API, webhooks & the MCP server

API v2: what you can actually do

The REST API covers the objects you would expect: contacts (create, update, search, tag, custom fields), conversations and messages (read a thread, send an SMS or email), calendars and appointments (read availability, book, reschedule), opportunities and pipelines, forms and survey submissions, payments, invoices and orders, locations (sub-accounts), users, custom fields, and custom objects. Webhooks push events out so you do not have to poll.

Authentication: pick the right one

• Private Integration Token (PIT). A scoped token generated inside a sub-account. Perfect for a script, an internal tool, or an automation you run for yourself. It is a long-lived credential — treat it like a password, keep it server-side, and never ship it in anything a browser can read.
• OAuth 2.0 marketplace app. What you build if other agencies will install your integration. You request scopes, the installing user consents, and you receive tokens per location. This is the only correct path for a distributed product, and it is what the marketplace listing process expects.

Rate limits

The public V2 API is rate limited — the commonly cited figures are a burst limit around 100 requests per 10 seconds and a daily ceiling in the low hundreds of thousands of requests. Verify the current numbers in the official docs, then design for them: batch, back off exponentially on a 429, and prefer webhooks over polling. Anyone who has tried to full-sync a large contact database on a naive loop has met these limits within the first minute.

The MCP server: the part that is actually new

HighLevel ships an official MCP (Model Context Protocol) server — the LeadConnector MCP endpoint — which exposes the platform as a set of tools an AI assistant can call directly. Point an MCP-capable client at the endpoint, pass a Private Integration Token and a location ID in the headers, and the assistant gains scoped tools across contacts, conversations, calendars, opportunities, payments, locations and custom fields.

The practical consequence: you can ask an AI assistant to "find every lead from last week who never got a follow-up text and draft one each," and it can actually do it, against the real CRM, without you writing an integration. For agencies with a technical operator, this is the most interesting thing in the platform right now — and it is early enough that the tooling is thin and OAuth support for MCP has been signposted as future work rather than shipped. Treat it as powerful and immature, in that order.

Who this is for

• Developers building for the marketplace. A large, paying, non-technical installed base that needs tools built for it. That is a good place to be.
• Technical agencies automating their own operations — onboarding, reporting exports, cross-client dashboards, custom client portals.
• Businesses with an existing system — a POS, a practice-management platform — that has to stay authoritative while GoHighLevel handles marketing.

Where the API falls short

• Not on the $97 plan. API access starts at the $297 Unlimited tier. If your plan was to script your way around Starter's limits, it is not a plan.
• Documentation is uneven. The reference exists and is public, but coverage of edge cases, error semantics and field-level behaviour is patchy, and you will spend real time probing endpoints to find out what they actually return. The developer community's shared knowledge is, frankly, part of the documentation.
• API v1 to v2 migration left scars. Older tutorials, older marketplace apps and older Stack Overflow answers reference v1 endpoints and auth. Check the version on anything you read before you copy it.
• Rate limits bite on bulk work. Any migration, backfill or reconciliation job needs to be designed around them from the start, not retrofitted after the 429s appear.
• Webhooks are fire-and-forget. If your endpoint is down, the workflow does not care. Queue on your side and assume delivery is best-effort; do not build a financial reconciliation on the assumption that every webhook arrived.
• The platform moves under you. Endpoints, scopes and product behaviour change, sometimes with modest notice. If you ship a marketplace app, budget for ongoing maintenance — this is a living platform, not a stable contract.

The honest summary

The GoHighLevel API will not win any design awards, and its documentation will occasionally infuriate you. What it will do is put your software in front of a very large number of agencies who are actively looking for tools and used to paying for them. Add the MCP server — which makes the entire CRM addressable by an AI assistant with a token and a location ID — and this is quietly one of the more interesting developer surfaces in the SMB software world. Start with a workflow webhook, graduate to the API when you need to read, and build an OAuth app when you want to sell.