Outlevo now has a public API, version 1. The release notes for 2026-10-18 describe it as a public API with scoped test and live keys, idempotency keys, rate limits and signed webhooks [[1]](#sources). A developer sandbox, an MCP server, and the TypeScript SDK and components shipped in the same release [[2]](#sources).
This post covers what each piece does, what it costs, and the order we would work through it. It also says where the details live, because some of them are not in this post.
What changed
One API for everything in the app
Everything in the app is available in the REST API, along with a TypeScript SDK and an MCP server [[3]](#sources). The API reference lists 96 paths [[4]](#sources). The resources include campaigns, companies, contacts, policies, webhooks, audiences, suppressions, ledger, usage and quotas, among others [[4]](#sources).
In practice, you no longer need to click through the app for work that a script or another system could do. A team can read companies and contacts, check usage against quotas, or read the ledger from its own tooling. The full list of resources is in the API reference.
Scoped test and live keys
There are two kinds of key: test and live, and both are scoped [[1]](#sources). Test keys run against a sandbox with fake companies and contacts, and they are not charged [[3]](#sources).
That split gives you a safe place to build. You can write and break an integration against fake data before any live key exists. The list of scopes and what each one permits is in the API reference, not here. Read it before you create keys, so each key gets only the access its job needs.
Idempotency keys
Idempotency keys are part of v1 [[1]](#sources). The general idea is simple. You attach a unique key to a request. If the request is sent twice, for example because a network call timed out and your code retried, the second attempt is not treated as a new action.
This matters most for requests that cost credits or change state. Metered API calls quote their credit cost first and run only when confirmed [[3]](#sources). A retry that repeats a confirmed call would be an expensive mistake, so use idempotency keys on any call that spends credits. How long a key is retained is a detail to check in the reference.
Rate limits
Rate limits are now part of the API [[1]](#sources). We are not stating the limit values in this post. Take them from the reference and build your client to expect a limit response. A client that backs off and retries later is better than one that retries at once.
Signed webhooks
Webhooks carry an HMAC signature on every delivery [[5]](#sources). Events cover qualification, actions, handoffs, campaigns and usage [[5]](#sources).
Delivery rules are fixed:
- Retries happen at 1 min, 5 min, 30 min, 2 h and 12 h [[5]](#sources).
- The replay window is 5 minutes [[5]](#sources).
- Each delivered event costs 1 credit [[5]](#sources). The pricing page lists "webhook delivered" at 1 credit as well [[6]](#sources).
The signature lets your receiver confirm that a delivery came from Outlevo and was not altered. The replay window limits how long an old, captured delivery stays usable. The retry schedule means a short outage on your side does not have to lose events. Setup details are on the webhooks integration page.
What did not change
The API does not bypass the approval model. Nothing is sent outside a policy that a person approved [[7]](#sources). Policies set who can be contacted, on which channels, how often and with what budget [[7]](#sources). Every external action is checked against the approved policy before it runs, and recorded in a ledger [[7]](#sources).
So an API call that triggers outreach is held to the same policy as a click in the app. Kill switches work the same way: they pause a campaign, a channel or the whole workspace at once [[7]](#sources). If you build automation on the API, keep a person who knows where the kill switch is.
Security is also the same. Every customer table is protected by row-level security in the database [[8]](#sources). Personal data such as email addresses is encrypted at the field level [[8]](#sources). Staff support access is read-only, time-limited and logged [[8]](#sources).
What it costs
Test keys are not charged [[3]](#sources). Live usage is metered in credits. These are the listed costs [[6]](#sources):
- Contact discovery: 20 credits.
- Deep research: 30 credits.
- Email verification: 2 credits.
- Qualification: 8 credits.
- State change: 1 credit.
- Webhook delivered: 1 credit.
The plans are Free at USD 0 per month, Builder at USD 29 per month with 320 credits a month, and Growth at USD 149 per month with 1650 credits a month [[6]](#sources). Managed is priced per contract [[6]](#sources). Plans and credit top-ups can be bought through Stripe Checkout, with sales tax [[9]](#sources).
Webhooks are cheap per event but they add up. One contact discovery costs as much as 20 delivered webhook events [[6]](#sources). If you subscribe to every event type and receive them all, you pay for every one. Subscribe to the events your system acts on.
The notes do not give sandbox credit or request limits, so we make no claims about them here.
What to do
Work through these steps in order.
- Read the reference first. Open the API reference and the developer hub. Note the scopes, the rate limit values and how long idempotency keys are retained. Those are the details this post leaves out on purpose.
- Build against a test key. The sandbox has fake companies and contacts, and test keys are not charged [[3]](#sources). Get your full flow working there, including error handling.
- Create narrow live keys. Give each live key only the scopes its job needs. Use separate keys for separate systems, so you can revoke one without touching the others.
- Add idempotency keys to every write that matters. Generate a unique key per logical action, not per attempt. Reuse the same key when you retry.
- Confirm costs before you run metered calls. Metered calls quote their credit cost first and run only when confirmed [[3]](#sources). Log the quote in your own system so you can reconcile it against usage later.
- Verify every webhook signature. Reject any delivery that fails the HMAC check. Store the signing secret in a secrets manager, not in code.
- Respect the replay window. The window is 5 minutes [[5]](#sources). Make your receiver tolerate that window and make it safe to process the same event twice. Retries mean a duplicate can arrive.
- Return a fast response and process later. Retries run at 1 min, 5 min, 30 min, 2 h and 12 h [[5]](#sources). If your receiver is slow or down, you will get the same event again. Acknowledge first, then do the work.
- Watch usage. Read the usage and quotas resources on a schedule [[4]](#sources). Alert before you run short of credits, not after.
If you use a connected tool
The API sits alongside the existing integrations. Nothing here replaces them. If your team already syncs a CRM, check how that sync works before you add API writes on top of it. The HubSpot integration reads companies, contacts and deals and writes back status, notes and Readiness Card decisions [[10]](#sources). The Salesforce integration writes back only Outlevo fields, Readiness Cards and Tasks, and its sync pauses at 80% of the daily API allocation [[11]](#sources).
For sending and ads, the Smartlead, LinkedIn Ads and Google Ads pages describe what each connection does. Smartlead sends from your own mailboxes and checks SPF, DKIM and DMARC before any send [[12]](#sources). Ad budgets stay within the approved policy [[13]](#sources) [[14]](#sources).
The point is to avoid two systems writing the same field. Decide which system owns each piece of data, and let the other one read it.
Where to start if you are not a developer
If you do not write code, the API still matters to you. Ask your developer or agency to follow the steps above, and ask them for two things: the list of scopes each key holds and the list of webhook events they subscribe to. Those two lists tell you what the integration can do and what it will cost.
If you have not yet seen what Outlevo reads from your site, the free assessment reads up to 5 public pages and returns facts labeled as verified observations or inferences [[15]](#sources). It also asks which countries you sell into. Outlevo never proposes markets [[16]](#sources).
For the full week of changes, see What changed in Outlevo, week 43 2026. The raw release notes are in the changelog.