Hookdeck
DEVELOPER · DEVELOPER
Sources, destinations and the events routed between them in their own project.
Connecting Hookdeck in practice
Hookdeck’s REST API allows 240 requests a minute per API key, but the limit that actually shapes an integration is delivery throughput: 5 events per second per project on the Developer plan, with a 10 MiB inbound payload cap and a 2.5 MB ceiling on what the dashboard can search inside. Anything larger is still stored and delivered — it just becomes invisible to the event filter.
Rate limits
- REST API: 240 requests per minute per API key, with X-RateLimit-Remaining and X-RateLimit-Reset (an ISO timestamp) on every response.
- Delivery throughput: 5 events per second, set per project rather than per organization, and self-service upgradeable by plan.
- Inbound payload: 10 MiB, rejected with HTTP 413 above that. Searchable payload: 2.5 MB, not adjustable.
- Automatic retries: 50 attempts, fixed. Delivery timeout: 60 seconds by default, configurable per destination up to 15 minutes.
- List pagination: 100 results by default, 250 maximum, cursor-based via next and prev.
Worth knowing
- Most limits apply organization-wide, but throughput is configured per project, so raising it for one project does nothing for the others.
- Basic auth with the API key as username and an empty password still works but is deprecated; Bearer is the documented path.
- Authorization: Bearer belongs on the REST and Publish APIs only — putting it on a Source URL is a documented mistake, because that header is how Hookdeck’s own inbound authentication is configured.
- The OpenAPI schema is date-pinned (api.hookdeck.com/2026-09-01/openapi.json), so a generated SDK silently tracks whichever date was current when it was built.
Checked against Limits (2026-09-29), API reference (2026-09-29), Authentication (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Hookdeck behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.