TL;DR
- Apollo offers API operations across prospect data and sequences, with limits varying by plan and endpoint. API calls do not bypass plan or credit limits.
- Instantly directs new integrations to API v2; API access is listed across Email Outreach plans, while webhooks require Hyper Growth or above.
- Smartlead documents campaign and lead operations, but says rate limits vary by subscription.
- Woodpecker has prospect, campaign and agency endpoints; it processes one request at a time and queues up to six.
- Reply.io exposes sequences, inbox threads and webhooks in API v3, with request-rate limits plus a separate monthly quota described in its docs.
What an AI workflow needs
A useful API is more than “we have endpoints”. An agent may need to find or create a contact, check suppression, create a sequence in draft, enroll a person, read a reply, classify it, create a task and stop further messages. Each operation has authentication, ownership, capacity and error-handling requirements.
Webhooks push events; polling asks for updates. Polling needs documented limits, pagination and change detection. Webhooks need signature checks, retries, idempotency and a dead-letter queue. Neither pattern should let an AI agent activate an unreviewed sequence or send an unapproved answer by default.
Use scoped credentials, a human approval state, a suppression check before enrollment, and a named owner for ambiguous replies. API capacity is an engineering constraint, not permission to exceed mailbox-provider or recipient-policy limits.
Quick comparison
| Platform | Useful operations | Webhooks / limits | Main concern |
|---|---|---|---|
| Apollo | Search/enrich, manage records, create sequences and enroll contacts | Per-plan/per-endpoint limits across team; rate headers and 429 Retry-After | Credits and plan rules remain in force |
| Instantly | API v2 with scoped keys and expanded endpoints | API v2 on Email Outreach plans; webhooks Hyper Growth+ | V1 deprecated 19 January 2026; v2 needs a new key |
| Smartlead | Campaign lifecycle, lead upload, sequences and analytics | Plan-specific limits; up to 400 leads/request; 429 on limit | Current guide passes API key in query string |
| Woodpecker | Prospects, campaigns, mailboxes, reports and agency operations | One active request, six queued, 15-second queue window | API & integrations is a paid add-on |
| Reply.io | Sequences, inbox, categories and webhook subscriptions | 100/min and 3,000/hour, plus monthly team-member quota | Quota/reset documentation needs reconciliation |
Five platforms
1. Apollo: prospect data and sequence actions
Apollo’s API groups endpoints into search and enrichment, record management, engagement, analytics and workspace administration. It can create a sequence and add contacts to one. A new sequence is a draft by default; email touches must be approved before sending. That is a useful state boundary for a human-reviewed integration.
Limits are team-wide, shared across keys and users, and vary by endpoint and plan. The current guide lists ordinary Basic/Professional limits of 200 requests/minute, 400/hour and 2,000/day; search and enrichment endpoints have separate windows. A 429 includes retry-after. Enrichment also consumes credits, so a high request rate is not unlimited data. Scope keys to the endpoints required and keep master keys out of agent logs.
2. Instantly: API v2 and campaign webhooks
Instantly’s July 2026 API v2 guide says v2 doubles the endpoint count relative to v1, supports granular scopes and multiple keys, and is available on Email Outreach plans. V1 was deprecated on 19 January 2026; v2 is not compatible and needs a new key. The webhook guide gates webhooks at Hyper Growth or above and lists events including sent, bounce, reply, unsubscribe, account error and lead-status changes.
This matters to a lower-tier prototype: API access may be available while push events are gated. Webhooks POST JSON immediately, but the integration still needs to handle retries and duplicates. Subscribe only to relevant campaigns, persist each event before processing, and use an idempotency key.
3. Smartlead: campaign lifecycle and bulk leads
Smartlead’s API guide covers campaigns, leads, mailboxes and analytics. It supports campaign creation and updates, schedule changes, sequence management and lead upload. The guide permits up to 400 leads per request and describes duplicate and blocklist handling.
The same guide says rate limits vary by plan and should be confirmed with support; exceeding them returns 429. Authentication currently uses an API key as a query parameter. Query strings can be copied into proxy, app and analytics logs, so redact them and keep keys in a secret manager. Confirm the plan-specific quota before designing high-concurrency ingestion. API availability does not establish a throughput commitment.
4. Woodpecker: agency operations and backpressure
Woodpecker’s developer docs expose prospects, campaigns, mailboxes, reports and agency-account operations. API access is part of the paid API & integrations add-on, currently shown at $20/month. Webhooks cover replies, opt-outs, bounces, campaign changes and LinkedIn actions.
Its published rate limit is concrete: one request is processed at a time, up to six can wait, and each queued request has a 15-second maximum. Further requests return 429; legacy v1 endpoints can return 409. Webhooks use exponential backoff and batch same-event updates up to 100 items. Repeated failures may remove the subscription. Put writes through a durable queue and monitor subscription health rather than launching parallel calls from multiple agents.
5. Reply.io: sequences and conversations in API v3
Reply’s v3 documentation covers sequence creation, inbox threads, categories and webhook subscriptions. Its Inbox API can list/filter email and LinkedIn threads, retrieve history, assign categories and send a reply. Webhooks include replies, bounces, opt-outs and LinkedIn events; payloads and available scopes vary by event.
Reply’s limits reference gives 100 requests/minute and 3,000/hour. Its API and webhook reference also describes 15,000 calls per team member every 30 days and a ten-second minimum interval. It says the quota resets on the first of the month but does not reconcile that with the rolling period. Treat the strictest applicable limit as binding until account usage or Reply confirms the rule. The quota is per member, not shared across a team; Zapier calls may count. Honour Retry-After on 429.
Minimum published plan cost and access gate
| Platform | Public price reference | API or webhook gate to validate |
|---|---|---|
| Apollo | Basic $49/seat/month equivalent billed annually; Professional $79 | Endpoint scopes, credits and plan entitlements vary; price alone does not prove the required API operation is enabled |
| Instantly | Growth $47/month; Hyper Growth $97/month | API v2 on paid Email Outreach plans; webhooks and Slack on Hyper Growth or higher |
| Smartlead | Base starts $39/month; Pro $94/month | API guide requires account key activation; confirm selected plan's API and webhook limits before sizing |
| Woodpecker | Entry contact tier $35/month plus $20/month API/integrations add-on, or $55 before other add-ons | Entry tier is only up to 500 contacted prospects; larger integration needs a qualifying contact tier |
| Reply.io | Multichannel $89/user/month equivalent annual or $99 monthly | API v3 scope and quota must be confirmed on the actual plan; agency tier has different workspace features |
These are published starting components, not a like-for-like total. Seat count, contacts, sending mailboxes, annual cash due and add-ons differ. An API workflow that needs events cannot use Instantly's $47 Growth rate if its webhook gate is Hyper Growth. Woodpecker's $55 arithmetic fits only its smallest contact tier. Apollo and Reply need a plan-specific entitlement check before claiming a minimum eligible total.
An endpoint-to-action example
Smartlead's v1 API guide gives a concrete path for one CRM signal. First GET /leads/?email= checks whether the address already exists. A reviewer approves the campaign and sequence, then POST /campaigns/{campaign_id}/leads can add up to 400 leads per call with duplicate and blocklist settings. POST /webhooks subscribes to reply, bounce and unsubscribe events; each payload should be persisted before routing to the CRM. If a prospect opts out, POST /leads/{lead_id}/unsubscribe applies a global unsubscribe, whereas the campaign-specific endpoint only affects one campaign. These operations still need external suppression before enrollment and a human approval state; a reachable endpoint is not an approval policy.
For comparison, Apollo's contact creation and sequence enrolment are separate calls, and only contacts can be enrolled. Instantly's v2 block-list endpoint offers an explicit suppression write. Woodpecker's reply webhook is account-wide, so an agency consumer must map event campaign and client before updating a CRM record. Reply's Inbox API exposes conversation actions, but confirm the exact scope and monthly allowance before automating replies.
A safe integration pattern
For a CRM signal that starts outreach, use six controlled steps:
- Read and validate: deduplicate stable contact/account IDs, check required fields and confirm the address is usable.
- Check suppression: query the client's suppression source immediately before enrollment. If unavailable, stop and create a review task.
- Create a draft: generate from approved templates and bounded fields; do not let a model invent prospect facts.
- Require approval: an authorised operator approves audience, copy, sending identity, limits and start time. Record the version and approver.
- Process replies: verify webhook signatures where available, persist events, deduplicate and route opt-outs/uncertain intent deterministically.
- Reconcile: compare contacts, sends, bounces and replies with the CRM; alert on missing events, 429s, duplicate enrollment and credential failure.
Start with read access and draft creation. Add activation or autonomous replies only after tests cover pause, opt-out, duplicate and recovery paths. Never put a long-lived administrator key in a prompt or model log.
Plan the integration before choosing
Map each workflow action to an endpoint and owner before estimating throughput. A batch of 2,000 prospects does not imply 2,000 requests. On Smartlead, an illustrative design that looks up each address separately and then uploads in maximum-size batches would make 2,000 lookups plus at least five upload calls, before campaign creation, webhook setup, retries or reconciliation. If a later status pass again checks each lead individually, that is another 2,000 requests, about 4,005 in total. Smartlead does not publish one universal rate cap in its guide, so this is a call budget for a vendor quota discussion, not a throughput promise. Apollo’s endpoint-specific limits and credits require a separate model. Woodpecker’s one-active-request rule means a client must queue writes rather than fan out simultaneous requests. The documented 400-lead batch size belongs to Smartlead, not Woodpecker. Reply’s public per-minute cap can still be constrained by the separate monthly quota. Build a queue that respects the smallest applicable limit and records the vendor response headers.
Write down the plan gates alongside the API design: Instantly's push webhooks are gated above the entry Email Outreach plan; Woodpecker's API/integrations listing is an add-on; Smartlead requires plan-specific limit confirmation; Reply's monthly quota language is internally ambiguous. When a webhook is unavailable, polling has its own cost and delay. Do not substitute a guessed polling frequency for a quota check.
Store credentials outside prompts and application logs. Rotate keys after staff departures, restrict scopes, and test that a revoked credential fails. Persist inbound events before processing them; deduplicate by provider event ID or a stable composite key. For a timeout after a sequence enrollment request, query the contact state before retrying. This prevents a network retry from enrolling the same person twice.
Which should you choose?
Choose Apollo when enrichment, CRM records and sequence operations should share one API. Choose Instantly for email campaigns with push events on an eligible plan. Choose Smartlead for campaign lifecycle and lead ingestion after confirming rate limits. Choose Woodpecker when its agency endpoints and explicit backpressure fit your integration. Choose Reply when the workflow needs email and LinkedIn conversation access, with per-member quotas modelled.
Prove one end-to-end path in a sandbox: create a draft, approve it, enroll one synthetic record, process a reply, stop the sequence and propagate an opt-out. No integration was run for this article; this is a proposed implementation check.
Use the signal-based outbound playbook to define the human decision that follows each API event.
FAQ
Which platform has the clearest rate limits?
Woodpecker publishes concurrency and queue limits. Reply publishes per-minute/hour and monthly quotas but leaves a reset ambiguity. Apollo varies by endpoint and plan. The cited Instantly webhook guide gives no numeric rate cap. Smartlead asks customers to confirm plan limits.
Do any charge extra for API access?
Woodpecker lists API & integrations as a $20/month add-on. Instantly lists API access on Email Outreach plans but gates webhooks at Hyper Growth. Other products’ available endpoints and quotas depend on the account plan.
Is an API key in a URL a problem?
It can expose the key in proxy or application logs. Smartlead’s guide uses a query parameter. Redact it, store it securely and rotate it if exposed. Prefer scoped keys where available.
Can an AI agent run outreach end to end?
An API may allow activation, but technical access is not a reason to remove human control. Start with read and draft operations. Keep audience, copy, mailbox and launch approval with an authorised person, and enforce suppression independently.
What if an API limit is exceeded?
Use bounded backoff and Retry-After where supplied. Queue writes durably. Before retrying a non-idempotent enrollment, check whether the contact is already in the sequence.
What should I test before building?
Test key scope, account ownership, approval state, duplicate enrollment, webhook authentication/retries, reply and opt-out events, quotas, export and credential revocation. Repeat after API-version or plan changes.
