Jul 20, 2026

Neon CRM API: The July 2026 Sunset Broke Old Webhooks

A major gift should reach the development director before it disappears into tomorrow’s report. Carly can send the acknowledgement, surface the donor history, and schedule the personal follow-up that same day. Neon CRM’s memberships, event registrations, and constituent changes can drive the same kind of timely outreach, connected-system updates, and development briefs.

On July 11, 2026, Neon CRM retired API v1 — and its legacy webhook structure along with it. That was nine days ago. If you have webhooks that were never migrated to the newer event triggers, they are not degraded or deprecated. They are silently not firing, right now.

That’s the first thing to check before reading anything else here. Certified Neon One partner integrations were exempt; everyone else had to re-select their event triggers.

(One disambiguation, because search results are a mess: this is Neon CRM by Neon One, the nonprofit constituent database. It is unrelated to Neon.tech, the serverless Postgres company, which dominates results for “neon api.” Everything below comes from developer.neoncrm.com, api.neoncrm.com, or neonone.com.)

What nonprofits actually automate with it

Nineteen event triggers is a genuinely good surface. The jobs worth building on it:

Gift acknowledgements the same day, with the right campaign and soft credit attached, instead of a batch run at month end.
Memberships chased before they lapse rather than after, which is a much easier conversation.
Event registrations that trigger the whole sequence — confirmation, reminders, and the follow-up afterward.
Major gifts escalated immediately so the development director calls while it still counts as prompt.

The thing to check first is whether your webhooks survived July 11 — because if they didn’t, none of the above is currently firing.

Getting a key

Settings cog → User Management → New User → enable the API access toggle → copy the API Key → Create User. Your Org ID is separately under Settings cog → Organization Profile → Account Information.

Both are needed, because auth is HTTP Basic with the Org ID as username and the API key as password.

On plan gating: Neon’s current pricing page carries a heading reading “Build Connections With Our Open API” and states plainly that as a CRM customer you have full access to it. Pricing is revenue-based starting at $99/month.

You’ll find older sources describing an Essentials / Impact / Empower tier structure with the API gated to Impact and above. Those tiers no longer appear on Neon’s pricing page, and that structure traces to a 2023 pricing document. Treat it as stale — the current position is that the API is included for CRM customers.

Auth is Basic, and only Basic

Neon’s docs are blunt about it: “Neon CRM does not support OAuth for authenticating system users.”

You’ll see OAuth and a session-token login flow referenced in places. Both belong to API v1, which is the thing that just got retired. The v2.11 spec still carries a vestigial OAuth2 declaration pointing at a hostname that doesn’t resolve. Don’t build against it.

Base URL https://api.neoncrm.com/v2 (trial orgs use https://trial.neoncrm.com/v2)
Current version is 2.11, released October 2025, selected per request with a NEON-API-VERSION header
Versions 2.0 through 2.8 are deprecated; 2.9, 2.10, and 2.11 are current

Pin the version header. Omitting it defaults to latest, which means Neon shipping 2.12 can change behavior under a running integration without you touching a line of code. And pin to a non-deprecated one — the versions page says all v2 versions are valid and then separately flags 2.0–2.8 as deprecated, which is easy to misread.

Rate limits are concurrency, not requests per minute

This is genuinely unusual and worth understanding before you write a sync. Neon’s docs: “In contrast to other APIs that define rate limits in terms of the number of requests per unit of time, the Neon CRM API defines rate limits in terms of number of requests per thread pool.”

Most endpoints: 5 simultaneous requests
All /search endpoints: 1 — effectively serial
Pools are per-organization and per-endpoint, independent of each other
Over the limit returns 429
There’s no daily quota and no bandwidth cap

The search limit of one is the constraint that will actually shape your design, and it compounds with how search works (below).

What you can write

Broad, genuine CRUD across 165 documented paths. Full create, read, update, patch, and delete on accounts, activities, addresses, campaigns, custom objects, donations, event registrations, events, grants, memberships, opportunities, pledges, recurring donations, shipping addresses, soft credits, timesheets, and webhooks.

Custom fields, groups, households, properties, and roles support everything except PATCH. The store and volunteers endpoints are read-only; orders are GET, POST, and DELETE; payments are GET and POST.

For a nonprofit audience the useful extras are soft credits, pledges with pledge payments, recurring donations, grants, and the volunteer opportunity/shift/timesheet chain — plus membership helpers for calculating fees and dates, renewing, and toggling auto-renewal.

One documentation caveat: the rate-limit table doesn’t list memberships, opportunities, custom objects, grants, or activities. That’s an incomplete table, not an endpoint inventory — don’t conclude those resources lack write paths.

Nineteen webhook triggers, API-manageable

Webhooks here are real outbound push, and they can be managed through the API rather than only the UI — so an integration can subscribe itself without walking an administrator through settings.

The complete trigger list:

Accounts — CREATE_ACCOUNT, UPDATE_ACCOUNT, DELETE_ACCOUNT, plus CREATE_MERGED_ACCOUNT
Donations — CREATE_DONATION, UPDATE_DONATION, DELETE_DONATION
Memberships — CREATE_MEMBERSHIP, UPDATE_MEMBERSHIP, DELETE_MEMBERSHIP
Activities — CREATE_ACTIVITY, UPDATE_ACTIVITY, DELETE_ACTIVITY
Event registrations — CREATE_EVENT_REGISTRATION, UPDATE_EVENT_REGISTRATION, DELETE_EVENT_REGISTRATION
Orders — CREATE_ORDER, UPDATE_ORDER, DELETE_ORDER

One correction worth carrying: Neon’s prose webhooks page lists seven data types including Pledge Payments, but no pledge-payment trigger exists in the 2.11 enum. Trust the spec. If you need to react to a pledge payment, that’s a polling job.

Payloads carry eventTrigger, eventTimestamp, organizationId, data, and customParameters.

Two things to design around. First, retries are up to 3 attempts at 2-second intervals — that’s the entire budget. A receiver down for roughly six seconds loses the event permanently, with no backoff and no replay. Second, there’s no HMAC signing. Verification is optional HTTP Basic credentials plus arbitrary custom parameters, which Neon suggests using to pass a key. That’s weaker than the signature model Stripe or GitHub use, and worth knowing if you’re handling donor data.

The write that isn’t a write

Accounts posted through the API are automatically matched against existing records. Matching name and email are automatically merged. Near-matches — say email and phone match but the name doesn’t — land in a Partial Match Queue that requires a human to resolve under Tools → Duplicates.

So a successful POST /accounts does not mean a new distinct account now exists. It might have merged into an existing one, or it might be sitting in a queue waiting for someone to look at it. Any integration that assumes create-means-created will drift from reality quietly.

Three more:

Search is a report builder, not a query string. Searches are three-part — search fields, output fields, pagination — modeled on Neon’s UI report builder with a fixed operator set. Valid fields have to be discovered at runtime through searchFields and outputFields endpoints, because they vary per organization with custom fields. Combined with the concurrency limit of 1, bulk extraction is inherently serial.
API keys inherit the UI user’s permissions, per method. A least-privilege integration user will 403 in non-obvious places.
Households aren’t accounts. They can’t own transactions or carry custom properties. And “organization accounts” were renamed “company” accounts in 2019 to avoid colliding with the tenant organization — older docs still use the old word.

Getting the event to do something

A donation landing, a membership lapsing, an event registration coming in — nineteen triggers is a real event surface, better than most nonprofit CRMs ship.

Handing it to an AI assistant runs into a specific limit.

These assistants can run on a schedule now — ChatGPT Scheduled Tasks and Claude Cowork both do unattended work on a timer. What none of them do is fire on an event: nothing starts because a record changed, a message landed, or a deadline passed. The schedule is the trigger, and the gap between "every hour" and "the moment it happens" is where the work falls through.

“Summarize this quarter’s giving by campaign” is well within what ChatGPT or Claude will do with a Neon export. “Acknowledge the gift within the hour with the right soft credit attached” is not, because nothing on that side is watching for it.

Carly covers that half:

Fires on the Neon trigger — CREATE_DONATION, UPDATE_MEMBERSHIP, CREATE_EVENT_REGISTRATION
Runs the whole follow-up in one flow — read the record, pull the account, draft the acknowledgement, send it, log the activity
Actually sends — Gmail and Outlook, with attachments
Survives the three-retry ceiling — acknowledging fast and processing asynchronously is exactly what a two-second, three-attempt retry budget demands, and it’s the most common reason hand-rolled receivers lose events

Because Neon CRM exposes a public API, you can connect it natively to Carly from the Integrations tab with your API credentials. Carly can then use Neon CRM in on-demand, recurring, and event-triggered workflows. AI agents start at $35/month, and workflow steps that don’t use AI run free.

Frequently Asked Questions

Did the Neon CRM API v1 sunset break my integration?

If you were using API v1, yes — it was retired July 11, 2026. Critically, the legacy webhook structure was retired at the same time, so webhooks that were never edited to select the newer event triggers have silently stopped firing. Certified Neon One partner integrations were exempt.

Do I need a specific Neon CRM plan for API access?

Neon’s current pricing page states that CRM customers have full access to the open API, with revenue-based pricing starting at $99/month. Older sources describing an Impact-tier gate reference a tier structure that no longer appears on the pricing page.

Does Neon CRM support OAuth?

No. Neon’s docs state directly that OAuth isn’t supported for system users. Authentication is HTTP Basic with your Org ID as the username and API key as the password. OAuth references in older material belong to the retired API v1.

What is the Neon CRM API rate limit?

It’s concurrency-based rather than time-based: 5 simultaneous requests on most endpoints, and only 1 on any /search endpoint. Pools are per-organization and per-endpoint. There’s no daily quota.

What webhooks does Neon CRM support?

Nineteen triggers covering create, update, and delete on accounts, donations, memberships, activities, event registrations, and orders, plus merged accounts. Despite what the prose documentation says, there is no pledge-payment trigger in the current spec. Retries are three attempts at two-second intervals, and payloads aren’t HMAC signed.

Why didn’t my Neon CRM account creation produce a new record?

Neon auto-matches posted accounts against existing ones. Matching name and email merge automatically; near-matches go to a Partial Match Queue needing manual resolution. A successful POST doesn’t guarantee a new distinct account.

More: AI agents for nonprofit directors · Best AI assistant for nonprofits · Bloomerang AI

Ready to automate your busywork?

Carly schedules, researches, and briefs you—so you can focus on what matters.

See what people say

"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.

Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.

On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."

Gus Ibrahim, Founder & Director, IHR