Lookup tables

The facts you look up mid-integration: headers, versions, limits, identifiers, and where each canonical table lives.

One page for the facts you need mid-integration. Where a canonical table already exists elsewhere, this page links it rather than restating it. The linked section is the source of truth.

Request headers

Header	Required	Rule
Authorization: Bearer <api-key>	Always	Server-side only; missing/revoked → 401 auth.invalid_key
Checkfu-Version: 2026-08-27	Always	Dated wire contract; missing/unsupported → 400 validation.malformed
Idempotency-Key	Mutating POSTs (where the contract allows it)	Same key + same body replays the first result; same key + different body conflicts. Semantics: HTTP overview
Content-Type: application/json	Requests with a body
Last-Event-ID	SSE reconnect	Resume a dropped stream: Resume a stream

Wire versions

Only 2026-08-27 is currently supported. D257 authorizes pre-launch hard cuts backed by fresh storage; the policy lives in Authentication and versions.

Throttling and refusals

Checkfu does not publish anonymous rate-limit numbers; work is refused by named gates, each with a typed error you can dispatch on:

Refusal	Error	What to do
A limit you configured (Budget, quota, or API-key rate limit)	429 budget.exceeded	Clears only when the limit does. Back off substantially or raise the limit; surface “limit reached” to end users without distinguishing which limit
Organization entitlement exhausted	402 billing.usage_limit_reached	An Organization administrator raises the plan or adds credits
Account not in good standing	402 billing.payment_required	An Organization administrator fixes billing
Platform-supplied model capacity exhausted	503 model.platform_capacity_reached	Retry later, or bring your own provider key

Whether an error is worth retrying is a per-error property. The error registry has a retry-safety column for the whole catalog. A 429 in particular clears only when its underlying limit does, so immediate retries buy nothing.

Request and payload limits

Every ceiling below is enforced before the work happens, and each one has a typed refusal. A byte limit crossed while the body streams in is 413 validation.payload_too_large; a count or size the schema rejects after the body arrives is 400 validation.malformed.

Payload	Ceiling	On breach
Any /v1 request body with a method other than GET or HEAD, unless a row below overrides it	4 MiB	413 validation.payload_too_large
POST /v1/files upload	64 MiB of file content; the multipart envelope allows a further 64 KiB for part framing	413 validation.payload_too_large
The JSON body of a Project tree route (POST /v1/projects, …/revisions, …/push)	A computed envelope over the tree budget in the next two rows (base64 expansion plus per-file path and structure) rather than the 4 MiB default	413 validation.payload_too_large
An uploaded Project revision	1,024 files, 10 MiB per decoded file, 20 MiB per decoded revision	400 validation.malformed
A Git push manifest (POST /v1/projects/{id}/push)	64 files; the per-file and per-revision byte budget is unchanged	400 validation.malformed
An Agent directory archive (application/x-tar)	2 MiB per archive, 1 MiB per file, 256 files	400 validation.malformed
A Skill (POST /v1/skills, POST /v1/skills/import)	1 MiB of instructions, 256 files, 1 MiB per file, 2 MiB across files; an imported tar archive is additionally capped at 4 MiB	400 validation.malformed
An Automation webhook delivery body (POST /v1/ingest/automations/{id})	1 MiB	413 validation.payload_too_large
That delivery’s JSON structure, checked after the signature verifies	64 levels of nesting, 100,000 nodes	400 validation.malformed
An Automation prompt, both as authored and after {{event}} expands	64 KiB encoded as UTF-8	400 validation.malformed
A MemoryStore document body	100 kB	400 validation.malformed

Canonical tables and where they live

You need	Go to
Every error, with retry safety	Errors
Session statuses and every legal transition	Sessions reference
The complete event catalog and envelope	Events
The freeze rule (what changes when)	Two freeze horizons
PermissionAssignment/ActionPolicy decision algorithm	Tenancy and governance
Pagination and streaming conventions	HTTP overview
Identifier prefixes (wrkspc_, agent_, sess_, …)	HTTP overview → Identifiers