Upwork API

The API is the one route Upwork names when someone wants to automate part of their work. Its automation article says compliant automation is possible "through an approved API key request", and treats scripts, extensions and outside services that act on the website as bots. Access starts with an Upwork API key, which Upwork grants for personal or internal use; commercial use is reserved for select partners with prior written permission.

Limits. Upwork's limits article sets the ceiling at 10 requests per second per IP address, enforced per IP rather than per user or application. Going over returns an HTTP 429 error. Caching API responses for more than 24 hours is not allowed under the Terms of Service.

What a key does not permit. Upwork lists patterns that get a keyholder flagged anyway: using browser session tokens or cookies in a script, calling website pages instead of approved endpoints, mixing an API key with exported browser credentials, background polling that resembles scraping, and sharing keys across users without authorization. Even with a key, spamming proposals or invites and scraping data remain off-limits.

What it covers. Upwork does not publish a plain-language list of what the schema exposes. Probing a live agency key, Upsight found proposal lists with view status and cover letters, Connects history, contracts, message rooms for the signed-in user, and a mutation that submits a proposal. Each field is subject to the key's scopes, and a refused field is not the same as an empty one.

How Upsight uses it. A workspace connects its own key, and a campaign whose submission method is API files its proposals through that key without opening a page on anyone's login. A connected key is used for that workspace's own proposals and never reads for another workspace.