API cannot bypass safety rails

The API is not a back door. Writes go through the same recording and enrolment rules as the screens. There is no API that sends a reminder. Kill switch, Firm/Final approval, first-run review, demo refusal, opt-out, and stop-on-payment still apply. You remain the creditor.

Before you start

Anyone building against the REST API, on every plan. If you need to stop leaving immediately, an Admin uses Halt all sending on Settings → Reminder defaults — see Stop all automated sending.

What the API will not do

1. It cannot send a chase message. GET /api/v1/messages is read-only. There is no POST /api/v1/messages. Firm and Final still wait for a human in the approval path the engine already enforces. Wording that needs extra confirm still needs that confirm.
2. It cannot ignore the kill switch. Halt all sending stops automated leaving. The API cannot queue a send around it. First-run review, while it is still on, also blocks delivery.
3. It cannot deliver demo-book outreach. The send worker refuses demo rows at the final delivery gate. Creating or updating records through the API does not lift that refusal.
4. It cannot keep a chase live past a stop. Recording a payment goes through the same payment recorder as the UI, so the invoice settles and chasing stops. New invoices enrol through the same rules, including never-chase and the minimum-chase floor. You cannot set chase state yourself on create. A reply, dispute, or promise still stops or holds the chase the same way as in the product.
5. It cannot skip the sent log. Outbound messages that do leave still land in Activity.

Practical checks

• A key without write scopes cannot record money or create customers or invoices. A key cannot “force” a send — there is no send scope.
• A payment recorded through the API is treated as money you learned about elsewhere, not as a proven PayBlah payment-link payment. Do not report it as caused by PayBlah.
• Rate limits (600 requests per hour per key by default) cap load. They are not a plan privilege that weakens these rails.
• Acceptable use still applies: B2B invoices you are owed — not harassment, not consumer debt collection.

Expected result

Integrations read and write account data. Reminders still leave only through the product’s own send path, with the same holds and human approvals as a person using the screens.

If an integration seems to skip a rail

Treat it as a defect. If anything is leaving that should not, press Halt all sending, Revoke the key, and tell Support. Do not build a workaround. PayBlah is accounts-receivable automation, not a collection agency.