---
title: "The envelope, errors, limits, auth and versioning"
description: "Every call carries four headers, and every response is a card, a task or an error. This page describes the headers, the card and its foot, the error shape, the task for a long step, keys and grants, and the contract's version."
section: reference
address: /reference/envelope
contract: 0476e35e6e275db5
---

# The envelope, errors, limits, auth and versioning

Every call carries four headers, and every response is a card, a task or an error. This page describes the headers, the card and its foot, the error shape, the task for a long step, keys and grants, and the contract's version.

[figure: Every call carries the same envelope, and every response carries the contract's hash.]

## Headers


| header | required | meaning |
|---|---|---|
| `Scale-Scope` | yes | the scope the call runs in: tenant/<id>, then /brand/<id>, then /strategy/<id> |
| `Scale-As-True-On` | no | the date the facts must have been true on; defaults to now |
| `Scale-As-Known-On` | no | the date the facts must have been known on; defaults to now |
| `Scale-Key` | no | for a change, the key made from the input; a repeat under the same key returns the unit held and writes nothing |



## Card
Every successful response is a card. The card's body is the type that the route specifies. The card's foot states the basis of every number, the scope of the call and the two dates. The basis is one of four: the platform observed the number, a source stated it, a rule derived it, or the platform estimated it with an interval. The platform cannot build a card without its foot.

## Errors
Every failure returns the same error shape. The error carries a reason that a person can read, the kind of rejection, and the identifier of the rejected object. A reached limit, a disallowed scope, an invalid body and an object that is not ready each have their own kind.

## Limits and pages
Every list returns its items in pages, under a bound that the plan sets. Each page carries the cursor of the next page. The API gateway sets the rate limit for each key.

## Authentication and entitlement
You make a key in the platform's settings. A key carries grants from this set: read, ask, act, work, files and admin. Every route states the grant that it needs and the rung of scope that it runs at. The platform checks the plan's lead limit at delivery and not at acquisition. The platform counts and shows every lead that the plan withholds.

## Versioning
Every route starts with `/v1/`. Every response carries the contract's hash in the `Scale-Contract` header. This site is built from contract 0476e35e6e275db5cc06c238bc65f93c6070e2723b94b2b8dd78a66ec5306c3a, fixed on 2026-09-30. `POST /v1/contract` returns the served description of the contract.