Agentic Fabriq
Amplitude
DATA · DATA & ANALYTICS
Funnels, retention, cohorts, and event segmentation from their own project.
Connecting Amplitude in practice
The analytics side is metered in query "cost" rather than requests: 108,000 cost per hour with only 5 concurrent requests across every REST endpoint, where cost = days × conditions × the query type’s own cost, and a funnel counts events × 2 plus 4 per group-by per event. One dashboard-shaped question over a year of data is a noticeable slice of the hour.
Scopes that draw scrutiny
Secret keyThe other half of Basic auth for the Export and Dashboard REST APIs, so it is what lets an integration pull raw event data out rather than send it in. Amplitude shows a secret key only when you generate it, so it cannot be recovered later — only replaced.API keyThe ingestion credential used by the HTTP V2 endpoint. It is per project, so the blast radius of a leak is the project rather than the organization.
Rate limits
- Dashboard REST: up to 5 concurrent requests across all Amplitude REST API endpoints, and up to 108,000 cost per hour.
- Dashboard REST: up to 1,000 cost within a 5-minute window.
- User Activity and Search endpoints: up to 10 concurrent requests and 360 queries per hour.
- Query cost = (number of days) × (number of conditions) × (cost for query type). Event Segmentation costs the number of events plus 4 per group by; Funnel Analysis events × 2 plus 4 per group by per event; Retention 8; User Sessions 4; everything else 1.
- HTTP V2 ingestion: throttled above 30 events per second per device_id or user_id, with a 429 and a documented 30-second pause before retrying.
- HTTP V2 ingestion: 50,000 events per second per project across the HTTP API and HTTP V2 combined (150,000 for SDK endpoints).
- HTTP V2 on Free: at most 100 batches per second and 1,000 events per second. On Growth and Enterprise: request under 1 MB and fewer than 2,000 events per request, else 413.
- Export API: 365 days maximum per query and a 4 GB size limit, above which the request returns 400.
Who has to approve
Only Managers and Admins can generate, copy and revoke API keys or generate secret keys, so an ordinary project member cannot provision the credential an integration needs — someone with an elevated Amplitude role has to do it, and a secret key is displayed only at the moment it is created.
Worth knowing
- Amplitude rate limits individual users by Amplitude ID who update their user properties more than 1,800 times per hour: event ingestion continues while the property updates are dropped, so profiles silently diverge from events rather than erroring.
- The per-device_id and per-user_id throttle means one hot identifier can 429 a shared pipeline, which is why Amplitude’s own advice is to partition work by device_id or user_id.
- Export data is only available within 2 hours of when the servers received it, so an agent reconciling "today" against the UI will disagree with it — reporting in the product has no such delay.
- If an hour of data exceeds the 4 GB Export limit there is no paging around it; the documented answer is to switch to Amazon S3 export instead.
Checked against Amplitude HTTP V2 API (2026-09-29), Amplitude Dashboard REST API (2026-09-29), Amplitude Export API (2026-09-29), Amplitude API authentication (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Amplitude behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.