Agentic Fabriq
Laposta
MARKETING · MARKETING
Mailing lists, contacts, segments, and campaigns in the account they connected.
Connecting Laposta in practice
Laposta’s limit depends on the plan rather than the key — 30 requests a minute on a free account, 120 on a paid one — and authentication is HTTP Basic with the API key as the username and no password at all, which is why every example ends in a bare colon. Asking for an object that does not exist returns 400 with code 203 rather than 404, so the usual "404 means gone" branch never fires.
Scopes that draw scrutiny
API key (Basic auth username)One account-wide key from Access & Subscription → Links - API, passed as the Basic username with an empty password. There are no scopes, and partners can use it to create whole new Laposta accounts.
Rate limits
- Free accounts: 30 requests per minute. Paid accounts: 120 requests per minute.
- Over the limit returns 429 Too Many Requests with a Retry-After header in seconds.
Worth knowing
- A 400 with code 203 and the offending parameter is how Laposta reports an unknown list_id or member_id; a 404 means the URL itself does not exist.
- 402 Request Failed is a distinct state — the input was fine but the request was not processed — so 4xx here is not uniformly "your fault, do not retry".
- The API answers on api.laposta.nl and api.laposta.org and is HTTPS only, so the host differs from the marketing domain a customer will quote at you.
- Laposta publishes a working API key in its own examples for testing, which makes copied sample code look like it authenticates correctly against someone else’s account.
Checked against Authentication, rate limiting and error messages (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Laposta behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.