If you build on Outlevo, or plan to, the 2026-10-18 release matters to you. It added a developer sandbox with fake companies and contacts, an MCP server, and the TypeScript SDK and components. [[1]](#sources) This post covers what is new, what it costs to use, and the order we would try things in.
What changed
Three things arrived together in the 2026-10-18 release. [[1]](#sources)
- A developer sandbox. It holds fake companies and contacts.
- An MCP server.
- The TypeScript SDK and components.
The same day, public API v1 shipped. It has scoped test and live keys, idempotency keys, rate limits and signed webhooks. [[2]](#sources)
The developer hub states the scope plainly: everything in the app is available in the REST API, with a TypeScript SDK and an MCP server. [[3]](#sources) The API reference lists 96 paths. [[4]](#sources) The resources include:
- companies, contacts and campaigns
- policies, decisions and the ledger
- webhooks, usage and quotas
- audiences, competitors, imports and suppressions
The reference has the full list of resources and the paths under each. You can read it at developers.outlevo.com/api.html.
How the sandbox works with keys
Test keys run against the sandbox with fake companies and contacts, and they are not charged. [[3]](#sources) Live keys are the other half of the scoped pair. [[2]](#sources)
In practice, that gives you a place to write and break code before any real account data is involved. You can build an integration against fake companies, read the responses, and handle errors, with no credit charge. When it behaves, you switch the key.
Metered calls quote first
Metered API calls quote their credit cost first and run only when confirmed. [[3]](#sources) This matters for any script that loops. A call that spends credits does not spend them silently. Your code gets a quote, and the call runs only after confirmation.
Build that confirmation step on purpose. Decide in code what a script may confirm on its own and what should stop for a person.
What the credits cover
Credit costs per action are published on the pricing page:
| Action | Credits |
|---|---|
| Contact discovery | 20 |
| Deep research | 30 |
| Email verification | 2 |
| Qualification | 8 |
| State change | 1 |
| Webhook delivered | 1 |
[[5]](#sources)
Plans, as listed: Free is USD 0 per month. Builder is USD 29 per month with 320 credits a month. Growth is USD 149 per month with 1650 credits a month. Managed is priced per contract. [[5]](#sources) Self-serve plans and credit top-ups are available through Stripe Checkout, with sales tax. [[6]](#sources)
For developers, the point is that the sandbox is where you learn these costs without paying them. Test keys are not charged. [[3]](#sources)
Webhooks in the new API
Signed webhooks are part of API v1. [[2]](#sources) The details live on the webhooks integration page:
- Every delivery carries an HMAC signature. [[7]](#sources)
- The replay window is 5 minutes. [[7]](#sources)
- Failed deliveries retry at 1 min, 5 min, 30 min, 2 h and 12 h. [[7]](#sources)
- Events cover qualification, actions, handoffs, campaigns and usage. [[7]](#sources)
- Each delivered event costs 1 credit. [[7]](#sources)
Two of those points affect how you write a receiver. Verify the signature before you act on a payload. And expect the same event to arrive more than once if your endpoint fails, since retries run on that schedule. Because each delivered event costs a credit, subscribe only to the event types you will use.
What did not change
The API does not replace the approval model. Nothing is sent outside a policy that a person approved. [[8]](#sources) Policies set who can be contacted, on which channels, how often and with what budget. [[8]](#sources) Every external action is checked against the approved policy before it runs, and recorded in a ledger. [[8]](#sources)
Kill switches pause a campaign, a channel or the whole workspace at once. [[8]](#sources) If you are building automation, plan for the case where it gets paused. Your code should treat a pause as a normal state, not an error to retry around.
On data handling, every customer table is protected by row-level security in the database. Personal data such as email addresses is encrypted at the field level. [[9]](#sources) More is on the security page.
Other changes in the same window
The 2026-10-19 release added several things you may want to reach through the API or the app. [[10]](#sources)
- Win/loss analysis. You can import past deals from CSV or your CRM and get an analysis that proposes ICP hypotheses. [[10]](#sources) It counts companies, not deals, and under 10 won companies is labelled very low confidence. [[11]](#sources)
- A free ICP assessment. It reads your public site and asks which countries you sell into. [[12]](#sources) It reads up to 5 public pages and returns up to 5 experimental segment hypotheses, with facts labelled as verified observations or AI inferences. [[13]](#sources) Try it at the assessment page.
- Competitor tracking. It covers quoted facts from competitors' public pages, changes, win/loss by competitor and competitor signals on accounts. [[14]](#sources)
For the full weekly list, see what changed in week 43 of 2026.
What to do
You do not need to do everything at once. This order keeps risk low.
- Read the API reference. Skim the resource list at developers.outlevo.com/api.html. Mark the resources your use case touches.
- Create a test key and call the sandbox. Test keys are not charged, and the data is fake. [[3]](#sources) Start with read calls on companies and contacts.
- Install the TypeScript SDK if you work in TypeScript. The SDK and components shipped with the sandbox. [[1]](#sources) Start from the developer hub.
- Try the MCP server if you want an assistant to work with Outlevo. It shipped in the same release. [[1]](#sources) Use the sandbox first, so an assistant works against fake companies and contacts while you learn what it does.
- Write the confirm step for metered calls. Metered calls quote first and run only when confirmed. [[3]](#sources) Decide who or what confirms, and where your code stops.
- Build a webhook receiver that checks signatures. Handle retries and the 5 minute replay window. [[7]](#sources) Subscribe only to the events you need.
- Check your plan before switching to a live key. Compare the credit costs with your plan's monthly credits on the pricing page. [[5]](#sources)
- Confirm your policy is approved. External actions are checked against the approved policy and recorded in the ledger. [[8]](#sources) Your integration will run inside those rules.
If you connect a CRM, the HubSpot and Salesforce integration pages list what is read and written back. For sending and ads, see Smartlead, LinkedIn Ads and Google Ads.
The sandbox exists so you can make mistakes cheaply. Use it to find out what your code does when a call is quoted, a webhook fails, or a campaign is paused. Then move to a live key.