For AI agents: markdown of this page — /docs-content-en/entities/contacts/search.md documentation index — /llms.txt

Search contacts

POST /v1/contacts/search

Search contacts by conditions in the request body. Accepts the same filters as the contact list and is designed for compound conditions and large result sets.

Request fields (body)

Parameter Type Default Description
filter object — Filtering by GET /v1/contacts/fields fields.
Filtering syntax. Example: { "companyId": 15 }
limit number 50 Number of records (up to 5000)
offset number 0 Skip N records. Together with a date-range filter wider than 14 days it is rejected — see UNSTABLE_OFFSET_PAGINATION in the "Errors" section
order object — Sorting: { "lastName": "asc" }
select string[] — Field selection: ["id", "name", "lastName", "phone"]

Examples

curl — personal key

Terminal 
curl -X POST "https://vibecode.bitrix24.com/v1/contacts/search" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": { "companyId": 15 },
    "limit": 10,
    "order": { "lastName": "asc" }
  }'

curl — OAuth app

Terminal 
curl -X POST "https://vibecode.bitrix24.com/v1/contacts/search" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": { "companyId": 15 },
    "limit": 10,
    "order": { "lastName": "asc" }
  }'

JavaScript — personal key

javascript 
const res = await fetch('https://vibecode.bitrix24.com/v1/contacts/search', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    filter: { companyId: 15 },
    limit: 10,
    order: { lastName: 'asc' },
  }),
})

const { success, data } = await res.json()

JavaScript — OAuth app

javascript 
const res = await fetch('https://vibecode.bitrix24.com/v1/contacts/search', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    filter: { companyId: 15 },
    limit: 10,
    order: { lastName: 'asc' },
  }),
})

const { success, data } = await res.json()

Response fields

Field Type Description
data array Array of contacts (fields — see Fields)
meta.total number How many records matched the filter
meta.hasMore boolean Whether there is a next page
meta.nextAfterId string The identifier of the last returned record. Returned when the sort is strictly id ascending, while hasMore is true. Pass it back in the >id filter — a cheap replacement for a growing offset
meta.durationMs number Request duration in milliseconds

The meta fields sit next to data, not inside it. Pages must be walked using meta.hasMore: a data length equal to limit does not rule out the last page.

The card URL of any contact from the data array is built from its id:

https://<portal>.bitrix24.com/crm/contact/details/<id>/

<portal> — the Bitrix24 portal domain. Access is restricted by the employee's permissions in Bitrix24.

Response example

JSON 
{
  "success": true,
  "data": [
    {
      "id": 71,
      "name": "John",
      "lastName": "Brown",
      "phone": "12025550123",
      "companyId": 15,
      "assignedById": 1,
      "typeId": "CLIENT"
    }
  ]
}

Error response example

403 — no scope:

JSON 
{
  "success": false,
  "error": {
    "code": "SCOPE_DENIED",
    "message": "This endpoint requires 'crm' scope"
  }
}

Errors

HTTP Code Description
400 UNSTABLE_OFFSET_PAGINATION offset greater than zero together with a date-range filter wider than 14 days. Two different retrieval algorithms produce inconsistent results, so the request is rejected. Take everything in a single request with limit up to 5000, or pass autoWindow: false with sorting by id, or split the date range into parts yourself
403 SCOPE_DENIED API key lacks the crm scope
401 TOKEN_MISSING API key has no configured tokens
429 RATE_LIMITED Rate limit exceeded: 300 requests per minute per portal, all API keys of the portal share one limit. The exact value arrives in the x-ratelimit-limit header (the cap is divided across replicas). Retry after the delay in the Retry-After header

Full list of common API errors — Errors.

Known specifics

Email addresses by type. Besides email with the primary value, a contact returns three expanded fields — emailWork, emailHome, and emailMailing. You can list them in select and filter by them: "select": ["id", "name", "emailWork"] and "filter": { "emailWork": "info@example.com" }. The $contains operator works on them too. An address is written through email only, so these three fields are read-only. When the contact has no address of that type, null comes back.

The phone filter is not suitable for every search. A value without an operator is compared against the whole stored string: a contact whose number is stored as +1 (202) 555-0123 matches that exact string, but not 12025550123, because the plus sign, spaces, parentheses, and hyphens are part of the value. The filter also checks only the first number stored on a record: if both a work number and a mobile number are stored, searching by the mobile one returns an empty list. To find a contact by phone number in any format and by any of its numbers, use Duplicate search. The $contains operator does work here — it matches a substring inside the value, which makes it a practical approach for email: { "email": { "$contains": "@example.com" } }.

See also