Developers & API

API errors, request IDs and rate limits

Use the structured error and request ID; respect per-app, account and endpoint rate limits.

The public HAWI API returns structured errors and safe request IDs. API authorization checks the app, installation, environment, customer account, workspace, scopes and resource ownership. Rate limits are isolated by app, installation/account and endpoint class. CORS is not authorization.

Audience: developer
Updated: 2026-08-24

Create a HAWI developer appEnroll as a developer, create or join a developer organization, then create an app owned by that organization.
Use HAWI OAuth authorization code flowRegister an exact redirect URL, use state and PKCE where applicable, exchange the one-time code, then rotate refresh tokens.
Verify a HAWI webhookVerify the signature over the unmodified body and timestamp, enforce the replay window and deduplicate the event ID.

API errors, request IDs and rate limits

Related guides