HighLevel API v2 lets your tools read and write contacts, calendars, opportunities, and conversations from outside the app. Every call goes to services.leadconnectorhq.com with a Bearer token and a Version header. Most 400 errors come from a missing locationId, a missing Version header, an old v1 endpoint, or a field in the wrong format.

Many marketing managers describe a week like this one (a composite of common cases). Her team books appointments through a Zapier automation, and one Monday the bookings stop reaching the CRM. Zapier shows “Request failed with status code 400.” She opens the GoHighLevel API docs, sees words like scopes and payloads, and closes the tab. Leads keep coming in, and she fears rebuilding every automation from scratch. On her first call with a web team, the developer asks for the error details instead of the whole setup. Together they read one line in the response that names a missing field. She realizes a 400 error points to one fixable detail, not a broken system.

What Is the GoHighLevel API and What Can It Do?

The HighLevel API is the official REST interface for moving data in and out of a sub-account or agency account. Tools use it to create contacts, book appointments, update pipelines, send messages, and sync data.

Short Answer: HighLevel API v2 uses the base URL https://services.leadconnectorhq.com, JSON requests, and two login options: a Private Integration token for one account or OAuth 2.0 for Marketplace apps. Every request needs an Authorization Bearer token and a Version header such as 2021-07-28.

Good integrations are a big part of choosing the right digital marketing platform.

API v1 vs API v2

HighLevel’s help center states that API v1 reached end of support on 31 December 2025. Existing v1 connections keep working, but HighLevel no longer supports or updates them. New builds should use API v2, which adds scoped permissions and stronger security.

Which Plans Include API Access

The official HighLevel API documentation article says API access comes with all plans, including Starter, Unlimited, and Agency Pro. A few agency endpoints, such as Create Sub-Account, require Agency Pro.

How Does HighLevel API Authentication Work?

HighLevel API v2 authentication uses either a Private Integration token or OAuth 2.0. A Private Integration token suits one agency or sub-account using its own data. OAuth 2.0 suits Marketplace apps that many sub-accounts install.

Private Integration Token

A private integration token works like a fixed API key with chosen permissions. Here is how to create one:

  1. Open Settings and select Private Integrations. If you do not see it, turn the feature on in Labs.
  2. Click Create new Integration and give it a clear name.
  3. Select only the scopes your automation needs.
  4. Copy the token right away and store it in a password manager or your server settings.

HighLevel recommends rotating each token every 90 days, and the old token keeps working for 7 days after a rotation.

OAuth 2.0 for Marketplace Apps

OAuth 2.0 fits apps that agencies install across many sub-accounts. Your app uses a Client ID and Client Secret, receives an access token and a refresh token at install, and refreshes the access token before it expires.

Which v2 Endpoints, Headers and IDs Do You Need?

Every HighLevel API v2 request needs the base URL, a Bearer token in the Authorization header, a Version header, and usually a location ID. The Version header tells HighLevel which version of the endpoint you expect, and many 400 errors start when that header goes missing.

The HighLevel Private Integrations documentation shows this example request:

curl –request GET \

  –url https://services.leadconnectorhq.com/locations/YOUR_LOCATION_ID \

  –header ‘Accept: application/json’ \

  –header ‘Authorization: Bearer YOUR_TOKEN’ \

  –header ‘Version: 2021-07-28’

For POST and PUT requests, also send Content-Type: application/json.

How to Find Your Location ID

The location ID identifies one sub-account. Copy it from your browser address bar after /location/, or from Settings, then Business Profile.

Common v2 Endpoints

Most integrations use contacts, opportunities, calendar events, conversations, and locations. Pulling this data into dashboards also powers automated business reporting.

Why Does HighLevel Return a 400 Error?

HighLevel returns a GoHighLevel 400 error when it cannot accept the shape or content of your request. A 400 error is not a login problem. HighLevel usually rejects the request before it checks permissions or looks up the record.

Short Answer: A HighLevel 400 Bad Request means the request itself has a mistake, such as a missing field, a wrong format, or an old endpoint. The response body usually names the field at fault, so read it before you change anything else.

Here are the most common causes:

  • Missing locationId in the body or query.
  • Missing Version header, such as Version: 2021-07-28.
  • An old v1 endpoint or the wrong method, such as POST where the endpoint expects PUT.
  • Wrong formats, such as phone numbers without a country code (use +15551234567) or dates outside ISO 8601.
  • Custom field IDs from a different sub-account. Each sub-account has its own IDs.
  • Values outside the allowed list, such as an appointment status HighLevel does not recognize.
  • Broken JSON, such as a stray comma or a number sent as text.
  • Timing. A new sub-account can return “location not found” for a minute or two after you create it, so add a short delay before the next step.

How to Fix a 400 Error in Zapier, n8n and Webhooks

The fastest way to fix a 400 error is to read the full response body, then test the smallest possible request that works. Rebuild the request field by field until the error returns, and the last field you added shows the problem.

Follow these steps in order:

  1. Read the error body in the Zapier, n8n, or Make execution log.
  2. Check headers. Confirm the Bearer token, the Version header, and Content-Type: application/json.
  3. Send only required fields in Postman, then add fields back one at a time.
  4. Check IDs per sub-account. Confirm the location ID, custom field IDs, and calendar or pipeline IDs.
  5. Refresh field mappings. A Zapier GoHighLevel error often appears after someone renames a field in HighLevel, so remap the step.
  6. Check webhook payloads. For an inbound GoHighLevel webhook, send JSON and match the field names your workflow expects.

Other Status Codes You Might See

Each code points to a different fix:

  • 401: missing, wrong, or expired token.
  • 403: the token lacks a scope or belongs to another account.
  • 404: wrong path or an ID from another sub-account. Pages and funnels have their own causes, covered in our guide to fixing GoHighLevel 404 errors.
  • 422: the body passed basic checks but failed validation.
  • 429: you hit the rate limit.
  • 5xx: a HighLevel server problem. Retry after a short wait.

How to Keep a HighLevel Integration Stable

A stable HighLevel integration respects rate limits, keeps tokens safe, and logs every failed request. HighLevel allows 100 requests per 10 seconds and 200,000 requests per day for each app on each sub-account or agency.

These habits prevent most breakages:

 

  • Watch the X-RateLimit-Remaining and X-RateLimit-Daily-Remaining response headers.
  • Retry 429 responses with a growing wait, such as 1, 2, then 4 seconds.
  • Use webhooks for new events instead of checking for changes every minute.
  • Keep tokens on a server, never in website code.
  • Test changes in a test sub-account first.

For a custom integration or an AI agent built on HighLevel data, AI custom development connects the pieces properly.

Getting the CRM, lead generation, and campaigns to work together also needs solid marketing services.

Conclusion

HighLevel API v2 follows a clear pattern: one base URL, a Bearer token, a Version header, and the right location ID. Most 400 errors trace back to one missing or badly formatted detail, and the response body usually names it. Read that message, test a minimal request, and add fields back one at a time. Then protect your tokens and respect rate limits.

If you would like a second pair of eyes on a stubborn integration, talk with our team in plain language.

Related Reading

Frequently Asked Questions

Is the GoHighLevel API free?

HighLevel does not charge a separate fee for API access. Its help center says all plans, including Starter, Unlimited, and Agency Pro, include API access, while a few agency endpoints need Agency Pro. Check the endpoint pages in the developer docs to confirm what your plan covers before you build.

Where do I find my HighLevel API key?

In API v2, a Private Integration token replaces the old API key. Open Settings, select Private Integrations, and click Create new Integration. Choose only the scopes you need and copy the token right away. If Private Integrations does not appear, turn it on in Labs first.

Is HighLevel API v1 still working?

HighLevel ended support for API v1 on 31 December 2025. Existing v1 connections keep working for now, but HighLevel no longer fixes or updates them. Move any v1 automation to API v2 to keep support. Old tutorials often show v1 steps, so check that the base URL reads services.leadconnectorhq.com before you copy them.

Does a 400 error mean my token is wrong?

No. A token problem returns 401 or 403. A 400 error means HighLevel could not accept the request itself, usually because of a missing locationId, a missing Version header, a wrong field format, or an old endpoint. Read the response body to find the exact field.