## List contacts

`GET /v1/contacts`

Returns a list of contacts with support for filtering, sorting, and auto-pagination.

## Parameters

| Parameter | Type | Default | Description |
|----------|-----|-----------|---------|
| `limit` | number | `50` | Number of records (up to 5000). Auto-pagination is applied when `limit > 50` |
| `offset` | number | `0` | Skip N records. When `offset > 0`, `limit ≤ 500` is recommended. For a full-collection walk a cursor is cheaper — `order[id]=asc` plus `filter[>id]` from `meta.nextAfterId` |
| `select` | string | — | Field selection: `?select=id,name,lastName,phone` |
| `sort` | string | — | Sorting via the short syntax: `?sort=-lastName`, the minus means descending |
| `order` | object | — | Sorting: `?order[lastName]=asc` |
| `filter` | object | — | Filter by fields from `GET /v1/contacts/fields`.<br>[Filtering syntax](/docs/filtering). Example: `?filter[companyId]=15` |
| `withTotal` | string | — | Whether you need the count: `true` or `false`. `false` — do not request a count. This is the only way to guarantee that `meta.total` is absent from the response. Without the parameter: the API key setting applies, then the platform default — and in that case a short page still carries the exact count even without an explicit request. [Paging and counts](/docs/entity-api#paging-and-record-counts) |

You can also filter by the contact category using `categoryId`, for example `filter[categoryId]=0` in a GET request or `{ "filter": { "categoryId": 0 } }` in the search request body. Use the exact spelling `categoryId`.

## Examples

### curl — personal key

```bash
curl -g "https://vibecode.bitrix24.com/v1/contacts?limit=10&filter[companyId]=15&select=id,name,lastName,phone" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl -g "https://vibecode.bitrix24.com/v1/contacts?limit=10&filter[companyId]=15&select=id,name,lastName,phone" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/contacts?limit=10&filter[companyId]=15&select=id,name,lastName,phone', {
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
  },
})

const { success, data, meta } = await res.json()
console.log(`Found ${meta.total} contacts`)
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/contacts?limit=10&filter[companyId]=15&select=id,name,lastName,phone', {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})

const { success, data, meta } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|---------|
| `data` | array | Array of contacts (fields — see [Fields](/docs/entities/contacts/fields)) |
| `meta.total` | number | Total number of records. An optional field: if no count was requested, it is absent from the response |
| `meta.hasMore` | boolean | More records available |
| `meta.nextAfterId` | string | The identifier of the last returned record. Returned when the sort is strictly `id` ascending, while `hasMore` is `true`. Pass it back as `filter[>id]` — a cheap replacement for a growing `offset` |

The card URL of any contact from the `data` array is built from its `id`:

```
https://<portal>.bitrix24.com/crm/contact/details/<id>/
```

`<portal>` — the Bitrix24 portal domain. Access is restricted by the employee's permissions in Bitrix24.

## Response example

```json
{
  "success": true,
  "data": [
    {
      "id": 17,
      "name": "John",
      "lastName": "Brown",
      "phone": "12025550123",
      "email": "john@example.com",
      "companyId": 1,
      "assignedById": 1,
      "sourceId": "EMAIL",
      "typeId": "CLIENT"
    }
  ],
  "meta": {
    "total": 1167,
    "hasMore": true
  }
}
```

## Error response example

403 — no scope:

```json
{
  "success": false,
  "error": {
    "code": "SCOPE_DENIED",
    "message": "This endpoint requires 'crm' scope"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 403 | `SCOPE_DENIED` | API key lacks the `crm` scope |
| 401 | `TOKEN_MISSING` | API key has no configured tokens |
| 429 | `RATE_LIMITED` | Rate limit exceeded: 300 requests per minute per portal. All API keys of the portal share one limit. The current limit is returned in the `x-ratelimit-limit` header. Retry after the delay in the `Retry-After` header |

For the full list of common API errors, see [Errors](/docs/errors).

## Known specifics

**The phone filter is not suitable for every search.** A value without an operator is compared against the whole stored string: a contact whose number is stored as `+1 (202) 555-0123` matches that exact string, but not `12025550123`, because the plus sign, spaces, parentheses, and hyphens are part of the value. The filter also checks only the first number stored on a record: if both a work number and a mobile number are stored, searching by the mobile one returns an empty list. To find a contact by phone number in any format and by any of its numbers, use [Duplicate search](/docs/duplicates).

**Email addresses by type.** Besides `email` with the primary value, a contact returns three expanded fields — `emailWork`, `emailHome`, and `emailMailing`. You can list them in `select` and filter by them: `?select=id,name,emailWork` and `?filter[emailWork]=info@example.com`. An address is written through `email` only, so these three fields are read-only. When the contact has no address of that type, `null` comes back.

**Auto-pagination:** when `limit > 50`, Vibecode automatically requests multiple pages.

**When to use search.** For compound conditions, use `POST /v1/contacts/search` — parameters are passed in the request body. See [Search contacts](/docs/entities/contacts/search).

## See also

- [Search contacts](/docs/entities/contacts/search)
- [Create contact](/docs/entities/contacts/create)
- [Duplicate search](/docs/duplicates)
- [Filtering syntax](/docs/filtering)
- [Batch](/docs/batch)
- [Limits and optimization](/docs/optimization)