About bitrix24-rest-api
A client-side guide for developers consuming the Bitrix24 REST API. It covers authentication, calls, events, errors, and SDKs, with explicit guidance on verifying methods and protecting credentials.
Key features
- 01REST calls and pagination guidance
- 02Webhook, OAuth, and scope guidance
- 03Limits, errors, and retry rules
- 04Events and REST 3.0 guidance
- 05Guidance for multiple SDKs
Use cases
- 01Build REST integrations for Bitrix24 cloud
- 02Choose authentication and least-privilege scopes
- 03Handle batches, limits, and API errors
- 04Securely process events and inbound requests
MCP support
The project points to bitrix24-ai-tools MCP for documentation lookup, and recommends method.get on the target portal to verify API methods.
Install
Copy the command and run it in a terminal.
npx skills add https:/ / github.com/ bxmaximum/ bitrix-framework-skills --skill bitrix24-rest-apiAfter installing, type/bitrix24-rest-apiin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
rules/auth.mdcalls.mdevents-placements.mdlimits-errors.mdon-premise.mdrest-v3.mdsdk.mdDetails
From the project READMEBitrix24 REST API (client side)
Baseline: Bitrix24 cloud; on-premise main 23.0+ · Verified: rest 26.650.0 (main 26.800.0), b24restdocs 2026-09-30
Consuming REST. Registering your own methods in a module: bitrix-rest. Docs lookup for agents (MCP), Vibecode: bitrix24-ai-tools.
| Task | Read |
|---|---|
| Webhook vs local app vs Marketplace OAuth, token refresh, scopes | rules/auth.md |
| URL and body format, lists, fast pagination, batch | rules/calls.md |
| Limits, error codes, retry and backoff | rules/limits-errors.md |
| Events, outbound webhooks, offline events, placements | rules/events-placements.md |
REST 3.0 (/rest/api/), Idempotency-Key, OpenAPI | rules/rest-v3.md |
| b24phpsdk, b24jssdk, BX24.js, CRest | rules/sdk.md |
| On-premise specifics | rules/on-premise.md |
Invariants
- Never guess a method, field or filter: look it up (MCP from
bitrix24-ai-tools, ormethod.geton the target portal). - Webhook URLs,
client_secret, tokens andapplication_tokenlive in env or a secret store; never in VCS, browser code, logs or shared URLs. - Least privilege: request only the scopes the scenario calls. A call also runs with the rights of its user.
- Detect errors by the
errorkey (andresult.result_errorin batch), not by HTTP status. - Treat every inbound call (event, placement, install) as untrusted until
auth.application_tokenmatches the value stored for itsmember_id. - HTTPS only. Handlers acknowledge fast, queue the work and process it idempotently.