Skip to main content

JSON bodies and IDs

Send application/json for JSON request bodies. Bodies are limited to 1 MiB. Unknown fields are rejected. IDs are opaque strings. Use the ID returned for the resource. Do not infer its format or substitute a name.

Pagination

Pages contain items, nextCursor and hasMore. The default limit is 50 and maximum is 100. Phone-number limits are 10, 20, 50 or 100. Webhook destinations return one page of at most 20 records. Pass nextCursor unchanged with the same filters. A stale cursor returns cursor_expired, while changed filters return cursor_mismatch.

Call idempotency

Send Idempotency-Key when creating calls. Retry the same request with the same key to recover the original result. A replay includes Idempotent-Replayed: true. Reusing the key for different input returns 409 idempotency_key_reuse.

Concurrent webhook updates

Webhook updates require expectedUpdatedAt from the latest destination read. A mismatch returns 409 conflict. After a successful update, use the returned updatedAt for the next update.

Rate limits

Rate classes are independent per API key. A limit response includes Retry-After. Outbound placement also has an organization limit of 60 per minute with capacity 120. Call admission and concurrency limits apply separately. Webhook tests have a separate limit of five per minute per destination.

CORS

API responses allow any origin. Preflight requests return 204 without authentication. Allowed headers include Authorization, Content-Type and Idempotency-Key. Exposed response headers include Retry-After, Idempotent-Replayed and Location. Responses use Cache-Control: no-store. Keep API keys on your server even though the API supports CORS.