SmartSuite Developers

Yes. SmartSuite has a REST API that uses JSON for requests and responses and standard HTTP status codes for results. It covers Solutions, Tables, Fields, Records, Views, comments, files, Members, Teams and webhooks. The base URL is https://app.smartsuite.com/api/v1, and the API is available on all plans. Some endpoints still use the older name "applications" for Tables. Each Solution also has its own generated API documentation, which you can open from the Solution's menu in SmartSuite.

API introduction

Every request is made over HTTPS and needs two headers: Authorization: Token YOUR_API_KEY and ACCOUNT-ID: YOUR_WORKSPACE_ID. Your Workspace Id is the 8 characters after app.smartsuite.com/ in your browser's address bar. API keys are created in your user profile. If you are building an integration that other SmartSuite users connect to their own accounts, use OAuth instead of a personal API key.

Authentication

Yes. You can write JavaScript that runs inside SmartSuite, in the Scripting Widget on dashboards and in button actions. Scripts use the SmartSuite scripting SDK through window.SmartSuite to read and update Records, Tables, Fields, Views, Members and files. They can render their own HTML interface, and they can call external APIs through proxy_fetch for URLs an administrator has allowlisted. The Scripting Widget is available on the Pro plan and higher. For Enterprise and Signature customers, SmartSuite can host scripts that run on a schedule or in response to events. These scripts have access to the same SDK as well as secrets.

Scripting overview

Yes. SmartSuite has a Model Context Protocol (MCP) server that lets AI assistants work directly in your Workspace. Assistants can query and update Records, and they can build Solutions, Tables, Fields, Views, Forms and Automations. SmartSuite hosts the server at https://app.smartsuite.com/v1/mcp, and you connect to it from Claude, ChatGPT, Cursor, VS Code and other MCP clients by signing in with OAuth, with no API key needed. The assistant acts as the Member who connected it, and every change it makes is recorded in the Record's activity history. Workspace Administrators set MCP access to Disabled, Read-Only or Read & Write in the AI Control Center.

MCP Server overviewQuickstart

Yes. Administrators can store API keys, tokens, passwords and connection strings as Secrets under Workspace Administration > Secrets. Values are encrypted and write-only. The only way to see a value is the Reveal action, which records who used it and when. Scripts refer to a Secret by name and read the value at run time from context.secrets, so the credential is never stored in the script's code. When you rotate a Secret, every script and integration that uses it gets the new value automatically.

Secrets Management

True service accounts are coming soon to the SmartSuite platform - we will be announcing their availability in our Changelog and What's New page, as well as on this site. Until then, an API key acts as the Member it belongs to and has exactly that Member's permissions. For integrations, SmartSuite recommends creating a dedicated API Member that works as a service account. Give it only the permissions the integration needs, and don't use an Administrator account for automated access. Changes made through that key are attributed to the API Member, so integration activity stays separate from your own users' activity.

REST API permissions

Yes. The Webhooks API at https://webhooks.smartsuite.com sends notifications when Records are created, updated or deleted. You can watch a whole Solution, specific Tables, or specific Fields. When an event occurs, SmartSuite sends a POST request to your URL, and you then call List Events to get the changes. You must call List Events at least once every 7 days, or the webhook is disabled.

Webhooks overview

The API allows 5 requests per second per API key. If you go over that, you get an HTTP 429 response and must wait 30 seconds before sending more requests, so build back-off and retry into your integration. Monthly request allowances depend on your plan. For heavy read traffic, use a caching proxy.

Rate limitsAPI limits by plan

Requests made through the API, scripts or the MCP server have the permissions that the connected Member has at the time of the request. Changes are attributed to that Member, and they trigger the same notifications as the same change made in the SmartSuite interface. A read-only Member can only read data through the API.

Permissions

Yes. SmartSuite has native connectors for automation platforms such as Zapier and Make, and it works with tools such as Relay, Skyvia, WeWeb and Noloco. If a connector doesn't cover what you need, use the REST API, webhooks or the MCP server. Technology companies can also join the SmartSuite Technology Partner program.

Connect SmartSuite and ZapierConnect SmartSuite with Make