Revenue infrastructure you can build on.
No credit card. 500 free execution actions to start.
By signing up you agree to graph8's Terms and Privacy Policy.
One key. Four ways to spend it.
Pick the surface that fits your codebase. Nothing is gated behind a different plan or a second account, and all four resolve to the same org, the same records, and the same credit balance.
REST
Bearer auth against one base URL, https://be.graph8.com/api/v1. JSON in, a data envelope out, page or cursor pagination, and an Idempotency-Key header so a retried write replays instead of duplicating.
SDK
npm install @graph8/sdk, or the Python, Go, and Java clients. All four are generated from one OpenAPI spec, with typed requests, cursor helpers, automatic retries, and webhook signature verification built in.
MCP
Point Claude, Cursor, Windsurf, VS Code, or ChatGPT at the graph8 MCP server and sign in with OAuth. Your agent gets real tools, and there is no key for you to hold.
CLI
g8 login, then g8 search-contacts. Terminal commands over the same API with JSON output, so a prototype or a CI job is a shell script, not a project.
Six surfaces, one buyer graph.
The API is organised the way the product is. Every surface reads and writes the same records, so a contact your app enriches is the contact your customer's rep calls. The counts below are summed from the release contract, not rounded up for a website.
Data
/contactsThe buyer graph and your own CRM on the same records. Search 700M contacts and 100M companies, save to a list, then read and write the objects you keep.
Contacts, Companies, Lists, Fields, Notes, Tasks, Deals, Assert / Upsert, Search, Enrichment
Signals
/intentBuyer intent, website visitor reveal, competitor and answer-engine radar, and the audience syncs that push a segment back out to where you work.
Intent, Radar, Audience Syncs, Scans
Studio
/campaignsCampaign generation, brand and GTM context, knowledge bases, newsletters, and landing pages. Your product asks for content, the platform writes it against real context.
GTM Campaigns, GTM Context, GTM Knowledge Base, Newsletter, Landing Pages, Snippet, Knowledge, Knowledge Base
Engage
/sequencesSequences, inbox, dialer, voice, and booking. The largest group in the contract, because sending and answering is where most of the work happens.
Sequences, Sequence Lifecycle, Inbox, Voice, Meetings, Appointments, GTM Deliverability
Revenue
/quotesQuotes, pipelines, two-way CRM sync, and metering. GET /usage returns your balance and ledger, so you can build your own cost dashboard.
Quotes, CLI Pipelines, CRM Syncs, Usage, Analytics, Logs
Agents
/workflowsWorkflows and Skills you can create, execute, and stream from your own application, plus the repo install path that drops the tracking snippet into a site.
Workflows, Skills, MCP, Repos, Install
The full contract is 54 resources and 460 operations across 367 paths, published as an OpenAPI 3.1.0 spec with a production and a QA server. The six groups above are the ones you reach first.
A key, a curl, and a cursor.
Pass the key as a bearer token. The server resolves your org from the key itself, so nothing in the body or the query string carries an org id, and a key can only ever read and write its own org.
- ✓ Every response wraps its payload in a data field
- ✓ List endpoints add page, limit, total, has_next, and next_cursor
- ✓ limit runs from 1 to 200, default 50
- ✓ Send X-Org-Id as an optional guard: a mismatch returns 403 instead of touching the wrong tenant
curl "https://be.graph8.com/api/v1/contacts?limit=3" \ -H "Authorization: Bearer $G8_API_KEY"{ "data": [ ... ], "pagination": { "page": 1, "limit": 50, "total": 342, "has_next": true, "next_cursor": "bzo1MA" }}Signal to Qualified Meeting, in eight calls.
Build an audience, enrich it, launch outreach, and book a meeting. This chain is carried in the release contract itself: every step resolves to a public operation, and each one feeds the next. If your product does one job on graph8, this is usually the job.
/search/contacts Find the candidates worth working. /lists Create the audience that scopes the run. /lists/{list_id}/contacts Add the contacts you found to it. /enrichment/enrich Enrich them so outreach has real data. /enrichment/verify-email Verify deliverability before a single send. /campaigns Create the campaign against that audience. /campaigns/{campaign_id}/launch Launch it. /appointments/bookings Book the meeting that comes back. What the integration path actually looks like.
The REST surface, the SDKs, the CLI, and the MCP server work today. Production traffic is approved workspace by workspace, with keys scoped to the surfaces you call.
Mint a key
Settings, then MCP and API, then the API tab. Copy the token when it appears, because it is shown once. You can set an expiry from 1 to 365 days. The key is bound to one org at mint time and the server resolves the org from the key, so no request body ever carries an org id.
Build against the live surface
Search, index lookups, and reading records you already saved are free inside the rate cap, so you can page through the graph and shape your product before anything is billed. Every list response comes back in the same envelope, with page or cursor paging and a limit up to 200.
Harden it
Send an Idempotency-Key on writes: the first response is cached for 24 hours and any retry replays it with Idempotent-Replay: true. Subscribe to webhooks and verify the HMAC-SHA256 signature over the timestamp and raw body, rejecting anything more than 5 minutes old. GET /logs returns your recent calls with their request_id when something looks wrong.
Go to production
Mint restricted keys that carry resource:action scopes, so a service only reaches what it needs. Production access is approved workspace by workspace, with availability and support set in the terms rather than on a price list.
Free to search. Metered on execution.
Reading the graph never costs a credit, on any plan, over any surface. Credits move when graph8 does work on your behalf, and you can read your own balance and ledger over the API.
- ✓ Contact and company search
- ✓ Save to list
- ✓ Person and company index lookups
- ✓ The internal email validator
- ✓ Reading records you already saved
These hit indexes graph8 owns, so there is no monthly volume cap. The 50 requests a second ceiling is the only limit.
- ✓ Waterfall enrichment through a third-party provider
- ✓ AI generation
- ✓ Message sends
- ✓ Voice minutes
- ✓ Meeting bookings
Only a successful provider hit charges. A waterfall run that matches nothing is free, a cached result inside the 7-day cache window is free, and bringing your own provider key makes that provider free.
$0 to start
Keys from the first call. 1,000 contact reveals and 500 execution actions free, then $0.05 per credit. No card.
$25 a month
The single org plan. Unlimited contact data under fair use, and execution credits drop from $0.05 to $0.01.
$99 a month
Create and manage orgs over the API, an org per customer, with keys scoped per org. The plan for anything multi-tenant you sell.
GET /usage returns the org balance, held credits, available credits, and the full transaction ledger, read only, so budget alerts and cost dashboards are yours to build. Anything past these three shapes is agreed in the terms, not published as a list price.
Platform pricingThe questions a developer asks first.
How does auth work? +
Three methods, depending on where your code runs. An org API key in an Authorization: Bearer header for REST, the CLI, and server-side SDK calls. A write key for browser-side SDK work like visitor tracking and forms. OAuth for MCP clients, which is why an agent needs no key at all. The API key is an opaque token, not a JWT, and a JWT sent in its place is refused with a 401.
What are the rate limits? +
50 requests a second and 1,000 a minute, applied per org off the key. The cap is the same on every plan. Every response carries X-RateLimit-Limit-Second, X-RateLimit-Limit-Minute, X-RateLimit-Remaining, and X-RateLimit-Reset, so you can pace yourself before you are ever throttled. A 429 adds Retry-After. There is no monthly volume cap on the graph8-owned index endpoints: at the sustained limit with a page size of 200 you can read about 200,000 records a minute.
Can one key serve many customers? +
A normal key is bound to one org when it is minted and cannot be pointed at another, which is what makes it safe by default for multi-tenant data. Agencies are the exception: an agency-scoped key targets any org in its own authorized client set through the X-Target-Org-Id header, clamped to that set, with credits charged to the client org. On the developer plan you create the customer orgs over the API and scope a key to each.
How fresh is the data? +
Not published. The endpoints, the shapes, and the billing are documented; the refresh cadence of the underlying index is not, and we are not going to guess at one here. If your product depends on a specific interval, ask before you build on it.
Is there a sandbox? +
The contract carries a sandbox surface: seed sample data, snapshot and restore it, reset to clean, read a simulated outbox where sends are captured instead of delivered, and inject failures to test your error paths. Access to it is still in development and not open yet. Until it is, build against a free tier key, because search and index lookups cost nothing.
What happens when a call fails? +
Errors come back as a detail field, with field-level entries on a 422 validation failure. 400 for a bad request, 401 for auth, 404 for a missing record, 422 for validation, 429 for the rate cap, 500 for us. Retry 429 and 5xx with backoff and the Retry-After header, and send an Idempotency-Key so the retry replays rather than creating a second record.
Is there a status page? +
No public health dashboard. The developer platform is in preview, and a dashboard would read as production telemetry it has not earned yet. Availability, support response, and production access are contract terms rather than a published number.
Who do I ask when I am stuck? +
dev@graph8.com goes to the engineering team on every plan, and there is in-app chat once you are signed in, which carries your org context so nobody asks you for ids. Send the org id, the request_id, the endpoint and timestamp, and the error body, and the first reply is usually the fix.
Anything the docs do not answer goes to dev@graph8.com.
Start with a key and a curl.
Search and index lookups are free, so the first thing you build costs nothing. Credits move only when graph8 executes: enrichment through a provider, a generation, a send, a call, a booking. Bring the product idea. The revenue infrastructure is already here.
