> ## Documentation Index
> Fetch the complete documentation index at: https://hellotars.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API requests

> Use strict JSON, opaque pagination cursors, safe call retries and optimistic webhook updates.

## JSON bodies and IDs

Send application/json for JSON request bodies. Bodies are limited to 1 MiB. Unknown fields are rejected.

IDs are opaque strings. Use the ID returned for the resource. Do not infer its format or substitute a name.

## Pagination

Pages contain items, nextCursor and hasMore. The default limit is 50 and maximum is 100.

Phone-number limits are 10, 20, 50 or 100. Webhook destinations return one page of at most 20 records.

Pass nextCursor unchanged with the same filters. A stale cursor returns cursor\_expired, while changed filters return cursor\_mismatch.

## Call idempotency

Send Idempotency-Key when creating calls. Retry the same request with the same key to recover the original result.

A replay includes Idempotent-Replayed: true. Reusing the key for different input returns 409 idempotency\_key\_reuse.

## Concurrent webhook updates

Webhook updates require expectedUpdatedAt from the latest destination read. A mismatch returns 409 conflict.

After a successful update, use the returned updatedAt for the next update.

## Rate limits

Rate classes are independent per API key. A limit response includes Retry-After.

| Class | Rate | Burst capacity | Applies to |
| - | - | - | - |
| read | 60 per minute | 60 | GET requests and call search |
| write | 60 per minute | 60 | General writes |
| call\_create | 30 per minute | 30 | Call creation |
| campaign\_send | 120 per minute | 200 | Campaign send and validate |
| job | 10 per minute | 10 | MCP jobs, when tools are available |

Outbound placement also has an organization limit of 60 per minute with capacity 120. Call admission and concurrency limits apply separately.

Webhook tests have a separate limit of five per minute per destination.

## CORS

API responses allow any origin. Preflight requests return 204 without authentication.

Allowed headers include Authorization, Content-Type and Idempotency-Key. Exposed response headers include Retry-After, Idempotent-Replayed and Location.

Responses use Cache-Control: no-store. Keep API keys on your server even though the API supports CORS.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.