OIA Shield24
A zero-trust API gateway for Bitrix24 REST API
Free
In-app purchases
-
Rating
-
Installations3
-
Developer
Description
OIA Shield24 is an enterprise API gateway that sits between your CRM and every third-party
developer, AI tool, or integration partner that needs to call it — so you never have to hand out
your master API key again.
What it solves:
developer, AI tool, or integration partner that needs to call it — so you never have to hand out
your master API key again.
What it solves:
- - Replaces shared master API keys with scoped, revocable Vendor Endpoints — each one limited to
- specific CRM/Users/Calendar/Tasks methods, specific HTTP methods, and (on paid plans) an IP
- allow/block list.
- - Every request passes a security pipeline before it reaches your CRM: API-key hashing and
- zero-trust lookup, OAuth token decryption/refresh, HTTP-method and CORS/origin checks, IP
- allow/block enforcement, plan-tier quota checks, and a 50MB payload cap with malformed-input
- sanitization.
- - Routes and rate-limits every vendor's traffic through a per-endpoint queue, so one integration
- hammering your CRM can never starve another.
- - Forwards real-time CRM events (deal/lead/contact changes, etc.) to your own external webhook
- receivers, with automatic retries and delivery-rate tracking.
- - Gives administrators a live dashboard of allowed/blocked/rate-limited traffic, with automatic
- threat-signal detection for suspicious activity (Enterprise plan).
- - Tariff plans gate functionality. On the free Starter plan: up to 2 vendor endpoints, 10,000
- requests/month, 30 requests/minute, 256 KB max payload, and up to 5 outbound event rules — IP
- allow/block lists, custom domains, and advanced threat-intelligence analytics are NOT available
- on Starter. The Developer plan raises these to 10 endpoints, 100,000 requests/month, 120
- requests/minute, 2 MB payload, 25 outbound event rules, and unlocks IP filtering and custom
- domains. The Enterprise plan removes the endpoint/request/payload/event-rule limits entirely and
- adds advanced threat-intelligence analytics.
- - Upgrading to a paid plan requires a card payment processed via Stripe, handled through the
- app's own in-app billing screen — no separate account or software installation is required.
- - Only a Bitrix24 administrator can install the app, create/edit/revoke Vendor Endpoints, or
- change billing — matches the OAuth scopes granted at install and is enforced server-side, not
- just hidden in the UI.
- - Outbound event delivery requires the administrator to supply their own externally reachable
- webhook URL; OIA Shield24 does not host or provide that receiving endpoint.
