# Reqbeat > Hiring-demand signals as an API. Reqbeat reads public job-posting activity and returns it as structured hiring-intent signals: which companies are hiring, for which roles, in which markets, and what changed since you last looked. Every data call needs a Reqbeat API key. Sign up free at https://app.reqbeat.com/register (no card), then send the key as the X-API-Key header, or connect the MCP server with it. ## Calling Reqbeat - [Reqbeat](https://reqbeat.com/): What it is, what it costs, and the way in. Self-serve; no sales call - [Quickstart](https://reqbeat.com/docs): Get a key, make a first call with curl, connect an MCP client - [Webhook docs](https://reqbeat.com/docs/webhooks): Register a watch and get job-posting events pushed — the four event types (opened, reobserved, reposted, closed), signed deliveries, dedup semantics and per-plan limits - [MCP endpoint](https://mcp.reqbeat.com/mcp): Model Context Protocol server over streamable HTTP, authenticated with the X-API-Key header. Enumerate the tools from the server itself - [MCP tool docs](https://reqbeat.com/mcp/): One page per tool — its description, input schema and a copy-paste client config - [MCP server.json](https://mcp.reqbeat.com/server.json): The registry manifest — server name, version, remote type and the transport an installer needs - [API reference](https://api.reqbeat.com/docs): Every route, rendered from the OpenAPI spec - [OpenAPI spec](https://docs.reqbeat.com/openapi.json): The machine-readable contract - [Pricing](https://reqbeat.com/pricing): Plans, what each includes, spend caps, rate limits and the metered rate, for a human reader - [Pricing (JSON)](https://reqbeat.com/.well-known/pricing.json): The billing system's own price list as JSON — tiers, included allowances, spend caps, rate limits and the metered rate - [API directory manifest](https://reqbeat.com/apis.json): The APIs.json 0.23 manifest — the contract, the MCP server, the price, the terms and the status page - [API base](https://api.reqbeat.com/v1/): Every data call goes here and requires an API key, sent as an X-API-Key header or as Authorization: Bearer. See Authentication below - [Dashboard](https://app.reqbeat.com): Self-serve signup, API keys, usage and billing. No sales call - [Status](https://status.reqbeat.com/status): How current the corpus is right now - [Method](https://reqbeat.com/method): The sample definition, the deduplication rule and the pre-registered metric definitions - [Data ethics](https://reqbeat.com/data-ethics): What is collected, what is not, and on whose behalf - [Crawler and opt-out](https://reqbeat.com/crawler): The user-agent token every fetch we make as ourselves carries, and how a site asks to be excluded - [FAQ](https://reqbeat.com/faq): Short answers on data, billing, limits and integrations - [Recipes](https://reqbeat.com/recipes/): Copy-paste flows for Clay, n8n and MCP agents - [Guides](https://reqbeat.com/guides/): Longer reads on hiring signals and job posting data, including how to get a webhook when a company posts a job - [Compare](https://reqbeat.com/compare/): Honest comparisons with competitor claims sourced from their own sites — Reqbeat vs TheirStack, alternatives to TheirStack, Mantiks and PredictLeads, and the best hiring signals APIs in 2026 - [Blog](https://reqbeat.com/blog/): Team posts, including the best job posting APIs in 2026 and a comparison of real-time job posting webhook APIs - [Privacy](https://reqbeat.com/privacy) - [Terms](https://reqbeat.com/terms) ## Endpoints - `GET https://api.reqbeat.com/v1/reqs/search`: Discovery. Which companies are hiring for a role in a market, grouped by company with each one's matching reqs - `POST https://api.reqbeat.com/v1/reqs/qualified`: Multi-country ICP pull. One call takes a criteria body that can span several countries and returns one row per req, each carrying the company name, the posting URL, seniority, skills and salary Both require an X-API-Key header. ## Authentication Send the API key as an X-API-Key header or as Authorization: Bearer . Full guide: https://reqbeat.com/docs/authentication - No key: 401. - Invalid or revoked key: 403 {"detail": "Invalid or revoked API key"}. - Valid key without the endpoint's scope: 403 {"detail": {"reason": "scope_required", "required_scope": "", "endpoint": ""}}. Every key carries a list of scopes, from four values: - read: every data read: companies/{id}/*, reqs/search, reqs/qualified, jobs/search, jobs/role, markets/role-demand, companies/resolve, events, attribution, clay/enrich - write: POST companies/{id}/outcomes and POST migration-import - webhooks: POST webhooks, watches (create, list, delete) and webhook-deliveries (list, detail, replay) - account: key management (list, mint, revoke, rotate) and account/pause, account/resume - No scope needed: whoami, quickstart, onboarding, usage, pricing. whoami answers for any valid key, so it is the connection test. A signup key carries all four. Minting or rotating through /v1/keys can only narrow a key's scopes: asking for more than the presenting key holds is a 403 naming the extra scopes, and an unknown value is a 422 listing the four. Leave scopes out and a mint copies the presenting key's scopes, while a rotation keeps the replaced key's. The OpenAPI spec names each operation's scope as x-required-scope. Keys pasted into Zapier, Make, n8n or any other automation tool should carry read and webhooks only: mint one for the connector rather than sharing the signup key. ## Rate limits Each API key has one request budget per fixed 60-second window. The window opens on the key's first request and resets 60 seconds later; it does not slide. REST calls and MCP tool calls made with the same key draw on the same budget, and a request that answers 404 counts like any other. - Free: 20 requests per 60 seconds - Trial: 100 requests per 60 seconds - Starter: 500 requests per 60 seconds - Growth: 2,000 requests per 60 seconds Every response from a rate-limited route, refused or not, carries three headers: RateLimit-Limit (the budget for the window), RateLimit-Remaining (requests left in it) and RateLimit-Reset (seconds until it resets). Past the budget the API answers 429 with a Retry-After header — whole seconds, the same number as RateLimit-Reset — and the body {"detail": {"reason": "rate_limited", "endpoint": ""}}. Wait Retry-After seconds, then send the request again. A 429 whose reason is key_throttled is a different refusal: the key is held by an abuse throttle rather than by the window, and it sends no Retry-After because there is no scheduled end to wait for. rate_limited is also the name of a watch delivery status, and it means something else there: the watch fired more often than its own max_fires_per_hour and the extra deliveries were dropped. That is a setting on the watch, not your request rate, and it never arrives as an HTTP 429. ## Reqbeat elsewhere - [LinkedIn](https://www.linkedin.com/company/reqbeat/) - [GitHub](https://github.com/reqbeat) - [Apify](https://apify.com/reqbeat) ## No person or contact data Reqbeat returns companies and roles, never people: no names, email addresses, phone numbers or profile links for anyone at the hiring company. That is by design, not a gap to be filled later. To reach someone, pair Reqbeat with the people or enrichment provider you already use, keyed on the company. 1. Register a watch with a webhook endpoint. Each delivery names its event type — opened, reobserved, reposted or closed — and the company it fired for, by company_id. 2. Receive it in the tool you already run — an n8n Webhook trigger, a Clay webhook table, or your own handler — and verify its signature before acting on it. 3. Call GET /api/v1/companies/{company_id}/enrichment for the company's domain, then pass that domain to your people provider to find the contacts you want.