The REST API, API clients, and webhooks — Call the API (2)

Conventions hold everywhere: JSON is camelCase in and out, timestamps are UTC ISO-8601 (their field names end in Utc), and record values are keyed by field key — the stable slug listed by GET /tables, with Relation values as arrays of record ids and People values as arrays of person ids. A People write names workspace members by person id or by email address and stores the id; a name, or anyone who isn't a member, is refused with a 400. Errors always use one envelope, { "error": { "code", "message", "details" } }, with a matching status: 400 validation (details names the fields), 401 a missing, invalid, or expired access token, 402 the workspace's trial has ended, 403 the token lacks the required scope, 404 not found in this workspace, and 429 rate limited. Each access token may make 300 requests per minute (a sliding window); over that returns 429 with a Retry-After header. The token-exchange endpoint has its own tighter per-IP limit — cache your access token for its lifetime instead of exchanging on every call.