Everything an AI agent can do with the Recurly API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints35
API versionv2021-02-25
Last updated23 June 2026
Orientation

How the Recurly API works.

The Recurly API is how an app or AI agent runs subscription billing on a site: creating an account, starting or canceling a subscription, collecting or refunding an invoice, and applying a coupon. Access is granted through a private API key that carries full access to the site it belongs to, because Recurly has no granular scopes or read-only key type, so the only built-in boundary is which site the key is tied to. A change to a record can be pushed to a configured endpoint as a notification, so an integration learns about activity without polling.

35Endpoints
9Capability groups
14Read
21Write
0Permissions
Authentication
Recurly authenticates with a private API key over HTTP Basic auth, sent as the username with a blank password, not OAuth. Every request must also name a dated API version in the Accept header, like application/vnd.recurly.v2021-02-25. A separate public key exists only for client-side card tokenization through Recurly.js and cannot call the API.
Permissions
Recurly has no granular API scopes and no read-only key type. A private API key carries full access to every method on the site it belongs to, read and write, so the only built-in boundary is which site a key is tied to. A site can hold several private keys (5 on Core or sandbox sites, 10 on Professional), which lets a key be issued per integration and revoked on its own, but each one is still all-or-nothing within its site.
Versioning
Recurly pins a dated API version requested per call through the Accept header, like v2021-02-25, and a response echoes it in the Recurly-Version header. A change ships under a new dated version, so an integration keeps working against the version it targets until it deliberately moves up. Omitting the version returns a 406 error.
Data model
Recurly is resource-oriented REST with JSON requests and responses over a site-scoped base URL. Billing is built from Accounts, Plans, Subscriptions, Invoices, Line items, and Transactions, with Coupons applying discounts and a single Purchases call assembling an account, its subscriptions, and a payment at once. Lists are cursor-paginated, and a state change can be pushed to a configured webhook endpoint.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Recurly determines what it can reach. There is a route for making calls and a route for receiving events, and each is governed by the credential behind it. A private API key carries full access to the site it belongs to, so the boundary an agent works within comes from how that key is given out and what sits in front of it.

Ways to connect

REST API

The REST API takes JSON request bodies, returns JSON, and pages through lists with a cursor, at https://v3.recurly.com (or https://v3.eu.recurly.com for the EU data center). A call authenticates with a private API key over HTTP Basic auth, and every request must name a dated API version in the Accept header, like application/vnd.recurly.v2021-02-25.

Best forConnecting an app or AI agent to Recurly.
Governed byThe private API key, which carries full access to its site.
Docs ↗

Webhooks

Recurly POSTs a notification to an HTTPS endpoint configured in the site settings whenever a chosen event happens, like a subscription renewing or a payment failing. Payloads are available in JSON or XML, set per endpoint, and an endpoint can be limited to only the notification types it cares about. A JSON payload carries the event type and object identifiers, which an integration uses to re-fetch the current object through the API.

Best forReceiving Recurly events at an app or AI agent.
Governed byThe endpoints configured on the site; Recurly recommends checking the source IP and using a secret URL.
Docs ↗
Authentication

Private API key

A private API key authenticates server-side calls over HTTP Basic auth, sent as the username with a blank password. It carries full access to the site it belongs to: Recurly has no per-method scopes or read-only key type, so any key can call any method, read or write. A site can hold several private keys (5 on Core or sandbox sites, 10 on Professional), so a key can be issued per integration and rotated independently. A private key must never be exposed in client code.

TokenPrivate API key (HTTP Basic auth, key as username)
Best forServer-side calls; the only key type for the V3 API.
Docs ↗

Public key (Recurly.js)

A separate public key is used only by Recurly.js and the mobile SDKs to tokenize card details in the browser or app, so raw card data never reaches an integration's own servers. It cannot read or change data through the API and is not an alternative way to authenticate API calls.

TokenPublic key (client-side tokenization only)
Best forCollecting card details client-side without handling raw card data.
Docs ↗
Capability map

What an AI agent can do in Recurly.

The Recurly API is split into areas an agent can act on, like accounts, subscriptions, invoices, plans, transactions, and coupons. Each area has its own methods, and writes in some areas charge cards, refund money, or cancel a customer's billing.

Endpoint reference

Every Recurly API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Accounts

Methods for working with customer accounts.5

Read-only. Recurly has no per-method scopes; a private API key can call this.

Acts onaccount
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write. Recurly has no per-method scopes; a private API key carries full access.

Acts onaccount
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventnew_account_notification
Rate limitStandard limits apply

Read-only.

Acts onaccount
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts onaccount
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventupdated_account_notification
Rate limitStandard limits apply

Reversible with the reactivate method; cancels the account's active subscriptions.

Acts onaccount
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventcanceled_account_notification
Rate limitStandard limits apply

Billing info

Methods for working with an account's stored payment details.3

Read-only. Card numbers are returned only as a masked last four, never in full.

Acts onbilling_info
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Sets the payment method that future charges are taken from. Raw card data is normally tokenized client-side.

Acts onbilling_info
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventbilling_info_updated_notification
Rate limitStandard limits apply

Leaves the account with no payment method until one is set again.

Acts onbilling_info
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Subscriptions

Methods for working with recurring subscriptions.7

Read-only.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Starts recurring billing and can generate an immediate invoice and charge.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventnew_subscription_notification
Rate limitStandard limits apply

Read-only.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Plan and quantity changes go through the subscription change endpoint, not this one.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventupdated_subscription_notification
Rate limitStandard limits apply

The subscription stays active until term end, then expires; reactivate undoes it before then.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventcanceled_subscription_notification
Rate limitStandard limits apply

Ends the subscription now and can issue a full or prorated refund depending on the refund parameter.

Acts onsubscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventexpired_subscription_notification
Rate limitStandard limits apply

Can charge or credit immediately depending on the timeframe and proration settings.

Acts onsubscription_change
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Invoices

Methods for working with invoices.5

Read-only.

Acts oninvoice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only. A PDF of the invoice is available at the .pdf variant of this path.

Acts oninvoice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Charges the account's payment method; fires a payment notification on success or failure.

Acts oninvoice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventsuccessful_payment_notification
Rate limitStandard limits apply

Moves real money back to the customer; refund can be by amount or by line item.

Acts oninvoice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventsuccessful_refund_notification
Rate limitStandard limits apply

Only valid on an invoice with nothing collected on it.

Acts oninvoice
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Line items

Methods for working with charges and credits on an account.3

Read-only.

Acts online_item
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Creates an uninvoiced charge or credit that a later invoice picks up.

Acts online_item
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Only a line item not yet attached to an invoice can be removed.

Acts online_item
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Plans

Methods for working with subscription plans.4

Read-only.

Acts onplan
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Adds to the catalog every new subscription draws from.

Acts onplan
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onplan
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Affects new subscriptions and renewals on the plan.

Acts onplan
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Transactions

Methods for reading payment transactions.2

Read-only. Transactions are created by collection and refund actions, not by a direct create method.

Acts ontransaction
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts ontransaction
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Coupons

Methods for working with discount coupons.3

Read-only.

Acts oncoupon
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Creates a discount that can be redeemed on accounts and subscriptions.

Acts oncoupon
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reduces what the account is billed on matching charges.

Acts oncoupon_redemption
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Purchases

Methods for creating a checkout in a single call.3

Charges the card and creates the resulting invoice, subscriptions, and transactions together.

Acts onpurchase
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventsuccessful_payment_notification
Rate limitStandard limits apply

No money moves; returns the invoice that a real purchase would produce.

Acts onpurchase
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Places a hold on the card; capture the held funds with the capture method.

Acts onpurchase
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventtransaction_authorized_notification
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Recurly can notify an app when something happens on a site, like a subscription renewing, a payment succeeding, or an invoice closing. It sends a notification naming the event and the object it concerns, so an integration learns about activity without polling.

EventWhat it signalsTriggered by
new_account_notificationA new account was created on the site./accounts
updated_account_notificationAn account's details were changed./accounts/{account_id}
canceled_account_notificationAn account was closed or deactivated./accounts/{account_id}
billing_info_updated_notificationAn account's stored billing information was added or changed./accounts/{account_id}/billing_info
new_subscription_notificationA new subscription was created on an account./subscriptions
updated_subscription_notificationA subscription was changed./subscriptions/{subscription_id}
canceled_subscription_notificationA subscription was canceled and will expire at term end./subscriptions/{subscription_id}/cancel
expired_subscription_notificationA subscription ended, either at term end or by immediate termination./subscriptions/{subscription_id}
successful_payment_notificationA payment was approved and collected./invoices/{invoice_id}/collect
/purchases
successful_refund_notificationA refund was processed back to the customer./invoices/{invoice_id}/refund
transaction_authorized_notificationAn authorize-and-capture style payment was authorized, holding funds./purchases/authorize
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Recurly limits how fast an app can call, by a request count measured over a rolling window, with separate ceilings for sandbox and production sites.

Request rate

Recurly meters requests by count over a rolling 5 minute window, not by a per-method cost. A new sandbox site allows 400 requests per minute and counts every request, while a new production site allows 1,000 requests per minute and counts only GET and HEAD requests, so writes on a production site do not draw down the limit. Because the window is rolling, a production site can burst well above the per-minute figure in a single minute as long as the 5 minute total stays under the ceiling. Going over returns HTTP 429, and every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers to track headroom.

Pagination

List endpoints are cursor-based. The limit parameter sets the page size from 1 to 200 (default 20), order is asc or desc (default desc), and sort chooses the field to order by, usually created_at or updated_at. The response Link header carries the URL of the next page, and a has_more field signals whether more pages remain. The client libraries expose this as an auto-paging iterator.

Request size

A list page returns at most 200 records, the maximum value of limit. Times in begin_time and end_time filters use ISO 8601. Webhook notifications can be delivered as JSON or XML, configured per endpoint.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400bad_requestThe request could not be understood, for example malformed JSON or an invalid content type.Read the message, fix the request body or headers, and resend.
401unauthorized / invalid_api_keyNo valid API key was provided, or the key was rejected.Confirm a current private API key is sent as the Basic auth username, and rotate it if it may be compromised.
403invalid_permissionsThe key is valid but not allowed to perform this action on this site.Use a key for the correct site, and confirm the site has the feature enabled.
404not_foundThe requested object does not exist or is not visible to this site.Verify the id or code, and confirm the object lives on the same site as the key.
422validation / transactionThe parameters failed validation, or a payment was declined. A transaction error carries a transaction_error object describing the decline.Read params for the field errors, or transaction_error for a decline, fix the input, and ask for a different payment method where needed.
406invalid_api_version / unknown_api_versionThe Accept header named no version or a version Recurly does not recognize.Send a supported dated version in the Accept header, like application/vnd.recurly.v2021-02-25.
429rate_limitedToo many requests arrived within the rolling rate-limit window.Back off using the X-RateLimit-Reset header and retry, and smooth the request rate.
500internal_server_errorAn error on Recurly's side, which can also appear as service_not_available. It is rare.Retry with backoff, and contact Recurly support if it persists.
Versioning & freshness

Version history.

Recurly pins a dated version of its API, requested per call, so a change ships under a new dated version and existing integrations keep working against the one they target.

Version history

What changed, and when

Latest versionv2021-02-25
v2021-02-25Current version
Current GA version

Recurly pins a dated API version requested per call in the Accept header, like application/vnd.recurly.v2021-02-25, and a response echoes it in the Recurly-Version header. This version corresponds to the 4.x client libraries.

What changed
  • Entitlements support and percentage tiers for add-ons.
  • Ramp pricing and usage timeframes.
  • Multicurrency plans and precision (decimal) pricing.
  • Pending purchases, invoice customization, and shipping method management.
v2019-10-10
Previous major version (3.x client libraries)

The version targeted by the 3.x client libraries, superseded by v2021-02-25.

What changed
  • Decimal quantity support and measured units.
  • Dunning campaigns and backup payment methods.
  • Item-backed add-ons and wallet/billing-info management.
  • Revenue recognition and improved shipping support.
v2018-08-09
Account hierarchy and purchases

An earlier dated version introducing checkout-style purchases and account relationships.

What changed
  • Purchases endpoint introduced.
  • Parent and child account relationships.
  • Subscription changes and product codes on line items.
v2018-05-10
Subscription pause and resume

Added the ability to pause and resume a subscription.

What changed
  • Subscription pause and resume, with paused_at and remaining_pause_cycles fields.

Target a dated version in the Accept header and move up deliberately.

Recurly API changelog ↗
Questions

Recurly API, answered.

Does Recurly support OAuth or scoped API keys?+
No. The V3 API authenticates only with a private API key over HTTP Basic auth, sent as the username with a blank password. There is no OAuth flow and no scoped or read-only key type, so any private key has full access to its site. The public key used by Recurly.js is for client-side card tokenization only and cannot call the API.
How can an API key be limited in what it does?+
Within Recurly, it cannot be: a private API key is all-or-nothing on its site, with no per-resource or read-only setting. The available controls are issuing a separate key per integration (5 keys on Core or sandbox sites, 10 on Professional) and revoking a key on its own, plus using a sandbox site for testing. Finer limits, like read-only or per-resource access, have to come from a layer in front of the key.
Why am I getting a 406 error on every request?+
A 406 means the request did not name a valid API version. Every call must send the dated version in the Accept header, for example application/vnd.recurly.v2021-02-25 or the same with a +json suffix. Recurly echoes the version it used in the Recurly-Version response header.
How do the rate limits work?+
Limits are counted over a rolling 5 minute window. A new production site allows 1,000 requests per minute and counts only GET and HEAD requests, so writes do not draw down the limit, while a new sandbox site allows 400 per minute and counts every request. Over the limit returns HTTP 429, and the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers on every response show the current headroom.
How do I handle a declined payment?+
A payment failure returns HTTP 422 with an error type of transaction and a transaction_error object describing the decline, including a category and a customer-facing message. Read transaction_error to tell the customer what happened and, where relevant, ask for a different payment method rather than blindly retrying.
How are webhooks secured?+
Recurly POSTs notifications to the HTTPS endpoints configured on the site, in JSON or XML per endpoint. There is no payload signature, so Recurly recommends verifying the request comes from its published source IP ranges and using a hard-to-guess endpoint URL, optionally with HTTP Basic auth on the receiving endpoint. A JSON payload carries object identifiers an integration re-fetches through the API.
What is a Purchase and when should I use it?+
A Purchase creates an account, its subscriptions, any one-time charges, and the payment in a single call, returning the resulting invoice and transactions. It is the checkout-style endpoint for a new sign-up. The preview variant returns the same invoice without charging, and the authorize variant holds funds for later capture.
Related

More finance API guides for agents

What is Bollard AI?

Control what every AI agent can do in Recurly.

Bollard AI sits between a team's AI agents and Recurly. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged. This matters more with Recurly than most apps, because a Recurly private API key carries full access on its own.

  • Set read, write, or full access per agent, even though a raw Recurly key cannot be scoped.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Recurly
Billing Agent
View subscriptions ResourceOffReadFull use
Refund invoices ActionOffReadFull use
Accounts ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Recurly