CapableDocs

Search the API docs

Find an endpoint or guide

Get an API key

Get startedErrors, limits and conventions

Get started

Errors, limits and conventions

Status codes tell you what went wrong, and the message tells you how to fix it. The same rules for dates, money and lists apply to every endpoint.

Error shape

Every error response has the same body: one object with a message written for the person reading your logs.

422 Unprocessable
{
  "error": {
    "message": "name: Too small: expected string to have >=1 characters"
  }
}

Status codes

StatusMeaningWhat to do
200OKThe request worked.
201CreatedA stakeholder or security was created. The body has its id.
400Bad requestA POST body was not valid JSON.
401UnauthorizedThe API key is missing, mistyped or revoked, or its creator has left the company or lost write access. The message says which.
402Payment requiredThe company has no active plan in good standing. The message gives the reason; an owner can fix it on the Billing page.
403ForbiddenThe key does not have the scope this endpoint needs. The message names the scope.
404Not foundNo record with that id belongs to the key's company, or the path is not an endpoint.
405Method not allowedThe API accepts GET and POST only.
422UnprocessableA field is missing or invalid. The message lists each field and what is wrong.
429Too many requestsThe key or your IP went over its rate limit. Wait for the Retry-After header's seconds, then retry.

Rate limits

Each API key can make 600 requests a minute, and at most 100 in any 10-second window. Each IP address can make 1,200 requests a minute across all keys. Reads and writes count the same.

HeaderMeaning
X-RateLimit-LimitRequests allowed per minute for this key: 600.
X-RateLimit-RemainingRequests left in the current minute.
X-RateLimit-ResetSeconds until the current minute's count resets.
Retry-AfterSent with a 429: seconds to wait before retrying.

Over the limit, the API answers 429 and does nothing. Wait for Retry-After seconds and send the request again. Write to support@capable.so before a large backfill if you need a higher limit.

Conventions

  • Requests and responses are JSON. Send Content-Type: application/json with a POST body.
  • Dates are YYYY-MM-DD, such as 2026-11-17. Timestamps such as createdAt are ISO 8601 in UTC.
  • Money is a number in US dollars, such as 0.42 for an exercise price. For a SAFE or a convertible note, quantity is the principal in dollars.
  • Percentages are numbers from 0 to 100, such as 20 for a 20% discount.
  • Ids are opaque strings. Store them as given and do not parse them.
  • Lists return every record in one response under data. There is no pagination.
  • Fields with no value are null, never left out.
  • Vesting and outstanding amounts are computed for today, unless the endpoint takes an asOf date.