API frequently asked questions

What plan do I need to use the public API?

Pro or Enterprise. On the Starter plan, any call to /public/v1/* returns 403 PLAN_NOT_ELIGIBLE, even if the key exists and has the right scope. See Plans and limits.

What happens if my key doesn’t have the exact scope an endpoint requires?

You get 403 PERMISSION_DENIED, even with the rest of its permissions intact. Every resource has two independent scopes — read and manage. See Authentication.

How do I rotate a key without breaking my integration?

There’s no atomic rotation endpoint today: create a new key with the same scopes, update the secret in your integration, then revoke the old one — there’s a brief window with both active.

What does the API return if I ask for another tenant’s resource?

404, exactly as if the resource didn’t exist — never 403, which would confirm the data exists on another account.

How many requests can I make per minute?

180/minute and 50,000/day on Pro; 600/minute and 200,000/day on Enterprise. The quota is counted per key, not per IP. See Plans and limits.

Can I delete a lead, a contact, or any other resource through the API?

No — /public/v1 has no DELETE endpoint at all. See API use cases.

What happens if I send a WhatsApp message outside the 24-hour window?

You get 409 WHATSAPP_SESSION_WINDOW_CLOSED — use POST /conversations/start with an approved template instead. See Errors.