# Requests

Send JSON for request bodies. The API accepts up to 1 MB.

```
Content-Type: application/json
```

## Lists

Most lists use `limit` and `page`.

- `limit` defaults to 50 and cannot exceed 100.
- `page` starts at 0. Page 1 skips the first `limit` records.
- `GET /videos` uses `skip` instead of `page`.
- `GET /search/leads` defaults to 25 and cannot exceed 50.

The response is an array. An empty result is `[]`. Search routes also return an array when you pass an exact id.

## Errors

Errors use a stable `error` code and a `message`.

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | `invalid_request` | A required field is missing or a value is invalid |
| 401 | `missing_token` | No bearer token was sent |
| 401 | `invalid_token` | The key is unknown, expired, or revoked |
| 403 | `insufficient_scope` | The key does not include the scope |
| 403 | `ip_not_allowed` | The caller IP is outside the key allowlist |
| 404 | `not_found`, `page_not_found`, `project_not_found` | The record is missing or belongs to another account |
| 409 | `project_in_use` | The project still has pages, products, sites, or funnels |
| 429 | `rate_limited` | The key sent more than 5,000 requests in 10 minutes |

```json
{
  "error": "invalid_request",
  "message": "name is required."
}
```

## Rate limits

| Window | Limit | Applies to |
| --- | --- | --- |
| 10 minutes | 5,000 requests | Each API key |
| 15 minutes | 60,000 requests | Each IP, across the host |

When you hit a limit, wait for the window and retry. The response includes standard rate-limit headers.

## What is not in this API

Key creation, revocation, and the activity log use the logged-in Atomicat app. They are not available to an API key. Internal event routes used by Atomicat services are also omitted.