Agentic Fabriq
Constant Contact
MARKETING · EMAIL
Contacts, lists, email campaigns, and reporting for the account they connected.
Connect Constant Contact with Fabriq Developer
Your user consents at Constant Contact. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting Constant Contact in practice
Access tokens last at most 24 hours and the token endpoint is itself rate limited, so an agent that refreshes before every call collects 429s from the authorization server rather than from the API. The four scopes are coarse enough that contact_data alone covers reading and writing every contact, while the connecting user’s role can silently deny the token that same data.
Scopes that draw scrutiny
contact_data"Grants your application permission to read or write contact data and to read contact reports." One scope for both directions, so there is no read-only contacts grant.campaign_dataRead or write campaign data and read campaign reports, which includes sending surface for the account’s email programme.account_updateUpdates the account record itself, separate from account_read.offline_accessRequired before the token endpoint will return a refresh token at all; without it the integration dies with the access token.
Rate limits
- Constant Contact rate limits the token endpoint: the docs say a 429 will likely be returned if you refresh an access token before every V3 API request.
- The V3 API guide publishes no per-second or per-day request figure for the data endpoints, so there is no documented number to design a client around.
Worth knowing
- Access tokens are JWTs of 1,000 to 1,200 characters that expire after 1440 minutes (86,400 seconds) with a hard 24-hour maximum; implicit-flow tokens expire after 480 minutes.
- Refresh tokens are 42 characters and expire after 180 days if never used, and refresh requests need basic authentication of their own.
- The connecting user’s role decides what the token can reach: a Campaign Creator can create, edit and view campaigns and view contact lists but cannot read contacts, read reports, or modify lists. Call GET /account/user/privileges to find out which of contacts:read, contacts:write, contacts:lists:read, contacts:lists:write, campaign:read, campaign:create, campaign:write and ui:campaign:metrics the token actually holds.
- A newly created application defaults to private access — usable only by its own account — until it is approved for wider use, and one developer account can hold at most 50 applications.
Checked against Authorization scopes overview (2026-09-29), OAuth2 authorization overview (2026-09-29), User roles and privileges (2026-09-29), V3 API getting started (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Constant Contact behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.