Laravel CRM

Laravel CRM provides a comprehensive suite of tools for managing business operations, including:

• Sales & Leads: Sales leads management, deal management, quote builder (with accept/reject functionality), and Kanban boards.
• Operations: Orders & Invoicing, Purchase orders, and Deliveries.
• Communication: Web/In-app Chat, Email marketing, and SMS marketing.
• Data Management: Customer and Contact database management, Products & Product Categories, Custom fields, and Activity Feeds/Timelines.
• Organization: Notes, Tasks, File uploads, and Users & Teams.
• Security: Secure registration/login and Roles & Permissions (powered by spatie/laravel-permission).
• Integrations: Xero and ClickSend.

The venturedrake/laravel-crm-filament plugin is a UI wrapper that sits on top of the venturedrake/laravel-crm core. It does not duplicate business logic; instead, it delegates all data operations to the core services.

Key Integration Points:

• Data Persistence: Filament Resources use FormPayload to wrap form data, ensuring that existing core services (like LeadService) can access data using $request->property syntax.
• Routing: Resources use getRecordRouteKeyName() to return external_id, ensuring compatibility with the core's identification system.
• Lifecycle: Page hooks (like mutateFormDataBeforeCreate) delegate to core services to ensure that observers, number generation, encryption, and audit logs are triggered exactly as they are in the legacy UI.
• Access Control: The plugin reuses existing Laravel Policies defined in the core package.

When interacting with the API, adhere to the following data formats:

• IDs: All entity IDs are UUIDs. The JSON id field is the entity's external_id. Lookup tables (e.g., industry, pipeline stage) accept integer IDs.
• Money: All amount, price, and total fields are sent and returned as decimal dollars (e.g., 1500.50). The system handles conversion to cents internally.
• Timestamps: Use ISO-8601 with timezone offset (e.g., 2026-07-15T10:00:00+00:00 or 2026-07-15T10:00:00Z).
• Pagination: Use ?per_page=N (1–100, default 25). Responses use the standard Laravel pagination envelope (data, meta, links).
• Sorting: Use ?sort=field for ascending and ?sort=-field for descending. Unknown columns are ignored. Default is -created_at.
• Filtering: Supported on list endpoints: ?user_owner_id=<int> and ?active= (for products).

If the host application has teams enabled (config('laravel-crm.teams', true)), you can control the request context using the X-Team-ID header.

• Without X-Team-ID: Requests are scoped to the user's current_team_id.
• With X-Team-ID: The request runs in the context of the specified team for list, store, update, and delete endpoints. The ID must be a team the user belongs to, otherwise the API returns 403 Forbidden with the message "You are not a member of the requested team.".

Note on Single Resource Lookups: GET /{resource}/{uuid} resolves using the user's default current team due to Laravel's binding lifecycle. To find the correct UUID for a specific team, use the list endpoints with the X-Team-ID header.

Pass your Sanctum token in the Authorization header using the Bearer scheme.

Required Headers:

• Authorization: Bearer <token>
• Accept: application/json (Recommended)
• Content-Type: application/json (Required for POST/PUT)

Auth Management Endpoints:

• GET /crm/api/v2/auth/me: Returns the authenticated user's details.
• DELETE /crm/api/v2/auth/token: Revokes the current token.

GET /crm/api/v2/leads HTTP/1.1
Authorization: Bearer 1|abcdef1234...
Accept: application/json

This upgrade enforces server-side authorization on all mutating actions. Previously, custom roles with only view permissions (e.g., view crm leads without edit crm leads) could still perform edits via the UI because the server did not check permissions. Now, these actions will return 403 Forbidden and the corresponding UI buttons will be hidden.

Before upgrading, audit your custom roles to ensure users who need to perform actions have the appropriate create, edit, or delete permissions assigned.

Audit Command Use this Tinker command to list custom roles (excluding stock roles) and their current permissions:

Spatie\Permission\Models\Role::where('crm_role', 1)
    ->whereNotIn('name', ['Owner', 'Admin', 'Manager', 'Employee'])
    ->get()
    ->mapWithKeys(fn ($r) => [$r->name => $r->permissions->pluck('name')]);

php artisan tinker

To develop or use the Filament v5 plugin alongside the core Laravel CRM, you must configure your host application (e.g., a Laravel 13 project) to treat both the core package and the Filament plugin as Composer path repositories. This allows both packages to be symlinked and editable live during development.

In your host application's composer.json, define both the core CRM and the Filament plugin under the repositories key using the path type.

"repositories": [
    {
        "type": "path",
        "url": "../laravel-crm"
    },
    {
        "type": "path",
        "url": "../laravel-crm-filament"
    }
]

The LaravelCrmPlugin is used to register CRM resources, widgets, and modules within a Filament Panel. You can customize which modules are active using fluent method calls.

In your PanelProvider (e.g., app/Providers/Filament/CrmPanelProvider.php), use the plugin() method to attach the CRM plugin. You can enable specific modules like Chat, Xero, or Marketing using the provided helpers.

->plugin(
    LaravelCrmPlugin::make()
        ->modules([/* custom module list */])
        ->withChat()
        ->withXero()
        ->withEmailMarketing()
        ->withSmsMarketing()
        ->brand('Your Brand Name')
        ->navigationGroup('CRM Management')
)

The API is included with the package. To enable it, you must configure Laravel Sanctum in your host application.

1. Publish and run Sanctum migrations to create the personal_access_tokens table:

   php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
   php artisan migrate

2. Add HasApiTokens to your host User model:

   use Laravel\Sanctum\HasApiTokens;
   
   class User extends Authenticatable
   {
       use HasApiTokens;
       // ...
   }

3. Verify routes: Run php artisan route:list --path=crm/api to ensure the 8 resourceful entities and 3 auth routes are loaded.