EverBee Research API

Base URL: https://research-open-api.everbee.com · Endpoints live under /api/v1/. This page describes how to authenticate, what browsers need for CORS, and how rate limits work. For request/response schemas, use the API reference or interactive playground.

Authentication

Send these HTTP headers on every request (there is no long-lived session):

client_id — from your app in the EverBee Dev Portal.
client_secret — from the same registration.

The API checks credentials with the Dev Portal, expects an approved installation, and uses the EverBee account email returned for that app to resolve the user. Listing-style data is then filtered to match that user’s subscription (same idea as in-product analytics).

Authorization is not used for Research API auth. It may still appear on requests from browsers or extensions; CORS is configured so those preflights succeed. You do not need a bearer token for this API.

Rate limits

Limits are enforced per client_id (with a per-IP fallback when client_id is missing). The model is similar to common “API key” products: a per-second cap and a rolling daily quota, with limit headers on responses and 429 Too Many Requests when exceeded.

Evaluation order

Queries per second (QPS) are checked first, then queries per day (QPD) on a rolling 24-hour window.

Current limits

QPS: 10 requests per second per client_id
QPD: 50000 requests per rolling 24-hour window per client_id

Source of truth: your responses include x-limit-* and x-remaining-* headers. If these limits ever change, those headers will reflect the updated values.

Response headers (successful requests)

When rate limiting is active, successful responses include:

Header	Meaning
`x-limit-per-second`	Maximum requests allowed in the current wall-clock second.
`x-remaining-this-second`	How many calls remain in that second.
`x-limit-per-day`	Maximum requests in the rolling 24-hour window.
`x-remaining-today`	How many calls remain in that window.

When you are over the limit

HTTP status 429.
Header Retry-After: suggested wait time in seconds before retrying.
Response body includes a short JSON error (e.g. Rate limit exceeded).

Client recommendation: back off with exponential jitter when you receive 429; respect Retry-After when present.

CORS (browser apps)

On research-open-api.everbee.com, responses allow cross-origin GET and OPTIONS and include headers such as:

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers — includes client_id, client_secret, Authorization, Content-Type
Access-Control-Expose-Headers — so JavaScript can read the rate-limit and retry-after headers listed above