Bitrix24
Leads, deals, contacts, tasks, and activities via an incoming webhook. Outgoing webhooks check application_token.
Bitrix24 is CRM, tasks, and messaging. Simple integrations use an incoming webhook: a stable URL https://{domain}/rest/{userId}/{token}/{method}.json with no OAuth (sign-in by granting the app permission) on every run.
With Bitrix24 in Pailot you can:
- Leads — filtered list (JSON), create and update (status, budget, name, phone, email)
- Deals — list, create, update (stage, pipeline, amount, contact, company)
- Contacts — list and create
- Tasks —
tasks.task.addlinked to a lead, deal, contact, or company - Activities — a comment or email on the entity timeline (
crm.activity.add)
The integration supports a Bitrix24 outgoing webhook as a trigger (a webhook is an inbound HTTP request from the service). Events such as ONCRMLEADADD and ONCRMDEALUPDATE POST to the URL from the block.
How to connect (incoming webhook)
- In Bitrix24 open Developers (or Applications → Developers) → Other → Incoming webhook.
- Create a webhook with CRM and Tasks rights as needed.
- Copy the URL and take:
- Domain — portal host (
mycompany.bitrix24.ruor.com) - User ID — the number after
/rest/ - Token — the secret segment after the user id
- Domain — portal host (
- Paste those three values into Domain, User ID, and Webhook token on the block.
Filters on *.list methods are a JSON object with Bitrix24 field names: STATUS_ID, STAGE_ID, CATEGORY_ID, and so on.
Trigger (outgoing webhook)
- Turn on Trigger on the block, save, and copy the Pailot webhook URL.
- In Bitrix24: Developers → Other → Outgoing webhook — add a handler with that URL.
- Tick event types (lead created, deal updated, and others).
- After save, Bitrix24 shows an application token. Paste it into Application Token on the block to turn on the authenticity check.
Authenticity. Bitrix24 does not sign the request body. It repeats the portal token in auth[application_token], and the provider docs require you to compare that value before trusting the request. Fill Application Token — any request without a matching token gets 401 and does not start the workflow. If the field is empty, requests are accepted with no check: anyone who learns the URL can fire the scenario.
If you reissue the token in Bitrix24, update it on the block too. The old value will stop matching and events will be rejected.
Trigger outputs. The body is x-www-form-urlencoded with bracket keys. Pailot unfolds them, so data is a structure — for example <Trigger.data.FIELDS.ID>. event holds the event name (ONCRMLEADADD and similar). auth holds portal facts (domain, member_id, application_token).
Docs: REST API, CRM / tasks / activities.
Tools
bitrix24_get_leads
crm.lead.list — list leads.
| Parameter | Description |
|---|---|
domain, userId, webhookToken | Access |
filter | JSON filter string |
select | Comma-separated fields |
limit, start | Pagination |
Output: total, items, message.
bitrix24_create_lead / bitrix24_update_lead
crm.lead.add / crm.lead.update. Bitrix24 field names: TITLE, NAME, LAST_NAME, PHONE, EMAIL, STATUS_ID, OPPORTUNITY, CURRENCY_ID, ASSIGNED_BY_ID; plus customFields as a JSON object.
bitrix24_get_deals / bitrix24_create_deal / bitrix24_update_deal
crm.deal.list, crm.deal.add, crm.deal.update.
Changing the pipeline of an existing deal sometimes needs crm.item.update with entityTypeId: 2. The deal-update action in the block uses crm.deal.update (stage in the current pipeline).
bitrix24_get_contacts / bitrix24_create_contact
crm.contact.list, crm.contact.add.
bitrix24_create_task
tasks.task.add — TITLE, DESCRIPTION, DEADLINE, PRIORITY, CRM binding through the task’s internal field.
bitrix24_add_activity
crm.activity.add — a timeline entry (comment / email) for a lead, deal, contact, or company.