The API lets other software create campaigns, add leads and read replies; webhooks push events (reply received, lead interested, bounce) to other systems as they happen. Buyers care because cold email is now run from Clay, n8n, Make and Zapier by GTM engineers, and since 2025–2026 from AI assistants through MCP servers.
The 2026 development: Instantly, Smartlead, lemlist, Apollo, Reply.io, Woodpecker and HubSpot all ship official MCP servers. The API is becoming the product's main interface for agents, not a side door.
How it works
REST endpoints authenticated by API key or OAuth; webhooks registered per workspace or campaign with event filters; rate limits per key, workspace or plan. MCP servers wrap a subset of the API as "tools" that an LLM client (Claude, ChatGPT, Cursor, n8n) can call.
Who does it well
| Player | API (as of Oct 2026) | Rate limit | Webhooks | MCP |
|---|---|---|---|---|
| Instantly | v2, 300+ endpoints incl. audit log, workspace members, AI agents (docs); v1 deprecated Jan 19, 2026 (docs) | 100 req/s, 6,000 req/min per workspace (docs) | 17 named events + custom labels (docs) | Official, mcp.instantly.ai/mcp, 31 tools, API key (help) |
| Smartlead | v1, api_key query parameter; Pro ($94) and up (docs, pricing.md) | 60/min (Standard) or 120/min (Pro); 3 analytics endpoints at 10/min | 13 events (docs) | Official since ~April 2026, 116+ tools, key in URL (blog) |
| EmailBison | Full REST API on the $599 plan (pricing) | Not documented | Events + 10-day delivery history, manual resend (docs) | None found |
| lemlist | All plans (pricing) | 20 req / 2 s per key (docs) | Add/list/delete webhooks | Official, OAuth or key, tool buckets, plus CLI (docs) |
| Apollo.io | Per team, per endpoint | 50–200/min, 600–6,000/day by plan (docs) | Not verified | Official, OAuth, any plan incl. free (Apollo) |
| Saleshandy | All plans | 100/min, 50,000/day on Starter (pricing) | Pro and up | Not verified |
| Woodpecker | $20/mo add-on (pricing) | Not verified | In add-on | "MCP Server, CLI" listed |
| Reply.io | All plans (pricing) | Not verified | All plans | All plans |
| Outreach | 250,000–1,000,000 calls by tier (pricing) | — | — | Not verified |
| HubSpot Sequences | Mature CRM API | — | — | Official GA MCP, OAuth, read/write CRM objects (HubSpot) |
PlusVibe gates API and webhooks to its Business plan; Salesforge to Growth ($80/mo) (PlusVibe, Salesforge).
Where implementations differ
- Throughput. Instantly allows 6,000 requests a minute per workspace; Smartlead's Standard tier allows 60 — a hundredfold gap. Agencies syncing many clients notice.
- Auth hygiene. Smartlead passes the key as a query parameter in both API and MCP (
/sse?user_api_key=…); keys in URLs leak into proxy and server logs. lemlist and Apollo offer OAuth for MCP. - Event model. Instantly emits outcome events (
lead_interested,lead_meeting_booked,lead_closed,lead_wrong_person); Smartlead emits operational ones (EMAIL_ACCOUNT_DISCONNECTED,MANUAL_STEP_REACHED,UNTRACKED_REPLIES). EmailBison's replay tooling — 10 days of payloads and attempts, resend by date range — is the most integrator-friendly found. - MCP coverage. Instantly's help lists 31 tools while its developer docs describe the full V2 API; a Reply.io review says they "do not fully reconcile" and that MCP rate limits are undocumented. Smartlead claims 116+ tools; lemlist lets clients filter by bucket. Apollo forbids destructive bulk operations.
- Integrations. Instantly says v1-based Zapier and Make integrations "will keep working" after deprecation. EmailBison points low-code users to Clay, Zapier and Make guides (docs).
Retry policies are poorly documented. Smartlead says only that it "will retry" if no 200 arrives; EmailBison's docs give a 15-second timeout but no retry count, while a third-party profile claims "up to 5 retry attempts over 24 hours". Instantly's webhook page gives no retry policy.
Risks and abuse
APIs and MCP servers let one actor run thousands of campaigns without a human — the shape of abuse that triggers Provider crackdowns. Vendors need per-key spend and volume caps, anomaly detection, and audit trails that name which key or agent did what. Instantly exposes an audit-log endpoint; none of the vendors documents agent-scoped permissions or dry-run.
What this means for an entrant
- Make the API the product: everything the UI does, available over a versioned API and an MCP server from launch.
- Ship what the incumbents lack for agents: OAuth with fine scopes, idempotency keys, dry-run/preview, per-key credit caps, agent-attributed audit logs, and documented MCP rate limits.
- Publish outcome webhooks with signed payloads, documented retries and a replay API — copy EmailBison's event history and go further.
- Match Instantly's throughput (6,000/min); undercut Smartlead's gating by including the API on the entry plan.
- Ship first-class n8n, Make, Zapier and Clay connectors; GTM engineers choose tools by integration quality.