Real Estate CRM APIs, Webhooks and MCP (2026): A Buyer's Guide for Technical Teams

Most real estate CRM evaluations in India are run by sales and marketing heads. The demo looks good, pricing gets agreed, and then, two weeks before go-live, someone from IT asks whether the portal lead feed can be pushed in over an API. The project stalls for a quarter.

That question belongs at the start of an evaluation, not the end. A developer running six projects across two cities will eventually need the CRM to talk to a website, a Meta lead-ads account, three property portals, a WhatsApp BSP, a payment gateway and Tally. Every link that cannot be built cleanly becomes a spreadsheet, and every spreadsheet becomes lead leakage.

This is the technical half of that evaluation: what to ask, which answers should worry you, and what changed in 2026.

What changed in 2026: agents are now an integration surface

Until recently, "integration" meant a REST API and maybe a Zapier connector. There is now a third layer: the Model Context Protocol (MCP), an open standard that lets AI agents call a system's tools directly instead of scraping its interface. Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation in December 2025, making it vendor-neutral, and by July 2026 roughly 78% of enterprise AI teams reported MCP-backed agents in production. Forrester expects 30% of enterprise application vendors to ship their own MCP servers.

For a real estate CRM this is not abstract. An MCP layer is what lets a sales head ask, in plain language, which Baner leads from last week's Meta campaign have not been called in 24 hours, and get the answer out of the CRM rather than out of an export. It is also the practical difference between an AI-agentic CRM that can act on your data and a chatbot bolted onto a dashboard.

The API questions that actually separate vendors

1. Is the documentation public?

Ask for the developer documentation URL before the commercial conversation, not after it. A vendor that publishes REST docs openly has an API stable enough to publish. If documentation only appears after an NDA, or inside a paid "integration package", assume the API is a thin wrapper built per customer and budget the integration accordingly.

2. Rate limits, per what?

"We have an API" is not an answer. Ask for the limit in requests per minute, whether it is scoped per token, per user or per account, and what happens on breach: a 429 with a Retry-After header, or a silent drop. A launch weekend where 4,000 leads land in six hours will find the answer for you if you do not find it first.

3. Webhooks, or polling?

Polling a CRM every five minutes for new leads is how teams discover that speed-to-lead is a technical problem, not a discipline problem. Insist on outbound webhooks for the events that matter: lead created, stage changed, site visit scheduled, booking confirmed. Then ask the follow-ups nobody volunteers. Are payloads signed? How many retries, over what window? Is there a replay endpoint for events missed during a deploy?

4. Can you write, or only read?

Plenty of "open" CRMs will let you export leads and very little else. Confirm you can create and update leads, attach a source and campaign, push unit and inventory status, and write a call or WhatsApp activity back onto the lead timeline. A read-only API means the CRM can never be your system of record, only a reporting copy of one.

5. Do source and campaign tags survive the API?

This is the one Indian developers get burned on. A lead created through the API with no source, no campaign ID and no channel-partner reference is a lead that will never appear correctly in a cost-per-booking report, however good the dashboards look. Ask to see the lead-creation payload schema and confirm attribution fields are first-class, not custom fields you have to invent and then maintain. In Sell.do, source, sub-source, campaign and CP reference are part of the lead-creation contract, because source-to-booking attribution stops working the moment they are optional.

The six webhooks an Indian real estate stack really needs

• Meta Lead Ads. The leadgen webhook, so Instagram and Facebook form fills land in the CRM in seconds instead of a CSV downloaded the next morning.
• Google Ads lead form extensions. Webhook delivery with a shared key, mapped to the right project and campaign at the point of capture.
• Property portals. Ask how the CRM handles 99acres, MagicBricks and Housing leads specifically, because each pushes differently, some by API and some by email parsing, and duplicate detection across them is where most portal spend quietly evaporates.
• WhatsApp Business API. Inbound message and template-status callbacks through your BSP, so a buyer's reply reopens the lead instead of sitting in a separate inbox nobody owns.
• Payment gateway. Token and booking-amount receipts written back onto the booking record, so collections status is not reconstructed from bank statements.
• Finance and ERP. A scheduled export or webhook into Tally or SAP so receipts and demand letters are not re-keyed by an accounts executive at month end.

If a vendor can only demonstrate the first two, you are looking at a marketing CRM with a real estate label on it.

MCP: three questions for the 2026 evaluation sheet

• Does the vendor run an MCP server, and is it documented alongside the REST API rather than pitched as a roadmap item?
• What is the permission model? Does an agent inherit the logged-in user's role and record visibility, or does it get a blanket service token?
• Is it read-only, or can an agent also act, reassigning a lead, scheduling a site visit, logging a follow-up, with an audit trail on every write?

The second question matters most. An MCP server that ignores the CRM's role hierarchy will happily let a channel-partner login ask about another CP's leads, and you will not find out until a payout dispute. Sell.do's MCP server and developer platform enforce the same role and record-visibility rules the product applies in the interface, which is the only defensible way to expose an agentic layer over lead data.

Data ownership, export and DPDP

India's Digital Personal Data Protection Rules were notified on 13 November 2025, with staged enforcement running to 14 May 2027 and penalties of up to Rs 250 crore for serious violations once the transition period closes. Two obligations land directly on whichever CRM holds your buyer data: portability, meaning personal data exportable in a machine-readable format such as JSON or CSV, and erasure, meaning a documented and automatable deletion workflow rather than an email to support.

So ask three things. Can you export every lead, activity, call recording and booking yourself, without raising a ticket? Is deletion available over the API, or is it a manual request with a 30-day SLA? And where is the data hosted, because a developer carrying RERA record-retention obligations and an India-resident buyer base usually needs that answer to be India.

SSO, roles and audit

• SSO over SAML or OIDC, so a departing presales executive loses CRM access the moment their Workspace account is disabled, not three weeks later after an offboarding checklist surfaces.
• Role-based visibility enforced at the API layer, not only in the interface. Ask the vendor to prove it live with a token scoped to a junior user.
• An audit log that covers API writes and records which token did what. Channel-partner payout disputes are usually settled by this log, or lost for want of it.

A one-page scoring sheet

• Public REST documentation, reachable without an NDA
• Published rate limits and documented 429 behaviour
• Signed outbound webhooks with retries and replay: count the supported events
• Lead-create payload carries source, campaign and channel-partner reference natively
• Native connectors for Meta, Google, the portals you actually buy from, and your WhatsApp BSP
• MCP server with role-aware permissions and write auditing
• Self-serve full export plus a deletion API, with India data residency
• SAML or OIDC SSO and an API-level audit log
• What is included in the base licence versus billed as an integration add-on

That last line is where the surprises live. Integration and API access are among the biggest swing factors in real estate CRM pricing in India, and a licence that looks cheap per seat can double once every connector is quoted separately.

Related reading

• Sell.do vs LeadSquared vs Zoho: Which Real Estate CRM Actually Fits Indian Developers?
• Real Estate CRM with Inventory Management: One System for Leads and Units (2026)
• Real Estate Lead Leakage: Where Brokers Lose Deals and How to Plug Every Gap (2026)

If your evaluation has reached the integration questions, the fastest way to settle them is to read the documentation and call the endpoints yourself rather than take a slide's word for it. See the AI-agentic CRM built for Indian real estate, including the REST API, webhooks and MCP server, at sell.do. Bring your integration list to a walkthrough and we will work through it endpoint by endpoint.