lemlist API Review 2026: Can You Build Full Outbound Automation on It?

The question behind evaluating an outreach platform's API is whether it exposes enough of the product to justify a programmatic dependency, or whether you'll end up back in the dashboard for the operations that matter most.

lemlist's API is a REST surface on its second major version, with HTTP Basic authentication, twenty resource groups spanning campaigns, leads, sequences, email accounts, webhooks, enrichment, and the 650M+ contact database, and a developer portal that is public and interactive.

API access ships with every paid plan starting at $39/month. For a bootstrapped platform at $50M ARR, that is a mature developer surface.

lemlist's API covers outbound sales execution: creating and managing multichannel campaigns, adding and enriching leads, connecting email accounts, triggering sequences, handling webhooks across five channels (email, LinkedIn, WhatsApp, SMS, calls), and searching the 650M+ B2B contact database.

If your build automates the outreach pipeline (from lead sourcing through campaign enrollment to reply handling) the API is scoped for that job. Where it stops is at the data intelligence layer: there are no endpoints for org charts, corporate hierarchies, technographic profiling, buyer intent search, AI-powered account research, or compliance management.

This is where ZoomInfo enters the picture.

ZoomInfo is an AI GTM platform whose API is a REST suite covering search, enrichment, AI intelligence, and audience management across 500M contacts and 100M companies, with OAuth 2.0 authentication, tiered rate limits up to 35 req/sec, and an MCP server for AI-agent workflows.

ZoomInfo's API provides the data intelligence layer that tells you who to reach and why they are worth reaching, while lemlist's API handles the reaching.

This review covers the lemlist API in technical depth first, then reviews ZoomInfo's API as the intelligence layer that picks up where outreach execution stops.

lemlist API at a Glance

lemlist API: What Works Well & What to Plan Around

lemlist API: Authentication & Getting Started

API access starts with any paid lemlist plan. The pricing page lists "CRM integrations & API" as a feature of the entry-level Email plan at $39/month, with no separate developer tier, approval gate, or enterprise-only restriction. Any active subscriber can generate an API key from the app at Settings > Team > Integrations.

Keys are shown only once at creation and cannot be retrieved afterward. Store them immediately.

lemlist uses HTTP Basic authentication, not Bearer tokens. The docs flag this distinction explicitly. The username is always empty; the password is your API key. You Base64-encode the string :YourApiKey (note the leading colon for the empty username) and pass the result in an Authorization: Basic <encoded-value> header on every request.

A basic authenticated request:

curl "https://api.lemlist.com/api/team" \

-H "Authorization: Basic $(echo -n ':YOUR_API_KEY' | base64)"

One practical distinction: the MCP server at https://app.lemlist.com/mcp supports OAuth 2.0 with PKCE as its recommended authentication path.

The OAuth flow handles discovery, client registration, consent, and token exchange through the browser via mcp-remote. Access tokens last 1 hour; refresh tokens last 30 days. If you are building AI-agent integrations through Claude, Cursor, or another MCP-compatible client, OAuth is the intended path. For direct REST API calls, HTTP Basic is the only option.

Two things to plan around:

• HTTP Basic auth is simple to implement but offers no credential rotation, no scoped permissions, and no delegated access for multi-tenant integrations. If you are building a SaaS product that connects to many lemlist workspaces, each customer must generate and share an API key manually.

• The 14-day free trial provides full Multichannel plan access including the API, but there is no permanent free tier with API access.

lemlist API: Core Endpoints & Capabilities

The v2 API organizes endpoints into twenty resource groups, all served from https://api.lemlist.com/api. Requests and responses use JSON. The five most-called endpoints, as highlighted in the developer portal:

• POST /leads: create a lead in a specific campaign

• POST /enrich: trigger enrichment for a lead

• POST /people-database/search: search the B2B contact database

• POST /hooks: register a new webhook

• GET /leads/{email}: retrieve a lead record by email address

Leads, Contacts & Companies

The leads resource is the central data object in lemlist's API.

Operations include create, list (via POST filter), get, patch, delete (single and bulk), search by email, add to campaign, and move between campaigns. Leads are campaign-scoped: a lead exists within a campaign context, and the API supports adding leads in bulk to campaigns or lists.

The contacts resource is separate from leads. Contacts represent the underlying contact record independent of any campaign enrollment, while leads are campaign-specific instances. The companies resource handles company-level records linked to leads, supporting CRUD operations. The fields resource manages custom field definitions, letting you extend the data model to fit your pipeline's needs.

What you would build with this: a CRM sync that pushes qualified contacts from your deal pipeline into lemlist campaigns based on stage changes, or a deduplication service that merges contact records across workspaces before outreach begins.

Campaigns & Sequences

The campaigns resource gives you programmatic control over the campaign lifecycle: create, read, update, delete, start, and pause. Sequences (the multi-step outreach workflows attached to campaigns) are a separate resource with their own CRUD endpoints.

The schedules resource controls sending time windows, letting you define when campaign steps execute by timezone.

What you would build with this: an agency automation that spins up client-specific campaigns from a template, configures sending schedules by the client's timezone, and activates them without touching the dashboard.

People Database, Enrichment & Signal Agents

The people database endpoints expose lemlist's 650M+ B2B contact database programmatically.

The POST /people-database/search endpoint accepts filters by role, industry, company size, and location, returning matched contacts.

The enrich endpoint (POST /enrich) triggers waterfall enrichment for a lead, querying multiple data providers in sequence until a verified email or phone number is found.

Enrichment is asynchronous: the enrichmentDone and enrichmentError webhook events notify your system when results are ready. Credits are consumed only on successful enrichment: 5 credits per verified email, 20 credits per phone number.

The signal agents resource lets you query and manage Intent Signal Agents, which monitor for buying triggers (website visits, job postings, funding events, LinkedIn engagement). The signalRegistered webhook event fires when a new intent signal is detected.

What you would build with this: a prospecting pipeline that searches the B2B database for contacts matching your ICP, enriches them with verified emails, monitors for intent signals, and auto-enrolls them into the appropriate campaign when a buying trigger fires.

Email Accounts, Deliverability & Supporting Resources

The email accounts resource handles connected sender mailboxes with CRUD operations plus sending infrastructure management. The lemwarm resource manages email warm-up settings per mailbox, giving you programmatic control over lemwarm's warm-up process.

The inbox resource covers the unified conversation inbox where all multichannel replies land. The tasks resource handles manual tasks within sequences. The activities resource provides an activity log for all events per lead.

Additional supporting resources:

• CRMs: push/pull operations to connected CRM systems (HubSpot, Salesforce, Pipedrive)

• Unsubscribes: global and campaign-level unsubscribe list management

• Team and Users: team-level settings and user account management

lemlist API: Webhooks & Events

lemlist has a webhook system managed via POST /api/hooks.

A webhook subscription delivers real-time POST callbacks to a developer-supplied targetUrl. The type field specifies which event to subscribe to; omitting it subscribes to all events. Subscriptions can be scoped to a specific campaign via the campaignId parameter, or restricted to the first activity per lead with isFirst=true.

The event catalogue covers every channel:

Email: emailsSent, emailsOpened, emailsClicked, emailsReplied, emailsBounced, emailsFailed, emailsUnsubscribed

LinkedIn: 25+ events covering messages, profile visits, follows, connection requests (sent, accepted, withdrawn), endorsements, voice notes, post likes, and failures at each stage

WhatsApp: sent, delivered, opened, replied, failed

SMS: sent, delivered, replied, failed

Calls: created, ended, done, interested/not interested, recording ready, transcript ready

Enrichment: enrichmentDone, enrichmentError

Signal Agents: signalRegistered (new intent signal detected)

Workspace: campaign complete, connection issues, send limit reached, lemwarm paused, deliverability alerts, custom domain errors

Lead-state groups: contacted, hooked, attracted, warmed, interested, notInterested (aggregates across channels)

Inbox: inboxLabelUpdated

Each webhook payload is a JSON object carrying the activity _id, event type, teamId, campaignId, leadId, denormalized lead and sender identity, and an ISO timestamp. Email events include full to/cc/bcc arrays. Third-party replies (where the responder is not the original lead) are flagged with isThirdPartyReply: true and omit campaign/sequence identifiers.

An optional secret field can be set at creation time. It is stored encrypted, never returned by any GET endpoint, and echoed back in every callback body so receivers can verify authenticity. The secret is immutable: rotating it requires deleting and recreating the webhook.

Webhook management endpoints: POST /hooks (create), DELETE /hooks/{id} (delete), GET /hooks (list all).

The breadth of this event catalogue is a real strength. Five outreach channels, workspace-level operational alerts, enrichment completion, and intent signal detection all push to the same webhook infrastructure, so a single integration can drive a real-time event pipeline without polling.

One caveat: the public documentation does not describe retry policy or delivery guarantees for webhook callbacks, so design your receiver to be idempotent.

lemlist API: SDKs, Docs & Rate Limits

SDKs & Libraries

lemlist publishes no official SDKs.

The developer portal makes no mention of language-specific client libraries and directs developers toward iPaaS connectors (Zapier, Make, n8n) for low-code integrations or the MCP server for AI-agent workflows.

No official SDK means you own the HTTP client, the Base64-encoded auth header, the rate-limit backoff logic, and the error handling. For a webhook listener or a nightly enrichment job, that is manageable. For a production system with retry logic and rate-limit management across twenty resource groups, the engineering overhead is real.

Documentation & Developer Experience

The developer documentation lives at developer.lemlist.com, hosted on Mintlify. It is organized into three areas:

• Getting Started: authentication, rate limits, and overview

• Endpoints: interactive reference with try-it panels and pre-built cURL examples for every resource group

• Objects & Definitions: resource schema documentation

The docs include an AI assistant embedded in the UI that searches the documentation and generates answers inline. An llms.txt index is published for AI consumption, and a skill.md file covers common AI-agent use cases. The MCP section provides copy-paste configuration snippets for Claude Desktop, Claude Code, and Cursor.

The documentation does not include a downloadable OpenAPI/Swagger spec, a Postman collection, or a public changelog. Without a changelog, tracking what has changed between releases is harder when maintaining a long-lived integration. lemlist's status page reports 99.03% API uptime over a 90-day window.

Rate Limits & Constraints

The published rate limit is straightforward: 20 requests per 2-second window, enforced per API key, across all routes. There is no tiered rate limit by plan.

Every API response includes four rate-limit headers:

The effective throughput ceiling is 10 requests per second. For a single integration doing lead imports and campaign management, that is workable. For a high-volume pipeline pushing thousands of records or orchestrating across multiple campaigns, it requires careful request management and queuing.

No separate bulk-import limits, concurrent-request caps, or per-endpoint restrictions are documented beyond the 20 req/2s ceiling.

lemlist API Pricing & Access Costs

lemlist bundles API access into its paid plans rather than charging per call or offering a separate developer tier. The pricing page lists "CRM integrations & API" as a feature across all tiers:

• Email plan: $39/month ($31/month billed annually). Unlimited users, 5,000 emails/month. Includes API, MCP server, 650M+ lead database, unlimited contacts, AI Copilot, CRM integrations, and deliverability tools.

• Multichannel plan: $109/month per user ($87/month per user billed annually). Everything in Email, plus LinkedIn automation, SMS, WhatsApp add-on, built-in call dialer, and VoIP integrations.

• Enterprise: Custom pricing for teams of 5+ users. Everything in Multichannel, plus SSO/SAML, custom user roles, dedicated account manager, and priority support.

There are no published per-call API charges. The API draws from the same platform limits as the dashboard.

The cost driver for API-heavy builds is the credits system. Enrichment and intent signal operations consume credits on a pay-per-success basis (1 credit = $0.01):

• Verified email: 5 credits ($0.05)

• Phone number: 20 credits ($0.20)

• Website visitor signal: 20 credits ($0.20)

• Hiring/job change signal: from 100 credits ($1.00+)

• Company fundraise signal: 100 credits ($1.00)

• LinkedIn engagement signal: from 400 credits ($4.00+)

Credits are purchased in prepaid packs (minimum $10 for 1,000 credits) and can be topped up without a plan upgrade.

For a developer sizing costs: the API itself is free if you already pay for lemlist. A pipeline that enriches 10,000 contacts with verified emails consumes 50,000 credits ($500). The same pipeline adding phone numbers would add 200,000 credits ($2,000). At scale, credit costs can exceed the subscription cost, so model your enrichment volume before committing.

The 14-day free trial provides full Multichannel plan access including the API. There is no permanent free tier with API access.

Where the lemlist API Falls Short

These are practical limits a developer should plan around, not criticisms of the platform. Several are scope decisions that reflect what lemlist is (a multichannel outreach platform) and what it is not.

Data intelligence stops at outreach. The People Database and Enrich endpoints provide access to lemlist's 650M+ contact database with waterfall email and phone enrichment, which covers contact discovery well. But there are no endpoints for org charts, corporate hierarchies, employment history, technographic profiling, or company financials.

If your pipeline needs to verify an email, then map the recipient's position in a buying committee, identify their company's technology stack, and check whether the account shows buying signals, you need a second API for everything after the contact lookup.

No buyer intent search at the API layer. The Signal Agents resource lets you manage intent-signal monitoring, and the signalRegistered webhook fires when a signal is detected. But the API does not expose intent data as a searchable, queryable resource.

You cannot query "show me all companies in SaaS with 50-200 employees that are researching outbound tools" through the API. The signal system is event-driven, not query-driven.

HTTP Basic auth with no rotation or scoping. The REST API uses a static API key passed as an HTTP Basic password. There is no OAuth flow for the REST surface (the MCP server supports OAuth 2.0, but that is a separate access path). For teams with strict credential-rotation policies or multi-tenant integrations requiring delegated access per customer, static key auth is limiting.

Rate limits are tight. The 20 requests per 2-second window (10 req/sec) applies uniformly to all endpoints and is not tiered by plan. For orchestrating bulk imports across multiple campaigns, this ceiling requires careful request queuing. There is no documented way to request higher limits.

No official SDKs. Every integration is raw HTTP with manual Base64-encoded auth headers. For a production system with retry logic, rate-limit backoff, and error handling across twenty resource groups, the absence of maintained client libraries adds engineering overhead.

No compliance or privacy API. There is no endpoint for managing data privacy requests, opt-outs, or regulatory compliance programmatically. Teams building GDPR or CCPA workflows into their data pipeline will find this a gap.

Pagination is undocumented. The public API overview does not describe the pagination schema for list endpoints, leaving developers to discover the pattern through experimentation or support requests.

ZoomInfo API: The Data Intelligence Layer Beyond Outreach

lemlist's API tells your pipeline how to reach a contact.

ZoomInfo's API tells it who is worth reaching, what company they represent, what technology that company uses, whether the account is researching your category, and where the contact sits in the org chart.

The two APIs operate at different layers of a data pipeline. The gap between "send this person an email" and "should we be reaching this person at all?" is where ZoomInfo's API fits.

What the API Covers: Search, Enrichment & AI Intelligence

ZoomInfo's Enterprise API is a REST suite served from https://api.zoominfo.com/gtm, organized into four areas documented in the interactive API reference:

Data API (Search & Enrich): Search endpoints cover Contacts, Companies, Intent, News, and Scoops, returning matched records without consuming credits. Enrich endpoints unlock the full payload: business emails, direct dials, employment history, corporate hierarchy, org charts, technographics, and hashtag signals, up to 25 records per call.

The underlying dataset spans 500M contacts, 100M companies, 135M+ verified phone numbers, and 200M+ verified business email addresses.

Behind this sits the GTM Context Graph, which processes 1.5B+ data points daily by fusing ZoomInfo's B2B data with your first-party CRM records, conversation transcripts, and behavioral signals to surface the context behind your accounts. The search-then-enrich pattern means you filter freely, then pay only for the records you commit to.

AI Intelligence API: Account Summary returns structured account intelligence with a free-form Q&A endpoint. Find Similar Companies performs lookalike expansion from a seed account. Contact Recommendations returns AI-ranked buying-committee suggestions by motion (prospecting, deal acceleration, renewals).

Compliance API: Data privacy and opt-out management endpoints for handling GDPR and CCPA requests programmatically, filling a gap that lemlist's API does not address.

The pairing with an outreach API is direct: use ZoomInfo's search to find contacts matching your ICP (free, no credits consumed), enrich the ones worth pursuing, then push them into lemlist campaigns via the leads endpoint. ZoomInfo decides who belongs in the campaign; lemlist runs the campaign.

Authentication, Rate Limits & Credits

ZoomInfo uses OAuth 2.0 with PKCE via Okta, supporting three flows: Authorization Code with PKCE (web applications), Client Credentials (server-to-server), and Refresh Token.

Access tokens are 24-hour Bearer tokens with rotating refresh tokens. Applications are registered through the ZoomInfo Developer Portal.

This is a different model from lemlist's static API key. OAuth 2.0 supports delegated access, credential rotation, and scoped permissions, making it suited for multi-tenant integrations and enterprise security requirements.

Rate limits are published by tier: Builder (5 req/sec), Standard (25 req/sec), and Scaling (35 req/sec), with per-hour and per-day sliding-window limits enforced simultaneously. Every response includes quota headers, and 429 responses include a Retry-After header with exact backoff timing. At the Standard tier, ZoomInfo's throughput ceiling (25 req/sec) is 2.5x lemlist's effective rate (10 req/sec).

Source: ZoomInfo

Credits follow a rolling 12-month window: a record enriched for the first time consumes one credit; re-enriching the same record within the year is free. Search and lookup operations do not consume credits.

MCP Server, Webhooks & Developer Experience

For developers building AI agents, ZoomInfo's MCP server at https://mcp.zoominfo.com/mcp exposes search, enrich, and account research as native tools for MCP-compatible assistants, currently supporting Claude and ChatGPT. Like lemlist's MCP server, it uses OAuth 2.0 authentication.

Source: ZoomInfo

Webhooks are available via the Agents API, tied to ZoomInfo's Agent Teams system. Event types cover bulk enrichment jobs completing, records changing, credit usage crossing thresholds, and new GTM signals (scoops, funding events, intent spikes) becoming available, with retry behavior and throttling configurable per event type.

ZoomInfo does not publish official SDKs either, so both platforms require direct HTTP integration. Documentation lives at docs.zoominfo.com with an interactive API reference, OAuth recipes in five languages, and an llms.txt index for AI development tools. ZoomInfo has added API access to all relevant plans; pricing follows a consumption-based model.

BDO Canada reported an 87% reduction in time spent updating internal data dashboards using the ZoomInfo API, with one analyst describing the integration as plug-and-play across any process. (ZoomInfo)

Final Verdict

lemlist's API is a well-scoped outreach automation surface that covers the multichannel campaign lifecycle (from lead enrollment to reply handling) with webhook support across five channels and pay-per-success enrichment on a 650M+ contact database.

API access on every paid plan and an MCP server for AI-agent workflows make it accessible without an enterprise commitment. Its limits are limits of scope: it automates outreach execution well, and it stops where data intelligence begins.

Choose the lemlist API if your build is outreach-first: automating campaign creation, lead enrollment, multichannel sequences, email account management, warm-up monitoring, and reply handling. The $39/month entry point with API access included, combined with webhook coverage across email, LinkedIn, WhatsApp, SMS, and calls, makes it a practical surface for pipeline automation.

Choose the ZoomInfo API when the build needs the intelligence layer upstream of outreach: deciding which accounts are worth pursuing, which contacts to reach, what their companies look like, whether they are in-market, and where they sit in the org chart.

The search-then-enrich pattern (search is free, enrich consumes credits) and the AI intelligence endpoints cover the data and reasoning that outreach APIs do not.

Explore the ZoomInfo Enterprise API or start with the developer docs to see the endpoint surface directly.

A developer whose primary need is B2B data intelligence without outreach automation has no reason to build on lemlist's API; that build starts with ZoomInfo.

FAQ

Is the lemlist API free?

Not beyond a trial. The 14-day free trial provides full Multichannel plan access including the API, with no credit card required. After the trial, API access requires a paid plan starting at $39/month for the Email tier. There are no per-call API charges, but enrichment operations consume credits at $0.05 per verified email and $0.20 per phone number, purchased in prepaid packs starting at $10 for 1,000 credits.

Does lemlist have a GraphQL API?

No. lemlist exposes a REST API (currently at v2) that communicates over HTTPS with JSON request and response bodies. There is no GraphQL endpoint. If you need a GraphQL interface, you would need to build a wrapper layer on top of the REST API.

What is the lemlist API rate limit?

The published limit is 20 requests per 2-second window, enforced per API key across all routes. That translates to an effective ceiling of 10 requests per second. Every response includes rate-limit headers showing remaining capacity and reset timing. There is no tiered rate limit by plan, and no documented way to request higher limits.

Are there official lemlist SDKs?

No. lemlist does not publish official SDKs in any language. The developer documentation includes cURL examples for every endpoint, and the MCP server wraps the API in a natural-language interface for AI assistants, but there are no maintained SDK packages or GitHub repositories. Developers integrate directly over HTTP using the Base64-encoded Basic auth header.

Does the lemlist API support webhooks?

Yes. lemlist has a webhook system managed through the API. Webhooks are created, deleted, and listed via dedicated endpoints.

The event catalogue covers email events (sent, opened, clicked, replied, bounced), LinkedIn events (25+ types covering messages, invites, voice notes, and profile interactions), WhatsApp and SMS events, call events (including recording and transcript readiness), enrichment completion, intent signal detection, and workspace-level operational alerts.

An optional secret field provides payload verification. The public documentation does not describe retry policy or delivery guarantees.

Can I use the lemlist and ZoomInfo APIs together?

Yes, and there is a practical pattern for doing so. ZoomInfo's search endpoints let you find contacts and companies matching your ICP without consuming credits. Enrich the ones worth pursuing with B2B intelligence (org charts, technographics, intent signals, employment history), then push verified, enriched contacts into lemlist campaigns via the leads endpoint.

ZoomInfo decides who belongs in the campaign; lemlist runs the campaign. The two APIs use different authentication models (HTTP Basic vs. OAuth 2.0), different rate-limit structures (10 req/sec flat vs. 5-35 req/sec tiered), and different credit systems, so plan your integration layer to handle both.

Both platforms also offer MCP servers for AI-agent workflows, which means an AI agent can search ZoomInfo for prospects and enroll them in lemlist sequences from a single conversation.