API Usage Policy

The API is available over HTTPS as a REST interface, with webhooks for event delivery. API access is included with every plan, subject to the limits below.

Requests authenticate with an API key sent in the Authorization header. Keys are issued per workspace, can be rotated at any time, and must be kept secret. Do not embed keys in client-side code.

Requests are limited per plan: Solo 100 per hour, Venture 500 per hour, Business 2,000 per hour, and Enterprise 10,000 per hour. Full detail, including AI, voice, and messaging limits, is in the Rate Limiting Policy.

Use the API in a way that does not degrade the Service for others. Cache where sensible, use webhooks instead of tight polling, and back off when you receive throttling responses.

Scraping data you do not have rights to, probing or overloading the Service, accessing another tenant's data, reselling raw API access, and circumventing rate limits or security controls.

The API is versioned. When we deprecate a version or endpoint we give at least 90 days notice before removal, except where an immediate change is needed for security.

List endpoints are paginated with a maximum page size. Export large datasets through the export tools rather than by iterating the API at high volume.

Webhook deliveries are signed so you can verify their origin, and failed deliveries are retried with backoff. Endpoints that fail persistently may be disabled until fixed.