Everything an AI agent can do with the Klaviyo API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints23
API version2026-04-15
Last updated23 June 2026
Orientation

How the Klaviyo API works.

The Klaviyo API is how an app or AI agent works with a Klaviyo account: reading and creating customer profiles, building lists and segments, tracking events, and sending email and text campaigns through flows. Access is granted through a private API key or an OAuth grant, and a set of scopes sets which areas a call can read or write, like profiles:read or campaigns:write. Klaviyo dates each version of its API, and a state change can be pushed to a registered endpoint as it happens.

23Endpoints
9Capability groups
12Read
11Write
14Permissions
Authentication
Klaviyo authenticates a call with either a private API key or OAuth 2.0. A private key is sent in an Authorization header as Klaviyo-API-Key followed by the key, and suits a single account's own backend. OAuth uses the standard authorization-code flow and suits an app acting for many accounts, so each account grants and can revoke access independently.
Permissions
Access is scoped by area and direction, like profiles:read, profiles:write, lists:write, campaigns:read, events:write, or segments:read. An OAuth app requests a space-separated list of scopes and the account owner approves them; a 403 response means the key or grant lacks the scope the request needs.
Versioning
Klaviyo versions by date. A request names a revision in the revision header, like 2026-04-15, and a revision is stable for one year, then deprecated for a year before it retires, a two-year lifespan. Omitting the header uses the account's default revision.
Data model
Klaviyo follows the JSON:API format. A request and response wrap data in a typed object with attributes and relationships, lists are cursor-paginated, and errors come back as an array of error objects. The core resources are profiles, lists, segments, events, metrics, campaigns, flows, and templates.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Klaviyo determines what it can reach. There is a route for making calls, a route for receiving events as they happen, and a hosted server that exposes Klaviyo tools to agents, and each is governed by the key or grant behind it and the scopes it carries.

Ways to connect

REST API

The REST API uses the JSON:API format, takes and returns typed JSON objects with attributes and relationships, and pages lists with a cursor, at https://a.klaviyo.com/api. A call authenticates with a private API key in an Authorization header or with an OAuth token, and names a dated version in the revision header. A separate client API at https://a.klaviyo.com/client supports public-key calls from a browser or mobile app.

Best forConnecting an app or AI agent to Klaviyo.
Governed byThe key or OAuth grant and the scopes it carries.
Docs ↗

Webhooks

Klaviyo POSTs events to an HTTPS endpoint registered through the Webhooks API and subscribed to topics, like an email being clicked or a text message being received. Events are batched, up to 1,000 per request, and Klaviyo sends up to 10 concurrent requests per account. Topics are gated by both the webhooks scope and the scope for the underlying data.

Best forReceiving Klaviyo events at an app or AI agent.
Governed byThe webhooks scope plus the scope for each subscribed topic.
Docs ↗

MCP server

A first-party Model Context Protocol server exposes Klaviyo tools to AI clients across profiles, campaigns, flows, lists, segments, events, metrics, and templates. It is generally available. A hosted remote server at https://mcp.klaviyo.com/mcp authenticates with OAuth and dynamic client registration; a local server, run with uvx klaviyo-mcp-server, authenticates with a private API key and its scopes.

Best forConnecting an AI agent to Klaviyo through MCP.
Governed byThe OAuth grant or the private key and the scopes it carries.
Docs ↗
Authentication

Private API key

A private API key calls the API for a single account that owns it. It is sent in an Authorization header as Klaviyo-API-Key followed by the key, and a key can be scoped to specific areas when it is created. A private key must never be exposed in client code.

TokenPrivate API key (pk_...)
Best forAn account's own backend integration.
Docs ↗

OAuth 2.0

OAuth uses the standard authorization-code flow. A tech partner's app requests a space-separated list of scopes, the account owner approves them, and the app exchanges the code for an access token tied to that account. Each account grants and revokes access on its own, so no long-lived key is shared.

TokenOAuth access token (with refresh token)
Best forAn app acting for many Klaviyo accounts.
Docs ↗

Public API key (client)

A public API key, the account's six-character site ID, is safe to use in a browser or mobile app. It is limited to the client endpoints, like creating an event or subscribing a profile, and cannot read account data.

TokenPublic key / site ID
Best forClient-side event and subscription calls.
Docs ↗
Capability map

What an AI agent can do in Klaviyo.

The Klaviyo API is split into areas an agent can act on, like profiles, lists, segments, events, campaigns, flows, metrics, and templates. Each area has its own methods and its own scope, and a write in some areas changes who is subscribed or sends marketing messages.

Endpoint reference

Every Klaviyo API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Profiles

Methods for reading and writing customer profiles.5

Read-only. Adding additional-fields[profile]=predictive_analytics lowers the tier to 10/s burst, 150/m steady.

Acts onprofile
Permission (capability)profiles:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Read-only.

Acts onprofile
Permission (capability)profiles:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Body limited to 100KB.

Acts onprofile
Permission (capability)profiles:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

A core write.

Acts onprofile
Permission (capability)profiles:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Upsert by identifier. Body limited to 100KB.

Acts onprofile
Permission (capability)profiles:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Lists

Methods for working with lists and their membership.3

Read-only.

Acts onlist
Permission (capability)lists:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

A core write.

Acts onlist
Permission (capability)lists:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Needs lists:write and profiles:write. Adds membership; does not change marketing consent on its own. Up to 1,000 profiles per request.

Acts onlist
Permission (capability)lists:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Segments

Methods for working with segments.2

Read-only.

Acts onsegment
Permission (capability)segments:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Read-only.

Acts onsegment
Permission (capability)segments:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Events

Methods for tracking and reading events.2

Read-only.

Acts onevent
Permission (capability)events:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit350/s burst, 3500/m steady (XL)

Can create or update profile properties as a side effect.

Acts onevent
Permission (capability)events:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit350/s burst, 3500/m steady (XL)

Campaigns

Methods for working with email, SMS, and push campaigns.3

Requires a filter such as equals(messages.channel,'email'), 'sms', or 'mobile_push'.

Acts oncampaign
Permission (capability)campaigns:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10/s burst, 150/m steady (M)

Creates the campaign; sending is a separate send-job call.

Acts oncampaign
Permission (capability)campaigns:write
VersionAvailable since the API’s base version
Webhook eventsent_sms
Rate limit10/s burst, 150/m steady (M)

Sends real marketing messages to the campaign's audience.

Acts oncampaign-send-job
Permission (capability)campaigns:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10/s burst, 150/m steady (M)

Flows

Methods for reading automated flows.2

Read-only.

Acts onflow
Permission (capability)flows:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit3/s burst, 60/m steady (S)

Read-only.

Acts onflow
Permission (capability)flows:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit3/s burst, 60/m steady (S)

Metrics & Reporting

Methods for reading metrics and aggregating event data.2

Read-only.

Acts onmetric
Permission (capability)metrics:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit10/s burst, 150/m steady (M)

A POST used to read aggregated data; no data is changed.

Acts onmetric-aggregate
Permission (capability)metrics:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit3/s burst, 60/m steady (S)

Templates

Methods for working with message templates.2

Read-only.

Acts ontemplate
Permission (capability)templates:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

A core write.

Acts ontemplate
Permission (capability)templates:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Subscriptions

Methods for subscribing and unsubscribing profiles to marketing.2

Also accepted with lists:write or profiles:write. Up to 1,000 profiles per request; records marketing consent.

Acts onprofile-subscription-bulk-create-job
Permission (capability)subscriptions:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)

Also accepted with lists:write or profiles:write. Up to 1,000 profiles per request; removes marketing consent.

Acts onprofile-subscription-bulk-delete-job
Permission (capability)subscriptions:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit75/s burst, 750/m steady (L)
No endpoints match those filters.
Webhooks

Webhook events.

Klaviyo can notify an app when something happens in an account, like an email being clicked or a text message being received. A webhook subscribes to a set of topics and Klaviyo POSTs batched events to the registered endpoint, so an integration learns about activity without polling.

EventWhat it signalsTriggered by
event:klaviyo.sent_smsA text message was sent to a profile. Subscribing to this topic also requires the scope for the underlying event data./api/campaigns
event:klaviyo.received_smsA text message was received from a profile, like an inbound reply. Subscribing to this topic also requires the scope for the underlying event data.In-app only
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Klaviyo limits how fast an app can call, with a per-second burst limit and a per-minute steady limit applied per account, and each method is placed in a rate-limit tier that sets both numbers.

Request rate

Klaviyo meters requests per account with two windows at once, a per-second burst limit and a per-minute steady limit, and returns HTTP 429 when either is crossed. Each method sits in a named tier that sets both numbers, from XS (1/s burst, 15/m steady) through S, M, L, and up to XL (350/s burst, 3500/m steady). Most read and write endpoints sit at L (75/s, 750/m); reporting and aggregate queries sit lower, and event creation sits at XL. A normal response carries RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset headers; a 429 replaces them with Retry-After, the seconds to wait before retrying. Per-method tiers are shown on each row.

Pagination

Lists are cursor-based. A response includes a links object with next and prev cursors, and page[cursor] fetches the following page while page[size] sets the page size. The maximum page size varies by endpoint, commonly 10, 50, or 100, and some endpoints fix it. Results are not offset-paginated, so a client follows the next cursor until it is absent.

Request size

Page size maximums vary per endpoint and are stated on each reference page. A profile create or update accepts a body up to 100KB. Bulk subscribe and unsubscribe jobs accept up to 1,000 profiles per request, and an outbound webhook batch can carry up to 1,000 events.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400invalid_requestThe request was malformed or missing required input, or the API key is missing or invalid.Read the error detail, fix the body, parameters, or Authorization header, and resend. The request is not retryable as-is.
401not_authenticatedAuthentication credentials were missing or could not be verified.Send a valid private API key or OAuth token in the Authorization header.
403not_authorizedThe credentials are valid but lack the scope this request needs, like calling a write endpoint with a read-only scope.Grant the missing scope on the key or re-authorize the OAuth app with the needed scope.
404not_foundThe requested resource does not exist or is not visible to these credentials.Verify the resource id and that it belongs to the authenticated account.
409conflictThe request conflicts with the current state of the resource, like a duplicate or a concurrent change.Re-fetch the resource, reconcile the change, and retry.
429throttledA burst or steady rate limit was exceeded for the account.Wait the number of seconds in the Retry-After header, then retry with backoff and a smoother request rate.
500server_errorAn error on Klaviyo's side. It is rare.Retry with backoff, and contact Klaviyo support if it persists.
Versioning & freshness

Version history.

Klaviyo versions its API by date. A request names a revision in a header, and a revision stays stable for a year before a year of deprecation, so an integration upgrades on a schedule rather than all at once.

Version history

What changed, and when

Latest version2026-04-15
2026-04-15Current version
Current stable revision

Klaviyo dates each revision and a request names one in the revision header. A revision is stable for a year, then deprecated for a year before it retires.

What changed
  • Geofencing API added for mobile SDK consumption.
  • Conversations API added for outbound SMS and WhatsApp messaging.
  • Templates API gained drag-and-drop support via editor_type SYSTEM_DRAGGABLE.
2026-01-15Feature update
January 2026 revision

A backward-compatible dated revision.

What changed
  • Single data-source record creation added for one-at-a-time ingestion, alongside existing bulk import.
2025-10-15Feature update
October 2025 revision

A backward-compatible dated revision.

What changed
  • Forms API and Flow Actions API launched for programmatic form and flow-action management.
  • Reporting gained text-message ROI, credit usage, and spend statistics.
2025-07-15Feature update
July 2025 revision

A backward-compatible dated revision.

What changed
  • Mapped Metrics API and Custom Objects API released for ingesting third-party data records.
2025-04-15Requires migration
April 2025 revision (breaking)

A dated revision that introduced a breaking change to subscription endpoints.

What changed
  • Web Feeds API, Custom Metrics API, and Reviews client APIs introduced.
  • Push token management endpoints added with relationship support.
  • Subscriptions field made required on subscription endpoints (breaking).

Pin a revision in the header and move up before it retires.

Klaviyo API changelog ↗
Questions

Klaviyo API, answered.

What is the revision header and do I have to send it?+
Klaviyo versions its API by date, and a request names a version in a revision header, like 2026-04-15. The header is recommended on every call so behaviour stays stable as Klaviyo ships changes. If it is omitted, the request uses the account's default revision, which can shift, so pinning a revision is safer for an integration.
Should I use a private API key or OAuth?+
A private API key suits an integration acting on a single account it owns, and is sent in an Authorization header as Klaviyo-API-Key followed by the key. OAuth 2.0 suits a tech partner whose app acts for many Klaviyo accounts, because each account grants a scoped, revocable token through the authorization-code flow rather than handing over a long-lived key.
How do scopes work?+
Each area of the API has a read scope and a write scope, like profiles:read and profiles:write, or campaigns:read and campaigns:write. An OAuth app requests a space-separated list of the scopes it needs and the account owner approves them at authorization. A call that needs a scope the token does not carry returns a 403 response.
How does Klaviyo handle rate limits?+
Klaviyo applies two limits at once per account, a per-second burst and a per-minute steady, and each method belongs to a tier that sets both. Crossing either returns HTTP 429 with a Retry-After header naming the seconds to wait. Normal responses carry RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset so a client can pace itself before being limited.
Does Klaviyo have webhooks?+
Yes. The Webhooks API registers an endpoint and subscribes it to topics, like an email being clicked or a text message being received, and Klaviyo POSTs matching events to that endpoint in batches of up to 1,000. Flows can also call an external endpoint as a webhook action mid-flow, which is configured in the flow rather than through this API.
Is there an official Klaviyo MCP server?+
Yes. Klaviyo publishes a first-party Model Context Protocol server, generally available, that exposes Klaviyo tools to AI clients across profiles, campaigns, flows, lists, segments, events, metrics, and templates. A hosted remote server authenticates with OAuth, and a local server authenticates with a private API key and its scopes.
Related

More marketing API guides for agents

What is Bollard AI?

Control what every AI agent can do in Klaviyo.

Bollard AI sits between a team's AI agents and Klaviyo. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Klaviyo key.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Klaviyo
Lifecycle Agent
Read profiles ResourceOffReadFull use
Send campaigns ActionOffReadFull use
Lists & segments ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Klaviyo