Guest API

Everything a view calls funnels through one client — @conexus-x/sdk’s default export. No fetch, no token and no CRM base URL anywhere in this package on purpose: a view that cannot address the API directly is a view that cannot be tricked into addressing it with someone else’s credentials.

import conexus from "@conexus-x/sdk";

const cx = conexus();
const { context, settings, grantedScopes } = await cx.connect();

Connection

Subscribing

cx.listen(topic, handler) subscribes to a host push and returns the unsubscribe function — handing it straight back as a React effect’s cleanup is the whole reason it is shaped this way.

Reading and writing data

cx.api.* are typed helpers over the same allowlist described in Scopes & routes — thin on purpose, they build a path and hand back the unwrapped payload.

const records = await cx.api.records.list(context.collectionId);

if (cx.hasScope("records:write")) {
    await cx.api.records.update(records[0]._id, { isCompleted: true });
}

cx.api.modules

list(workspaceId) · create(workspaceId, body) · update(moduleId, body) · remove(moduleId)

cx.api.collections

list(moduleId) · create(moduleId, body) · update(collectionId, body) · remove(collectionId)

cx.api.columns

list(moduleId) · create(moduleId, body) · update(columnId, body) · remove(columnId)

cx.api.records

list(collectionId) · create(collectionId, body) · update(recordId, body) · remove(recordId) · subRecords(recordId) · createSubRecord(recordId, body)

cx.api.values

forRecord(recordId) · set({ record, column, value }) · update(recordValueId, { value }) · clear(recordValueId)

cx.api.amendments

list(recordId) · post(recordId, { message, parentComment? })

cx.api.members / cx.api.activity

members.list(workspaceId) and activity.list(workspaceId, query?) — both read-only; there is no members/activity write surface for a view at all.

The raw call

cx.request({ method, path, query, body }) reaches an endpoint the typed helpers do not cover yet — still checked against the exact same allowlist and scopes.

Commands — asking the host to do something

Things only the host can do, because they touch chrome the iframe cannot reach. An unimplemented command rejects with command_unsupported rather than resolving quietly, so a view can feature-detect instead of assuming it worked.

Storage

cx.storage.get/set/delete/keys — a small key-value store scoped to THIS mount of the view. For view state (a chosen grouping, a collapsed panel), not customer data.

Sizing itself

cx.autoResize(element?) keeps the iframe as tall as its content, via a ResizeObserver. Opt-in — a view that draws its own scroll area does not want it.

Errors

Every failure rejects with a ConexusError carrying a code. Branch on the code — the message is for your console and may be reworded.