Opening the API on every plan only works if it cannot become a compliance bypass. That is a product rule, not a marketing line.
Rules the API still obeys
- Stop on payment, reply, dispute, and promise — you cannot keep a chase live through the API when those fires have tripped.
- Opt-out / never-chase registers still suppress contact.
- Firm and Final (and threat-list wording) still need the human approval path the engine enforces.
- Outbound messages still land in the audit / sent log.
- Kill switch and first-run review still block automated leaving when engaged.
- Acceptable use still applies to volume and purpose (B2B invoices you are owed — not harassment, not consumer debt collection theater).
Practical implications
- Recording a payment through the API should stop chasing the same way a sync or manual payment does.
- A key without write scopes cannot "force" a send.
- Rate limits protect the platform from unbounded load on small plans.
If an integration seems to skip a rail, treat it as a defect — log it with support rather than building around it.