Limits for agents

An API key held by an autonomous agent is a different risk from one held by a deploy pipeline. These controls sit on the key rather than the workspace and are checked on every send — a workspace quota only trips once the agent has already mailed thousands of people.

Daily send cap

A hard ceiling per key per UTC day. Exceeding it returns 429 daily_limit. That is a stop, not a retry — an agent looping on it will simply burn its remaining budget against a closed door.

Recipient allowlist

Restrict a key to specific addresses or domains — ops@acme.com, or @acme.com for the whole domain. Anything else returns 403 recipient_not_allowed. Lookalike domains do not match: acme.com.evil.com is not @acme.com.

The allowlist is checked before the daily cap, so a misdirected send gets a clear reason instead of an ambiguous quota error.

Human approval

A key marked as requiring approval drafts instead of sending. The response comes back with status: "pending_approval" and an approval_id; a person releases it from the approvals queue.

That status is not an error and there is nothing to retry. An agent that treats it as a failure and sends again will queue a second draft.

MCP

The MCP server exposes this API as 21 tools, including reading a thread as a transcript and replying in place. Point an MCP client at it with an API key and the same scopes and limits apply.