OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
The current v2 schema defines structured contact records.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts; GET /rest/v2/contacts/{contact_id} · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Filtered collections support page_token/page_size; extraction must comply with the guide’s frequency/unfiltered-query restrictions.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts parameters · Checked 2026-10-16
Keap developer guide and restricted uses ↗
Restricted Uses of the API · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Contact filters include IDs, names and start/end update times.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts filter · Checked 2026-10-16
Access cost barrier -
-
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges.
Keap developer guide and restricted uses ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 10.0/10
Customer authorization without discretionary provider approval
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Customer-owned keys support integrations with other business systems.
Keap PAT and service account keys ↗
Service Account Keys; Creating a key · Checked 2026-10-16
Downstream permission 7.5/10
Published purpose and confidentiality boundaries
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Published restrictions limit continuous/frequent synchronization, unfiltered queries and unsafe clients.
Keap developer guide and restricted uses ↗
Restricted Uses of the API · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 7.5/10
Create and update in one business domain
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
POST contact creation and PATCH contact update are explicit operations.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
POST /rest/v2/contacts; PATCH /rest/v2/contacts/{contact_id} · Checked 2026-10-16
Custom application path 10.0/10
Customer applications using fixed APIs without provider selection
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Customers can implement scripts and back-office integration using generated keys.
Keap PAT and service account keys ↗
Introduction; Service Account Keys · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Bounded start_update_time/end_update_time contact filters support permitted refreshes.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts filter · Checked 2026-10-16
Keap developer guide and restricted uses ↗
Restricted Uses of the API · Checked 2026-10-16
Limit visibility 7.5/10
Numeric usage or polling guidance
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
PAT/SAK budgets are 10/second, 240/minute and 30,000/day; OAuth is separate.
Keap PAT and service account keys ↗
Quotas and Throttles · Checked 2026-10-16
CDC and deletion capture 5.0/10
Updates identified; deletion capture not established
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Update-time contact filters identify changes; hard-delete identities are unverified.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts filter · Checked 2026-10-16
Replay and gap recovery 5.0/10
Bounded redelivery or overlapping queries; no durable consumer checkpoint
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Overlapping bounded update-time queries refetch current matching records; no durable historical event checkpoint is established.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts filter · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Filtered authorized contact JSON provides a scoped external record copy under the published use restrictions.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts response · Checked 2026-10-16
Keap developer guide and restricted uses ↗
Restricted Uses of the API · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
No retrieval window or export charge at cancellation is established by these technical sources.
Keap developer guide and restricted uses ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Portable scoped contact records; unrestricted replication and complete product history/files are not established.
Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗
GET /rest/v2/contacts response · Checked 2026-10-16
Keap developer guide and restricted uses ↗
Restricted Uses of the API · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 2.5/10
External integration code; native business logic portability not established
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
The guide explicitly supports customer scripts and back-office integrations.
Keap PAT and service account keys ↗
Introduction · Checked 2026-10-16
Rights to custom logic -
-
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Rights to native workflow artifacts and independent execution are not established.
Keap developer guide and restricted uses ↗
Reviewed product documentation; stated limitation not resolved · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Any user can create a personal token with their own permissions. Administrators create service keys with administrator access; OAuth applications use a registered client and user consent.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
The current v2 schema documents filtered contact lists, page_token/page_size and selected fields. start_update_time/end_update_time support bounded change queries; this does not override the restriction on unfiltered or excessively frequent extraction.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer user personal access token | API key | Customer | No | user creates pat; bearer credential inherits user permissions; restricted uses apply | 2026-10-16 |
| Administrator service account key | API key | Customer | No | administrator-created bearer key grants administrator data access; restricted uses apply | 2026-10-16 |
| User-authorized registered OAuth app | OAuth 2.0 | Integration provider | Not confirmed | developer app credentials plus customer authorization; exact distribution review unknown | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
Lowest-plan entitlement and fixed API charges remain unknown. PAT/service keys have published limits of 10 queries/second, 240/minute and 30,000/day; OAuth budgets require separate verification.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
POST /rest/v2/contacts creates a contact and PATCH /rest/v2/contacts/{contact_id} updates it. duplicate_option can update a matching record during create, so validate its selected matching semantics before execution.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Bounded update-time queries can refetch current matching contacts. Hard deletion capture and retained event replay remain unknown; allowed cadence and purpose must respect the developer guide restrictions.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates identified; deletion capture not establishedKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Update-time contact filters identify changes; hard-delete identities are unverified. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts filterChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Bounded redelivery or overlapping queries; no durable consumer checkpointKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Overlapping bounded update-time queries refetch current matching records; no durable historical event checkpoint is established. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts filterChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Filtered contact JSON supports a narrow external record copy when use complies with the published restrictions. Complete product history/files, unrestricted replication and cancellation retrieval remain unverified.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
Service keys are intended for back-office integrations and customer scripts. Native workflow artifacts, their ownership and independent execution were not established (external code does not prove native portability).
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. The current v2 schema defines structured contact records. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts; GET /rest/v2/contacts/{contact_id}Checked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Filtered collections support page_token/page_size; extraction must comply with the guide’s frequency/unfiltered-query restrictions. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts parametersChecked 2026-10-16 Keap developer guide and restricted uses ↗Restricted Uses of the APIChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Contact filters include IDs, names and start/end update times. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts filterChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Customer authorization without discretionary provider approvalKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Customer-owned keys support integrations with other business systems. | Keap PAT and service account keys ↗Service Account Keys; Creating a keyChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. The reviewed documentation does not establish lowest-plan entitlement and access-specific fixed charges. | Keap developer guide and restricted uses ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | Published purpose and confidentiality boundariesKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Published restrictions limit continuous/frequent synchronization, unfiltered queries and unsafe clients. | Keap developer guide and restricted uses ↗Restricted Uses of the APIChecked 2026-10-16 |
| Which external write operations are documented? | Create and update in one business domainKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. POST contact creation and PATCH contact update are explicit operations. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗POST /rest/v2/contacts; PATCH /rest/v2/contacts/{contact_id}Checked 2026-10-16 |
| How can customers connect an application they build or choose? | Customer applications using fixed APIs without provider selectionKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Customers can implement scripts and back-office integration using generated keys. | Keap PAT and service account keys ↗Introduction; Service Account KeysChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Bounded start_update_time/end_update_time contact filters support permitted refreshes. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts filterChecked 2026-10-16 Keap developer guide and restricted uses ↗Restricted Uses of the APIChecked 2026-10-16 |
| How are integration limits disclosed? | Numeric usage or polling guidanceKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. PAT/SAK budgets are 10/second, 240/minute and 30,000/day; OAuth is separate. | Keap PAT and service account keys ↗Quotas and ThrottlesChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Filtered authorized contact JSON provides a scoped external record copy under the published use restrictions. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts responseChecked 2026-10-16 Keap developer guide and restricted uses ↗Restricted Uses of the APIChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. No retrieval window or export charge at cancellation is established by these technical sources. | Keap developer guide and restricted uses ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| How can customers define their own business logic? | External integration code; native business logic portability not establishedKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. The guide explicitly supports customer scripts and back-office integrations. | Keap PAT and service account keys ↗IntroductionChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Rights to native workflow artifacts and independent execution are not established. | Keap developer guide and restricted uses ↗Reviewed product documentation; stated limitation not resolvedChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedKeap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. Portable scoped contact records; unrestricted replication and complete product history/files are not established. | Keap public REST v2 OpenAPI schema (linked by official reference config.js) ↗GET /rest/v2/contacts responseChecked 2026-10-16 Keap developer guide and restricted uses ↗Restricted Uses of the APIChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- A purpose-appropriate permitted extraction cadence under restricted uses
- API entitlement, fixed fees and OAuth-specific quota
- Deletion capture and durable event replay
- Complete files/history and native artifact rights
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.