RSMID Platform API

REST API for RSM Indonesia's internal apps: CRM, projects and timesheets, NetSuite, HR and workplace.

564 endpoints · last updated 2026-10-14 · openapi.json

Quick start

Ask RSM Indonesia for an API key, then:

curl 'https://api-rsm.apergu.co.id/api/crm/leads?limit=5' \
  -H 'X-API-Key: rsmk_...'

You can also test any endpoint here. Open it, paste your key under Try it and press Send.

Every path starts with /api. If you were given a different host, change it here. Try it and the cURL samples use whatever is in this box.

Send your API key in the X-API-Key header with every request. Only GET /api/health works without one.

X-API-Key: rsmk_...

Keys are created by an RSM Indonesia admin in the RSMID app (CRM → Settings → API Keys). The key is shown once, so store it somewhere safe. If you lose it, ask for a new one.
A key has admin access to every endpoint. Keep it on your server.
If your client only supports bearer auth, Authorization: Bearer rsmk_... also works.
Expired or revoked keys get a 401.

Requests and responses are JSON.
Unknown fields in a request body are rejected with 400.
Lists are paged with page and limit and return { "items": [...], "page": 1, "limit": 20, "total": 134 }.
Dates use ISO 8601, e.g. 2026-10-14. Timestamps are UTC, e.g. 2026-10-14T08:30:00.000Z.
Amounts are plain numbers. The currency field says which currency (IDR by default).
The limit is 300 requests per minute per key. Past that you get 429.
Every response has an x-correlation-id header. Send it to us when you report a problem.
Actions like submit, approve or convert have their own endpoint, e.g. POST /api/crm/proposals/{id}/submit.

Errors look like this. For validation errors, message is a list.

{
  "statusCode": 400,
  "message": ["companyName should not be empty"],
  "error": "Bad Request"
}

Status	Meaning
400	Invalid input, or the record's current status doesn't allow that action.
401	Missing, wrong, expired or revoked key.
403	Not allowed.
404	Not found.
409	Duplicate, or the record is locked.
429	Too many requests.
500 / 502	Something failed on our side or in NetSuite/BIPO. Try again later.

Most endpoints need a permission such as crm:lead:create. API keys run as admin, so they have all of them. The list below is for reference.