Attio

Twin of the Attio CRM API v2.


Covers	`api.attio.com`
Auth	Workspace access tokens, OAuth access tokens
Webhooks	Yes
Operations	61

Coverage

Objects and their attributes, including select options and statuses, records with real attribute value history, lists and list entries, workspace members, notes, tasks, comments, files and webhooks, plus the OAuth flow. Real Attio runs the OAuth dance on app.attio.com and the API on api.attio.com, and the twin serves both path sets on the one base URL: GET /authorize and POST /oauth/token answer beside /v2. Point your app’s authorize and token URLs at the twin, because app.attio.com is not among the hostnames the proxy intercepts.

The API sits under /v2. Attio carries the version in the path and offers no selector header.

Credentials

Attio’s two credential kinds are both 64 hex characters and cannot be told apart on the wire, so the twin treats them the same way. Well-formed means exactly 64 hex characters, and both the Bearer and Basic schemes are accepted. Any well-formed token authenticates by default, so your existing token needs no change; set auth.mode to enforced to accept only what the world knows. See Credentials.

Scopes are enforced, and Attio’s rule is all-of rather than any-of. A token short of one gets a 403 naming only the scopes it lacks. The published workspace token holds every scope, so to test a refusal mint a narrow token through the OAuth flow.

Vendor specific details

The credential check runs before the router. An unknown path sent without a credential is a 401, not a 404. A wrong method is a 404 too, never a 405.
Attribute values are versioned. A write closes the current value and opens a new one rather than overwriting, so a record read after a PATCH shows only the current value and the full chain lives on the attribute’s own values route with ?show_historic=true.
An id is an object, not a string. A record’s is {workspace_id, object_id, record_id}, nested under a top-level data wrapper, and every other entity follows the same shape.
On a list entry, PATCH appends to a multiselect value and PUT overwrites it. On a record, PUT and PATCH do the same thing, and PUT /v2/objects/{object}/records is an assert-by-matching-attribute upsert instead.
Object and list path parameters take a slug or a UUID interchangeably. workspace_member_id takes a UUID only.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.