> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crustdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> List every Crustdata API endpoint with your account's access status, enabled and disabled response fields, and effective rate limits — in one free GET request.

Use this endpoint to see exactly what your API key can do: which endpoints
your account can call, which response fields each returns, and the rate limit
that applies to you per endpoint. It is read-only — to change your access,
contact your Crustdata account manager.

<Note>
  This endpoint is **free** — checking your permissions does not consume any
  credits. It is rate limited to 300 requests per minute.
</Note>

## Endpoint

```
GET https://api.crustdata.com/account/endpoints
```

Authenticate with your API key in the `Authorization` header and send the
required `x-api-version: 2025-11-01` header — requests without it return
`400`. Permissions are account-wide: every API key on your account starts with
the same access. An admin can narrow an individual key further — see
[Per-key endpoint access](#per-key-endpoint-access).

## Filter, or the response is hard to read

Unfiltered, this endpoint returns all 33 product endpoints, and every entry
lists each response field your account can and cannot receive as a dot-path
string. That is 1,947 field strings in total, and `/company/enrich` alone
contributes 558 enabled and 58 disabled. As compact JSON on a single line the
whole payload is around 77 KB, which is why `--format json` on the
[CLI](/for-agents/cli) gives you a wall of text.

Start with a single endpoint to learn the shape:

```bash theme={"theme":"vitesse-black"}
curl --request GET \
  --url 'https://api.crustdata.com/account/endpoints?path=/web/enrich/live' \
  --header 'authorization: Bearer YOUR_API_KEY' \
  --header 'x-api-version: 2025-11-01'
```

That entry is five fields long and fits on a screen. Then widen with
`category` or `status`. If you do want everything, pipe it through `jq` and
drop the field lists:

```bash theme={"theme":"vitesse-black"}
curl -s --request GET \
  --url 'https://api.crustdata.com/account/endpoints' \
  --header 'authorization: Bearer YOUR_API_KEY' \
  --header 'x-api-version: 2025-11-01' \
  | jq -r '.endpoints[] | [.status, .effective_rate_limit_rpm, .category, .path] | @tsv'
```

## Query parameters

All parameters are optional filters and combine with AND. A filter that
matches nothing returns `200` with an empty `endpoints` array, not a `404`.

| Parameter  | Example                 | Effect                                                                                                              |
| ---------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `path`     | `?path=/company/enrich` | Exact endpoint-path match. Case-sensitive, leading slash required, and a prefix such as `/company` matches nothing. |
| `category` | `?category=Company`     | Endpoints in that product category. Case-insensitive. URL-encode the space and ampersand in `LinkedIn & Social`.    |
| `status`   | `?status=enabled`       | Only `enabled` or `disabled` endpoints. Case-sensitive; any other value returns `400`.                              |

## Example request

<CodeGroup>
  ```bash Request theme={"theme":"vitesse-black"}
  curl --request GET \
    --url 'https://api.crustdata.com/account/endpoints?path=/company/enrich' \
    --header 'authorization: Bearer YOUR_API_KEY' \
    --header 'x-api-version: 2025-11-01'
  ```

  ```python Python theme={"theme":"vitesse-black"}
  import requests

  resp = requests.get(
      "https://api.crustdata.com/account/endpoints",
      headers={
          "Authorization": "Bearer YOUR_API_KEY",
          "x-api-version": "2025-11-01",
      },
  )
  for endpoint in resp.json()["endpoints"]:
      print(endpoint["path"], endpoint["status"], endpoint["effective_rate_limit_rpm"])
  ```

  ```json Response theme={"theme":"vitesse-black"}
  {
    "api_version": "2025-11-01",
    "token_limit_rpm": null,
    "endpoints": [
      {
        "path": "/company/enrich",
        "category": "Company",
        "status": "enabled",
        "effective_rate_limit_rpm": 15,
        "fields": {
          "enabled": ["basic_info", "basic_info.all_domains", "basic_info.company_type", "..."],
          "disabled": ["hiring.recent_openings", "social_posts", "..."]
        }
      }
    ]
  }
  ```

  The `enabled` and `disabled` lists are truncated above. In the real response
  this one entry carries 558 enabled and 58 disabled field paths.
</CodeGroup>

## Response fields

| Field                                  | Type           | Description                                                                                                                                                                               |
| -------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `token_limit_rpm`                      | number \| null | Aggregate requests-per-minute ceiling for your API key across all endpoints. `null` when no account-wide ceiling is set, which is the usual case; the per-endpoint limit applies instead. |
| `endpoints[].path`                     | string         | Endpoint path, as you would call it.                                                                                                                                                      |
| `endpoints[].category`                 | string         | Product category: `Company`, `Person`, `Jobs`, `Web`, `LinkedIn & Social`, or `Other`.                                                                                                    |
| `endpoints[].status`                   | string         | `enabled` — your account can call it; `disabled` — it requires an upgrade.                                                                                                                |
| `endpoints[].effective_rate_limit_rpm` | number \| null | The requests-per-minute limit that applies to your account for this endpoint.                                                                                                             |
| `endpoints[].fields.enabled`           | string\[]      | Response fields your account receives from this endpoint.                                                                                                                                 |
| `endpoints[].fields.disabled`          | string\[]      | Response fields withheld from your account.                                                                                                                                               |

## How to read the field lists

* On an **enabled** endpoint, `fields.disabled` lists the specific fields your
  plan does not include — the endpoint works, but those fields are omitted
  from its responses.
* On a **disabled** endpoint, `fields.enabled` is empty and
  `fields.disabled` lists everything the endpoint can return — the full set
  you would unlock by enabling it.
* **Batch endpoints** (`/batch/...`) list the fields of the job envelope they
  return (`batch_id`, `status`, `status_url`, and so on), not the fields of
  the records the job produces. Read the matching non-batch endpoint's entry
  for those. A batch endpoint with no field-gated payload lists nothing at
  all.
* Field names are dotted paths (for example `basic_info.company_type`)
  matching the response structure of the endpoint. Both lists are sorted, and
  so is the `endpoints` array itself.

## Errors

| Status | Body                                                                                                              | Cause                                          |
| ------ | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| `401`  | `{ "message": "Missing API key in request" }`                                                                     | No `Authorization` header.                     |
| `401`  | `{ "message": "Invalid API key in request" }`                                                                     | `Authorization` header carries an invalid key. |
| `400`  | `{ "error": { "type": "invalid_request", "message": "Missing required header: x-api-version. ..." } }`            | No `x-api-version` header.                     |
| `400`  | `{ "error": { "type": "invalid_request", "message": "Account endpoints requires API version 2025-11-01. ..." } }` | Unsupported `x-api-version` value.             |
| `400`  | `{ "error": "Invalid status 'x'; expected one of ['enabled', 'disabled']" }`                                      | `status` filter outside `enabled`/`disabled`.  |
| `429`  | —                                                                                                                 | More than 300 requests per minute.             |

## Per-key endpoint access

Account permissions set the ceiling for every key on the account. A workspace
admin can restrict an individual key to a subset of those endpoints on the
**API Keys** page in your [dashboard](https://app.crustdata.com/). A key with no
restriction can call everything the account has enabled.

Calling an endpoint the key is not allowed to use returns `403`:

```json theme={"theme":"vitesse-black"}
{
  "error": {
    "type": "permission_error",
    "message": "This API key does not have access to /person/search. A workspace admin can update the key's endpoint access in the dashboard.",
    "metadata": []
  }
}
```

The status and `error.type` match an account-level permission failure, so
clients need no new handling. The message names the endpoint that was refused.

## What to do next

* **Check your balance** — see [Credits](/general/credits) before large batches.
* **Understand per-endpoint limits** — see [Rate limits](/general/rate-limits).
* **See what fields cost** — review [Pricing](/general/pricing) for credit costs per endpoint.


## Related topics

- [Person Enrichment](/person-docs/enrichment/introduction.md)
- [Technographics](/guides/technographics.md)
- [Person Enrich reference](/person-docs/enrichment/reference.md)
- [Person Contact Enrich](/person-docs/contact/enrich.md)
- [Credits](/general/credits.md)