API reference · Account

What this key may do, and what it can spend

GET /v1/me/limits

The authenticated key's machine identity, enforced publishing policy, connected channels, credit balance, and rate limits. rateLimits.apiPerMinute and postsPerMinute are the workspace ceiling. rateLimits.profile is the per-Channels-profile cap, so one end user cannot starve the others. Networks still apply their own caps (TikTok is about 6 requests a minute per account). MCP agents receive the same view through whoami. Read this before planning a batch rather than discovering a limit by being refused.

Request

Authenticate with a bearer API key. Agents calling over MCP authorise with OAuth instead and never handle the key.

curl -X GET https://api.postlake.dev/v1/me/limits \
  -H "Authorization: Bearer $POSTLAKE_API_KEY"

Response

Success (200).

FieldTypeRequiredWhat it is
accountstringNo
emailstringNo
namestringNo
creditsobjectNo
credits.totalintegerNo
credits.monthlyintegerNo
credits.packintegerNo
credits.monthlyAllowanceintegerNo
credits.planstringNo
credits.blockedPlatformsarray of stringNo
billingobjectNoBilling state separate from the entitlement tier. `payg` means the Free plan with a positive balance of purchased, non-renewing credits, not a subscription.
billing.modestring (free, payg, subscription)Yes
billing.isSubscriberbooleanYes
billing.hasPurchasedCreditsbooleanYes
connectedarray of objectNo
rateLimitsobjectNo
rateLimits.apiPerMinuteintegerYesAuthenticated /v1 and /mcp requests per 60-second window for this workspace. The abuse ceiling shared by every profile.
rateLimits.postsPerMinuteintegerYesPOST /v1/posts, /v1/posts/{id}/publish, and MCP create_post / publish_draft per 60-second window for this workspace.
rateLimits.profileobjectYesPer Channels profile (one end user). Applied when the request names profile or the post's accounts resolve to one.

Example

{
  "account": "…",
  "email": "…",
  "name": "…",
  "credits": {
    "total": 0,
    "monthly": 0,
    "pack": 0,
    "monthlyAllowance": 0,
    "plan": "…",
    "blockedPlatforms": [
      "…"
    ]
  },
  "billing": {
    "mode": "free",
    "isSubscriber": false,
    "hasPurchasedCredits": false
  },
  "connected": [
    {
      "account": "…",
      "platform": "…",
      "handle": "…",
      "status": "…"
    }
  ],
  "rateLimits": {
    "apiPerMinute": 0,
    "postsPerMinute": 0,
    "profile": {
      "apiPerMinute": "…",
      "postsPerMinute": "…"
    }
  }
}

Limits

Reads are limited to 600 requests a minute per account. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset, and a 429 includes Retry-After so a client can back off without guessing. Reads of network data (comments, followers, conversations) are metered in credits; reads of your own PostLake state are not.

Calling this from an agent

Agents do not call REST. They call tools. Over the hosted MCP server this operation is whoami, and the agent authorises with OAuth so your API key is never pasted into a chat or seen by the model. The reply comes back in the same normalised shape you see above, which is what lets an agent reason about it without a per-network branch.

You control what any one agent may do with it: which brands it may act for, which networks it may reach, how much it may do in a day, and whether it may spend credits you bought up front. See the MCP server.

Errors

Every failure uses one shape: a stable type, a granular code, the field at fault in param, and a plain-language fix. An agent can act on it without a person reading the message. See Errors and retries.

Check the result before retrying a write. Only operations that explicitly support idempotency can safely replay an Idempotency-Key.

Common questions

Can an AI agent do this without the REST API?

Yes. Over MCP the same job is the whoami tool. The agent authorises with OAuth, so no API key is pasted into a chat or seen by the model, and the answer comes back in the same normalised shape.

How often can I call this?

Reads are rate limited per account and every response carries X-RateLimit-Remaining and X-RateLimit-Reset. On a 429 the Retry-After header tells you how long to wait.

What happens when it fails?

You get one error shape: a stable type, a granular code you can branch on, the offending field in param, and a fix written so an agent can correct itself rather than stop. Full list on Errors and retries.

Related