The whole record, one call away.

Only the scopes you granted it, and only inside your own organisation. The organisation is resolved from the key itself rather than from anything in the request, so a key cannot be pointed at someone else’s data by editing a parameter, and a key missing a scope is refused rather than quietly given less.

Page through once with limit and nextCursor, then poll with updatedSince and de-duplicate on each record’s stable id. Rows come back newest-updated first, so an incremental poll reads what moved and nothing else. Cursors are opaque: store them, do not parse them.

A 429 with a Retry-After header saying how long to wait. There are two independent ceilings — a per-minute rate and a monthly call quota — and every response carries the limit, what is left of it and when the window resets, so a well-behaved client paces itself before it gets there. Limits are per key, so one integration can never throttle another.

Both. Writes go through the same services the product itself uses, so they inherit the same guards: the server computes a time entry’s minutes and decides whether it is billable, and an append into an approved timesheet is refused. Every write requires an Idempotency-Key header, so a retry replays the stored response rather than booking the same hours twice.

Rotate it rather than deleting it. The rotation mints a successor carrying the same scopes, environment and limits, and leaves the old secret working for a grace window while you roll your integration onto the new one. Nothing has to be revoked and recreated at midnight.

A breaking change ships under a new version prefix, never inside this one. A route being retired stays supported and advertises its removal date in the Deprecation, Sunset and Link response headers, so a client learns it is on borrowed time from the response itself rather than from an email somebody forgot to send.