API Report Card · Workflow & CRM · Methodology v1.1
LeadSimple
Where the points came from.
Five categories, each worth a fixed share of the 100 points. A category earns the fraction of its checks it passes, times its maximum.
Functional Coverage
Design & Reliability
Access Control
Docs & AI-Ready
Access & Cost
Letter grades are absolute, never curved.
The same numeric bands apply to every platform. Nothing here is scored relative to the rest of the board.
What this means for you.
One paragraph per category, in plain language.
1 · Functional Coverage
You can build real tools on this. Read and change your main records, contacts, deals, and processes, and receive change events by webhook. Two gaps: you cannot create or complete a task through the API, and you cannot delete records through it.
2 · Design & Reliability
The weakest of the technical categories, and it shows. Good in places: live rate-limit counters on every response, a request id on each one, and page totals so you can plan a full sync. Weaker elsewhere. Money fields come back as text rather than numbers, errors give a message but no fixed code, webhooks have no signature and no stated retry rule, and there is no version in the path and no deprecation policy.
3 · Access Control
One of the stronger areas on this card. LeadSimple offers read-only keys, multiple named keys and per-key revoke. You can hand a reporting agent a key that cannot change anything, give every integration its own key, and cut one off without breaking the rest. The gap left is fine-grained scoping: the create-key dialog offers only read-only or full read and write, so a key still cannot be limited to particular data.
4 · Docs & AI-Ready
The reference is now public, which was the big fix. A complete no-login reference, a downloadable OpenAPI 3.0 file, and request samples in five languages, so a developer or an AI tool can build against it without an account. Two gaps remain: no llms.txt for AI retrieval, and no API-specific changelog, only a product-wide one.
5 · Access & Cost
Full marks. You enable the API and create keys yourself with no sales call. On the gating question the run relied on the operator confirming the REST surface they use is available on their own plan, plus LeadSimple's pricing page gating no API rows by plan. LeadSimple does market an Enhanced API access tier for higher rate limits, so confirm your own plan rather than assuming this one.
Every check, and why it scored that way.
The same 27 checks are applied to every platform. What changes is which are N-A and what the core objects mean for that kind of software. Each mark below is quoted from the run's own report.
Category 1 · Functional Coverage
15 / 15Object coverage
weighted coverage 92%. All critical objects present with write operations; tasks read-only and properties update-only are the only reductions. [spec paths; live reads 2026-08-25]
Core operational actions
(borderline; documentation-graded) — weighted coverage 85%. Create/update for contacts, deals, processes, custom fields, communications; properties update-only; tasks not writable. [POST/PUT /contacts, /deals, /processes; POST /custom_fields, /notes, /calls; PATCH /conversations/{id}]
Delete or lifecycle actions
(documentation-graded) — weighted coverage 89%. Stage transitions, close, reassign, tag changes, webhook deletion; no record delete/archive, no direct task completion. [PUT /deals/{id}, PUT /processes/{id}, PATCH /conversations/{id}, DELETE /webhook_subscriptions/{id}]
Change notification
documented webhooks cover the critical + important state changes (deal/process created, stage/tag changes, reassigned; task; call; conversation), plus incremental polling (updated_since) proven live. [spec event_name enum; live 2026-08-25]
Category 2 · Design & Reliability
5.8 / 10Modern API conventions
resource-oriented REST, standard verbs, JSON, now OpenAPI 3.0.0. [new spec; live calls]
Consistent typing
ids/timestamps/booleans/counts are clean, but monetary/decimal fields are JSON strings (Deal.value, Deal.cost, Unit.market_rent, Unit.current_rent, Unit.estimated_rent, amount_receivable). [new spec schema types; live 2026-08-25]
Structured errors
structured JSON with correct HTTP status and message, but no populated stable machine code, and the shape varies (string vs. array). [live errors 2026-08-25; spec Errors_Authorization/NotFound/Validation]
Duplicate prevention
(documentation-graded) — deal creation has de-duplication (accept_duplicates), but no general idempotency-key for other writes. [spec POST /deals; idempoten=0]
Graceful handling under load
documented and live rate-limit headers (X-RateLimit-*, X-RateLimit-Retry-After); 429 behavior evidenced; the new spec documents rate-limit responses per operation. [spec; live headers 2026-08-25]
Pagination for large collections
offset pagination (page/per_page, cap 200) with a meta total_count/total_pages signal, but no stable-ordering guarantee and no cursor. [spec params; live meta 2026-08-25]
Bulk or incremental export
incremental sync via updated_since + pagination on most list endpoints, but no dedicated bulk/export endpoint, and some resources lack updated_since. [spec; live filter test]
Webhook security and delivery reliability
(documentation-graded) — webhooks exist (19 event types) but with no payload signature/HMAC, no retry policy, and no replay/idempotency guidance. [spec webhook_subscriptions; signature/hmac=0]
Concurrency and conflict control
a weak read ETag is honored (If-None-Match → 304, confirmed live), but no If-Match-on-write and no 409 conflict semantics (409 absent from the spec). [live ETag/304 2026-08-25; new spec]
Versioning and backward compatibility
a version is declared (info.version 1.0.0) and deprecations are signalled informally via [Deprecated] field markers, but there is no consumer-facing version identifier in the path (/rest, no /v1) or a header, and no documented backward-compatibility or deprecation-window policy. (Reconciled from an initial no: both independent runs marked this partial, and a declared version plus deprecation markers fit "versioning exists but thin/informal" better than "no versioning scheme.") [new spec server:/rest, info.version:1.0.0, 5 deprecated markers]
Request traceability
every response carries x-request-id (confirmed live), but it is undocumented and not described as usable with support. [live headers 2026-08-25]
Service availability and status transparency
public status page with 16 components including "REST API", 100% 90-day uptime and incident history. [status.leadsimple.com]
Category 3 · Access Control
4.4 / 5Read-only credentials
the Create REST API key dialog has a "Read-only access" checkbox ("Read-only keys can retrieve data but cannot create, change, or delete it"). [operator-supplied API Keys screenshot, 2026-08-28]
Scoped credentials
the create-key dialog offers only two access levels, "Read-only access" vs. "Read and write"; there is no per-resource or per-endpoint scoping (no option to limit a key to specific data such as contacts or a single pipeline). This is broad role-level scoping, not fine-grained. [operator-supplied API Keys screenshot, 2026-08-28 — the dialog shows only a key-name field and a read-only checkbox]
Multiple keys
a "Create API key" button issues multiple distinct keys, each given a required name; the page states "use a separate key for each integration" and "you can revoke this key later without interrupting your other integrations." [operator-supplied API Keys screenshot, 2026-08-28]
Rotation and revocation
each key exposes both "Rotate" and "Revoke" controls, self-serve; the page guidance says "revoke a key immediately if it's exposed." [operator-supplied API Keys screenshot, 2026-08-28]
Test and production isolation
no sandbox / separate test environment exists.
Category 4 · Docs & AI-Ready
3.1 / 5Complete self-serve reference
a complete, public (no login) API reference at docs.leadsimple.com covering all operations, with a "Download OpenAPI Document" control and client-library request samples in Shell, Ruby, Node.js, PHP, and Python. Minor limitation: response samples are schema-generated (the spec carries 0 curated example values). [docs.leadsimple.com, observed 2026-08-28]
Reliable machine-consumable integration path
a complete, published, public OpenAPI 3.0.0 specification (59 paths / 72 operations) at docs.leadsimple.com/openapi.json, suitable for code and tool generation (upgraded from the prior auth-gated 2.0 spec). [frozen evidence/leadsimple-openapi-3.0-2026-08-28.json]
AI-readable documentation
no llms.txt/llms-full.txt or Markdown corpus. Both /llms.txt and /llms-full.txt return 404 on the new docs, which are a reference-only SPA. (The public OpenAPI is credited under C4.2.) [404 probes 2026-08-28]
Kept current
an active product changelog and in-spec [Deprecated] markers show maintenance, but there is no API-specific changelog, release notes, or deprecation policy on the reference site. [product.leadsimple.com; new spec deprecated markers]
Category 5 · Access & Cost
15 / 15Self-serve API key
an account admin enables REST API access and creates keys self-serve in Settings; no Support needed. [Settings page 2026-08-25; operator report]
Not commercially gated
the operator confirmed (2026-08-27) that the full REST API surface they use is available on their plan, not restricted to the top Platform tier. LeadSimple markets an "Enhanced API access — Platform" tier for higher rate limits, but the API and object surface are reachable on the operator's plan, and pricing gates no API rows per plan. [operator confirmation 2026-08-27; leadsimple.com/pricing]
What works
- Gained 9 points by shipping fixes to its two weakest categories
- Read-only keys, multiple named keys, and per-key revoke, all self-serve
- Public OpenAPI 3.0 spec and reference, no login required
- Full coverage of contacts, deals, and processes, with webhooks
- The operator confirmed the REST surface they use is on their plan
What to watch
- Money fields come back as text, not numbers
- Webhooks have no signature and no documented retry policy
- Errors carry no stable machine-readable code
- Keys are read-only or full access; still no per-resource scoping
- No version in the path, and no deprecation policy
The bottom line for a property manager
LeadSimple's REST API is strongest exactly where it matters most for safe automation. You can create multiple labeled keys, make a key read-only, and revoke any key on its own, so you can hand a reporting agent something safe and cut off one integration without breaking the rest. The documentation is public, with a downloadable OpenAPI 3.0 file and request samples in five languages, so a developer or an AI tool can build against it without a login. The remaining weaknesses are in reliability rather than access: money fields come back as text, errors carry no stable code, webhooks have no signature or retry policy, and there is no clear version policy. LeadSimple is not a bank and not your system of record. It sits on top of your PMS, so you still need that PMS for property, lease, ledger and money data.
Check it yourself.
Both files behind this page, in full.
LeadSimple’s full report
The complete markdown report this page is built from, including the evidence packet, the run metadata and every check in full.
Download the LeadSimple reportThe grading file
The exact rubric behind every score on this page. Same file, every platform. Run it yourself and compare.
Download the methodologyFound a factual error in your grade?
Tell us and we will fix it. Every mark on this page traces to a specific piece of first-party evidence or a live API call, and the full report is published so you can see exactly what was checked and what it was checked against.
Confirmed factual errors are corrected immediately.
Everything else waits. We do not rescore piecemeal on request, because a board where some vendors have been re-run and others have not is not a fair comparison. Shipped improvements, changed documentation and disagreements about judgement all go into the next full rerun.
Contact us with a factual errorMethodology inspired by SaaStr’s AI Agent API Report Card. Sponsored by Column.