Agentic Fabriq
Connecting Bolna in practice
Bolna publishes no HTTP rate limit at all; what actually constrains an agent is outbound call concurrency — two concurrent calls on a trial restricted to verified numbers, from ten on a paid account — and overflow is queued rather than rejected, so a campaign silently paces itself instead of erroring. That concurrency is then "split evenly between the providers you have calls waiting on", so adding a second telephony provider halves the slots available to the first.
Scopes that draw scrutiny
AdminBolna’s own wording: "Has full, unrestricted access to the organization. Admins can manage billing, invite or edit member roles, create and delete agents, and manage all API keys." An Admin key correspondingly "can perform any action via the API".Member"Has limited access designed for operational tasks. Members can place calls on existing agents ... Members are restricted from performing most delete operations (like deleting agents)." A Member key inherits exactly that, and members can mint their own keys without an admin.Subaccount key (sa- prefix)The only way to tell a subaccount credential apart: "API keys generated for a Subaccount will start with sa-." Subaccounts are themselves an Enterprise feature, so most tenants have no isolation to use.
Rate limits
- No HTTP request rate limit is published anywhere in the documentation, and no 429 is documented.
- Outbound call concurrency is the real limit: trial accounts "Up to 2 concurrent calls, restricted to verified phone numbers only"; paid accounts "Starts at 10 concurrent calls, scaling automatically with monthly usage"; Enterprise gets elevated levels.
- Inbound calls have no concurrency limit and are "never restricted or queued".
- Outbound calls over the limit "are queued, not rejected. They dial automatically as active calls finish."
Worth knowing
- Webhooks are unsigned. The only authentication documented is a header you supply yourself — "Turn on Add headers to send custom headers (for example an auth token) with every webhook request" — with no HMAC signature, signing secret, timestamp verification or documented retry policy.
- Concurrency is split across providers rather than served first-come-first-served, and Bolna’s own worked example is a limit of 700 with 15,000 calls queued on each of two providers giving 350 slots each — so provider choice changes pacing, not just routing.
- The balance is shared and uncapped per key: "All usage from both Admin and Member accounts is deducted from this single, centralized balance", and any Member can create their own key, so there is no documented way to limit what one integration spends.
- Organizations, team roles and subaccounts are all Enterprise features, and no sandbox or test mode is documented anywhere — the nearest thing is a trial account limited to verified phone numbers.
Checked against Bolna API introduction (2026-09-29), Outbound calling concurrency (2026-09-29), Organization management (2026-09-29), Sub-accounts (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Bolna behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.