty CRM REST API (Commerce/CRM). 70 operations: people, companies and opportunities (create, update, get, list, delete, find duplicates); notes and tasks including attaching them to records; attachments; workspace members; synced messages and calendar events; timeline activities; a generic record family that reaches ANY standard or custom object (find, create, batch create, update, bulk update, soft delete, restore, destroy, merge, duplicates, group-by); schema discovery over the metadata API; and webhook registration.

Credential: Twenty CRM credential - see Credentials.

Role permissions

Each operation below lists the role permission it needs. Role permissions are held by the ROLE assigned to the workspace API key, in Settings -> Roles. Twenty has NO OAuth scopes and no consent screen - a key is one opaque bearer string minted per workspace in Settings -> APIs, and everything it may do follows from the role behind it. Three things this catches people out on. First, there is no CREATE permission: permissions.utils.ts maps an insert onto canUpdateObjectRecords, so a role that may read but not update cannot create records either. Second, DELETE and DESTROY are different permissions on different operations - the Delete … operations soft-delete and need canSoftDeleteObjectRecords (Restore uses the same one), while Permanently destroy record needs canDestroyObjectRecords. Third, two families are gated by a SETTINGS flag rather than an object permission: the schema operations need the Data Model flag and the webhook operations need the MCP & APIs flag. And whatever else it grants, a role that does not have canBeAssignedToApiKeys cannot back an API key at all. If a run fails with a permission error, the node names the missing role permission in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (70)

People

Companies

Opportunities

Notes

Tasks

Attachments

Workspace members

Synced email & calendar (read-only)

Activity

Any object (standard or custom)

Schema (metadata)

Webhooks

Example

Write to a custom object you created this morning

Twenty has no static endpoint list — its REST API is generated from each workspace's own schema, so every object, standard or custom, answers the same record verbs under its own plural name. That is why the generic family exists: the object name is a FIELD, so a workflow reaches an object the day a user creates it, which no amount of hand-written per-entity operations could.

Set Operation to createRecord, then fill in:

Sets {{record.id}} and {{record.record}}. Reads default to 60 rows and are silently clamped at 200, and depth accepts only 0 or 1 — both read out of Twenty's own server source rather than its docs.