REST API

120+ LinkedIn actions.
One REST API.

Curviate is a documented, API-first HTTPS interface for LinkedIn: Classic plus 30+ dedicated Sales Navigator and Recruiter actions, all behind one Bearer token. A headless, agent-native app: OpenAPI 3.1 described, structured errors on every call, webhooks for what happens in between. Per-seat pricing, no partner program, no procurement.

120+ LinkedIn actions30+ Sales Nav + Recruiter20+ webhook event typesEU data residency
Intent-named operations
POST search peopleGET retrieve profilePOST send messagePOST send InMailGET list chats
POST send connection requestPOST accept inviteDELETE withdraw inviteGET list notifications
POST create postPOST comment on postPOST react to postGET list company followers
POST save lead · Sales NavigatorPOST save candidate to pipeline · RecruiterPOST publish job posting
01QUICK START

How do I authenticate?

One API key authenticates everything. Sign up, connect a LinkedIn account in the dashboard (credentials or cookie; both encrypted at rest and never logged), and copy the key from the dashboard topbar. Send it as a Bearer token. Account-scoped calls carry the acc_... account ID in the path, so one key can act across every account you connect.

GET · a member profile, by public slug
# A member profile, by public slug (the part after linkedin.com/in/)
curl "https://api.curviate.com/v1/acc_YOUR_ACCOUNT_ID/users/a-public-slug" \
  -H "Authorization: Bearer cvt_live_YOUR_KEY"
POST · send a message into an existing chat thread
# Send a message into an existing chat thread
curl -X POST "https://api.curviate.com/v1/acc_YOUR_ACCOUNT_ID/chats/chat_YOUR_CHAT_ID/messages" \
  -H "Authorization: Bearer cvt_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "Following up on your message."}'

Full walkthrough in the docs: authentication and accounts.

No key yet? An account is the one prerequisite for authentication: creating it takes about a minute and hands you a live key straight away.

02THE SURFACE

What can you do with it?

The API exposes 120+ LinkedIn actions as intent-named REST operations. Search people, companies, posts and jobs. Read and send messages, voice notes and InMail. Send, accept and withdraw connection requests. Publish posts, comment, react. Read profiles, company pages and notifications. Operate Sales Navigator lead lists and Recruiter hiring projects, with 30+ actions dedicated to those two premium surfaces; Recruiter alone is the deepest group in the surface at 23 actions.

recruiterHiring projects, pipelines, Recruiter search, job postings, applicants23 actions
messagingChats, messages, attachments, reactions, inboxes, InMail15 actions
companiesCompany profiles, page inbox, followers, employees, follow invites13 actions
postsPublish, retrieve, react, save; per-user post and reaction lists12 actions
sales-navigatorLead and account lists, saved searches, SN profiles and messaging12 actions
usersProfiles, connections, analytics, SSI, endorsements, InMail credits10 actions
jobsPost, edit, publish and close jobs; applicants and résumés10 actions
commentsComment, reply, react, moderate across posts9 actions
searchPeople, companies, posts, jobs, groups, services; filter resolution9 actions
invitesSend, accept, decline and withdraw connection requests6 actions
moreFollowing, groups, notifications and the home feed11 actions

This surface backs real work: lead generation and outreach in Sales Navigator, candidate sourcing and pipeline automation in Recruiter, inbox and CRM sync, content publishing and agent-driven prospecting. See the patterns on the use cases page.

Every action, on one page, honestly labelled: the LinkedIn actions catalogue. Every parameter and response shape is documented in the interactive API reference.

03MACHINE CALLERS

What makes this API agent-native?

We design for agent experience (AX) the way good products design for UX. Picture an AI operating a LinkedIn account with no human in the loop: it cannot squint at a screenshot or guess what a bare 400 meant. So every response is built to be parsed, not read. Errors carry a stable machine code plus fields that tell the caller whether retrying makes sense. Rate-limit state rides on standard RateLimit headers with every response (the quota, what remains, when it resets), and a 429 adds retry_after_ms plus a machine-readable retry hint, so the agent backs off precisely instead of hammering. Operations are intent-named, so a tool-calling model picks the right one from the name alone, without a human mapping RPC verbs to intentions.

On every callYou get
Structured errorsstable code, human message, retry guidance a program can branch on
Rate-limit feedbackstandard RateLimit headers (limit, remaining, reset) on every response; 429s add retry_after_ms and a retry hint
Intent-named operationsone operation per user intention, no RPC soup
Event webhooks20+ HMAC-signed event types pushed to your endpoint, instead of polling. Every event type

And for the agents reading this page: the full surface is machine-described. The OpenAPI 3.1 document lives at a stable well-known URL, and we publish AGENTS.md and llms.txt so an agent can load the operating contract in plain text before it makes a single call. AX is not an afterthought here. It is the design brief.

04WHERE IT FITS

Where the API fits

There are two honest ways to drive LinkedIn programmatically: a documented, versioned contract, or a bot clicking through a UI that changes underneath it. This is the difference.

Curviate APIBrowser automation tools
Getting accessSign up, pay per seat, call in minutesInstall an extension
Sales Navigator and RecruiterAvailable: 30+ dedicated actionsFragile screen-driving
ContractOpenAPI 3.1, structured errors, versioned surfaceNone; DOM changes break flows
Webhooks20+ event types, HMAC-signedNone
Company & Page accounts13 actions: page inbox, followers, employees, follow invitesFragile per-page scripting

The surface is available as the typed TypeScript client, the command line, and the MCP server, all on one API key.

05FAQ

Questions, answered

Yes. Curviate gives you a documented REST API over a LinkedIn account you own, on per-seat pricing, with no partner application and no procurement. You sign up, connect the account, and authenticate with one Bearer token. The official LinkedIn API remains the sanctioned enterprise path; Curviate is the accessible one.

COMPANY · LEGAL

Privacy Policy

Redmer Holding GmbHLast updated July 25, 2026

Who we are

Curviate is operated by Redmer Holding GmbH ("Curviate", "we", "us"), a German GmbH registered at Amtsgericht Bonn, HRB 29957, registered address Hostertstraße 16, 53332 Bornheim, Germany. Full company details are on our Imprint. We haven't appointed a statutory Data Protection Officer, since our processing doesn't reach the scale or sensitivity that requires one. Privacy questions go to privacy@curviate.com.

The two roles we play

When you create an account and use Curviate, we process your own data (identity, billing, API keys, connector authorizations). For that data, we are the controller.

When you use Curviate to act on your own connected LinkedIn account, viewing profiles, sending messages, managing engagement, that content and those contacts belong to that account and its people. You are the controller of that data; we are the processor, acting only on your instructions, under the Data Processing Agreement between us. If one of your contacts has a question about being reached through Curviate, you're who they should contact first; email privacy@curviate.com if you need help routing it.

What we collect, and why

DataWhy
Account identity (name, email, sign-in method)Create and secure your account
Your LinkedIn credentialsOperate the actions you request
LinkedIn content returned by an API callFulfil that specific request, nothing more
API keys and connector (OAuth) authorizationsAuthenticate your API, CLI, MCP, or SDK requests
Billing detailsCharge you correctly and meet our tax obligations
Usage and security logsKeep the service reliable and abuse-free
Support messagesRespond to you
Website analytics, only if you opt inUnderstand how the site is used

We rely on our contract with you, our legitimate interest in running and securing the service, our legal obligations (tax law, for example), and, for analytics, your consent. We never sell your data or use it to train models.

Where it's processed, and who else touches it

Our infrastructure runs in the EU. Hosting: Railway. Database and auth: Supabase, Ireland. Email: Resend. Payments: Stripe. Network security: a DDoS-protection provider sits in front of our app and never sees or stores request content. LinkedIn connectivity: a third-party infrastructure provider that lets us execute LinkedIn actions on your behalf. Error tracking: Sentry, Frankfurt. Product analytics: PostHog, Frankfurt. Uptime monitoring: Better Stack.

We give the current, named list of every provider above, plus our Data Processing Agreement, to any customer who asks: security@curviate.com.

Outside the EU

All customer LinkedIn data, account data, and telemetry are processed and stored exclusively in EU regions of our sub-processors. A few providers we rely on (Stripe and Sentry, for example) are headquartered outside the EU/EEA; where that applies, it's covered by their own GDPR safeguards, typically the EU Standard Contractual Clauses.

How long we keep it

DataRetention
Account and workspace dataWhile your account is active
Closed accountRecoverable for 7 days, then deleted on day 8
LinkedIn credentialsUntil you disconnect that account
LinkedIn contentNot stored; any transient cache clears within 1 hour, never indexed, never used for training
API keysUntil you revoke or rotate them
Connector (OAuth) authorizationsAccess token ~1 hour; refresh token up to ~12 months, or until you revoke it, whichever comes first
Billing recordsAs required by German tax law, currently up to 10 years
LogsA short operational window; metadata only, never message content

The 12-month figure above is a server-side credential for a connected AI agent or app. It is not a cookie and doesn't touch your browser session; see Cookies below for that. You can see and revoke every connector from Authorized applications in your dashboard at any time.

Cookies

We keep cookies to a minimum, and ask before anything beyond the essentials runs.

Strictly necessary, no consent needed:

NamePurposeExpiry
cc_cookieRemembers your cookie choice12 months
curviate-themeRemembers light/dark mode (local storage, not a cookie)Persistent
sb-*-auth-tokenKeeps you signed inWhile active; cleared on sign-out

Analytics, only if you accept:

NamePurposeExpiry
_gaGoogle Analytics: distinguishes visitors2 years
_gidGoogle Analytics: distinguishes visitors24 hours
_ga_<container id>Google Analytics: persists session state2 years

No advertising cookies, ever. Accept and reject are equally easy, and you can change your mind any time via Cookie Preferences in the footer; we won't ask again for 12 months unless something material changes. Our LinkedIn connect flow and OAuth authorization screen never set anything beyond the essentials, so no banner appears there.

Connecting an AI agent or app

Curviate is built for AI agents and automated clients as much as for people. If you connect an app like Claude, or your own code, via an API key or an OAuth connector, it can act on your workspace within the access you gave it. What it does with anything it receives back, including what it sends to its own AI model, is between you and that provider; review its practices before connecting it. Review and revoke any connection any time from your dashboard.

Your rights

You can access, correct, delete, restrict, or object to your data, port it elsewhere, and withdraw consent at any time: email privacy@curviate.com. Closing your account starts the 7-day recoverable window above. We don't make automated decisions about you that have a legal or similarly significant effect. You can also complain to a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de, though you're free to complain to the one in your own country instead.

Keeping it secure

Credentials are encrypted and never logged, returned, or shared. LinkedIn actions run through native, humanized flows; full detail is on our Security & Compliance page. If a breach puts your rights at risk, we'll notify the authorities and you, as GDPR requires. Curviate isn't directed at, or offered to, anyone under 16.

Changes

We'll update this page when our practices change, and reset the cookie prompt if the change is material.

Contact