### What plan do I need to use the public API?

**Pro or Enterprise.** On the Starter plan, any call to `/public/v1/*` returns `403 PLAN_NOT_ELIGIBLE`,
even if the key exists and has the right scope. See **[Plans and limits](/en/api/plans-and-limits/)**.

### What happens if my key doesn't have the exact scope an endpoint requires?

You get `403 PERMISSION_DENIED`, even with the rest of its permissions intact. Every resource has two
independent scopes — read and manage. See **[Authentication](/en/api/authentication/)**.

### How do I rotate a key without breaking my integration?

There's no atomic rotation endpoint today: create a new key with the same scopes, update the secret in
your integration, then revoke the old one — there's a brief window with both active.

### What does the API return if I ask for another tenant's resource?

`404`, exactly as if the resource didn't exist — never `403`, which would confirm the data exists on
another account.

### How many requests can I make per minute?

180/minute and 50,000/day on Pro; 600/minute and 200,000/day on Enterprise. The quota is counted per key,
not per IP. See **[Plans and limits](/en/api/plans-and-limits/)**.

### Can I delete a lead, a contact, or any other resource through the API?

No — `/public/v1` has no `DELETE` endpoint at all. See **[API use cases](/en/api/use-cases/)**.

### What happens if I send a WhatsApp message outside the 24-hour window?

You get `409 WHATSAPP_SESSION_WINDOW_CLOSED` — use `POST /conversations/start` with an approved template
instead. See **[Errors](/en/api/errors/)**.