# erxes

> Open-source Experience Operating System (XOS) that unifies marketing, sales, operations and support in one self-hostable platform, positioned as a replacement for HubSpot, Zendesk, Linear and Wix. The machine surface is a GraphQL Federation API served by an Apollo Router gateway; there is no REST API and no OpenAPI. erxes is AGPL-3.0 with a proprietary Enterprise Edition, and ships ~one release per merge day (3.0.79, 2026-08-13).

GENERATED by the API Evangelist enrichment pipeline on 2026-08-13. erxes serves no llms.txt of its own — /llms.txt returns the marketing SPA shell on erxes.io and 404 on www.erxes.io and docs.erxes.io.

## How to call it

- Endpoint: `POST <gateway>/graphql`
- SaaS gateway pattern: `https://<subdomain>.next.erxes.io/gateway/graphql`
- Self-hosted: Apollo Router on `:4000` in dev; nginx proxies `/gateway/` to `127.0.0.1:3300` in the published production layout
- Required headers: `Content-Type: application/json`, `Authorization: Bearer <accessToken>`, `erxes-subdomain: <subdomain>`
- `erxes-subdomain` must NOT be sent on OAuth token/refresh requests — the gateway infers the tenant from the host
- Auth: OAuth 2.0 Device Authorization Grant (RFC 8628). Confidential clients for the agent plugin, public clients for the CLI. Access token TTL 28800s; device code TTL 600s; refresh tokens rotate. Clients are created per tenant in Settings > OAuth Clients.
- GraphQL introspection is DISABLED on the gateway (`INTROSPECTION_DISABLED`)
- A GraphQL error can arrive with HTTP 200 — never treat the status code alone as success
- There is NO idempotency key. Retrying a mutation creates a duplicate record.

## Agent surfaces

- [erxes agent plugin (erxes-next-plugin v1.0.23)](https://github.com/erxes/erxes-skills) — provider-published OpenClaw/Clawhub agent plugin with operating instructions, an OAuth session manager and explicit anti-hallucination rules
- [erxes dev skills](https://github.com/erxes/erxes-dev-skills) — ~30 SKILL.md files for building erxes plugins (codebase contribution, not API consumption)
- [AGENTS.md](https://github.com/erxes/erxes/blob/main/AGENTS.md) — repository-wide agent/contributor guide with nested-file resolution and tenant-isolation rules
- No MCP server. No A2A agent card. No llms.txt.

## APIs

- [erxes GraphQL API](https://erxes.io/docs/introduction) — federated gateway over contacts, companies, products, tags, documents, brands, org structure, team members, automations, plus the sales, frontline, operation and block plugin subgraphs

## Specs

- [graphql/erxes-schema.graphql](graphql/erxes-schema.graphql) — harvested core SDL, 128 types, Apollo Federation `@key(fields: "_id")`
- [graphql/erxes-graphql.md](graphql/erxes-graphql.md) — architecture and auth overview
- No OpenAPI. No AsyncAPI. No Protobuf.

## Artifacts

- [authentication/erxes-authentication.yml](authentication/erxes-authentication.yml) — OAuth device flow, confidential vs public clients, tenant header
- [scopes/erxes-scopes.yml](scopes/erxes-scopes.yml) — 34 published OAuth scopes plus the CLI public-operation identifiers
- [conventions/erxes-conventions.yml](conventions/erxes-conventions.yml) — pagination (both cursor and page/perPage), error envelope, versioning, no idempotency
- [errors/erxes-error-codes.yml](errors/erxes-error-codes.yml) — 14 typed automation error codes and their documented resolution order
- [rate-limits/erxes-rate-limits.yml](rate-limits/erxes-rate-limits.yml) — the only enforced limits (webhook 100/min, continue 20/min) with real `RateLimit-*` headers
- [asyncapi/erxes-webhooks.yml](asyncapi/erxes-webhooks.yml) — incoming/outgoing automation webhooks and GraphQL subscriptions
- [data-model/erxes-data-model.yml](data-model/erxes-data-model.yml) — entity graph derived from the SDL
- [lifecycle/erxes-lifecycle.yml](lifecycle/erxes-lifecycle.yml) — semver releases, status page, no deprecation policy
- [changelog/erxes-changelog.yml](changelog/erxes-changelog.yml) — recent release window
- [packages/erxes-packages.yml](packages/erxes-packages.yml) — SDKs and their real registry currency
- [cli/erxes-cli.yml](cli/erxes-cli.yml) — first-party CLI command surface
- [components/erxes-components.yml](components/erxes-components.yml) — messenger and form widgets, native SDKs
- [conformance/erxes-conformance.yml](conformance/erxes-conformance.yml) — standards posture
- [security/erxes-domain-security.yml](security/erxes-domain-security.yml) — TLS/DNS posture
- [security/erxes-vulnerability-disclosure.yml](security/erxes-vulnerability-disclosure.yml) — SECURITY.md policy, 90-day disclosure
- [plans/erxes-plans-pricing.yml](plans/erxes-plans-pricing.yml) — tiers and quotas; no prices published
- [skills/_index.yml](skills/_index.yml) — the provider's own agent skills, saved verbatim

## Docs

- [Introduction](https://erxes.io/docs/introduction)
- [Developer docs](https://docs.erxes.io/) — self-hosting, local setup, plugin development, create-plugin, contributing
- [Self-hosting](https://docs.erxes.io/self-hosting)
- [erxes Messenger install](https://erxes.io/docs/erxes-messenger)
- [Changelog](https://erxes.io/changelog) · [Releases](https://github.com/erxes/erxes/releases)
- [Roadmap](https://erxes.io/roadmap) — route exists, content empty as of 2026-08-13
- [Status](https://status.erxes.io)
- [Discussions](https://erxes.io/discussions) · [Discord](https://discord.com/invite/aaGzy3gQK5)
- [GitHub organization](https://github.com/erxes)
- [Pricing](https://erxes.io/pricing/self-service/frontline) · [Sign up](https://erxes.io/auth/signup) · [Log in](https://erxes.io/auth/login)
- [Terms](https://erxes.io/legal/terms) · [Privacy](https://erxes.io/legal/privacy) · [GDPR](https://erxes.io/legal/gdpr)

## Known gaps

- No OpenAPI, no AsyncAPI, no MCP server, no A2A agent card, no llms.txt, no /.well-known/ documents on any host
- GraphQL introspection disabled, so no live schema is fetchable
- No idempotency contract; no deprecation policy; no Sunset/Deprecation headers; no SLA
- No published prices on any paid tier; no published rate limits on the GraphQL gateway
- No published error reference or event catalog outside the source code
- The current first-party CLI is installable only from a moving git branch; `com.erxes:messenger-sdk` is documented as a Maven Central coordinate but is not published there