https://api.flowiq.live/v1 (Calling, Webhook deliveries, Subscriptions, Reports) share these rules. Older endpoints (/send-text, /broadcast, /contact, …) keep their own, simpler shapes.
Request ids
Every response carries anX-Request-Id header, and every error body repeats it as request_id. Quote it when you write to support: it finds the exact request in FlowIQ’s logs.
Errors
Errors are JSON with a short label, a stable machine-readable code, a sentence for a person, and the request id. Branch oncode, never on message.
The
401 for a missing or invalid key comes from the shared key check and carries error and message only.
Rate limits
Limits are per API key: 240 reads a minute and 60 actions a minute (anything that sends, calls or changes settings). Every response says where you stand:Idempotency keys
Send anIdempotency-Key header (any string up to 255 characters, a UUID is a good choice) on a POST or PATCH and FlowIQ remembers the response for 24 hours per API key. A retry with the same key and the same body gets the same response back, with Idempotent-Replayed: true, without doing the work again: a network glitch can never start a call twice or send two permission requests.
- The same key with a different body is refused:
422 idempotency_key_reused. - A retry while the first request is still running:
409 idempotency_in_progress. 5xxanswers are not remembered, so a retry after a FlowIQ-side failure runs again.
Paging
Lists are cursor-paged: passlimit (max 100) and, for the next page, the next_cursor from pagination as ?cursor=. A page with has_more: false is the last one. Cursors are opaque; a cursor you did not get from the API answers 400 invalid_cursor. (The Subscriptions endpoints still use page.)
