Api-Key header; the api_key query parameter still works but is documented as deprecated and is never used here.
Lookups and verification can spend credits, so those four operations are marked write even where the HTTP verb is GET. Searches return summaries without spending lookup credits and are marked read. Search requests still count toward plan limits. Things to know:
- A
403on a lookup is not a permission problem. Running out of lookup credits returns403 Forbiddenwith only an explanatorydetail; there is no structured credit field to check. The plugin exposesisOutOfLookupCreditsfor exactly this case, and no retry can help. Only/email/verifyreports an empty balance as a402, and that one names the pool incredit_typeand apurchase_url. statusdecides whether a lookup is final. A lookup answerscomplete,progress,searchingornot queued. Anything butcompletemeans the contact fields are not settled: the cached emails may be withheld and the rest arrives later. Pollperson.checkStatuswith the profile ID or theRR-Request-IDrather than treating a200as finished.- A bulk lookup has no body.
person.bulkLookupanswers a bare200with the request ID in theRR-Request-IDheader, so the plugin returnsrequestId(ornullwhen RocketReach sends no header) and that is what to poll with. email.verifycan cost nothing. It charges one verification credit and refunds it when the status isunknownorchecks.format_validis false, which is why the response carriescredits_chargedas0or1.statusandchecks.catchallanswer different questions: a catch-all domain whose mailbox was confirmed isvalidwhilecatchallistrue.- Search is not lookup.
person.searchreturns profile summaries and ateaser, with no unlocked contact details.company.searchreturns company summaries. Unlocking a profile is a lookup, and that is the call that spends a lookup credit. - Rate limits are layered. There is a global ceiling of 10 requests per second across every endpoint, plus a per-route, per-plan limit per minute. A
429carries aRetry-Afterin seconds, which the plugin honours. - The universal account returns your key.
account.universalincludes the caller’s ownapi_keyin its body; the plugin strips it before returning, so a credential never lands in a caller’s logs or stored records. - Bulk prerequisites. Enable a webhook for bulk lookups in RocketReach, or supply its
webhook_id. - Paging:
page_sizetops out at 100 andstartat 10,000 on both searches.
- 9 typed API operations
Setup
1
Install
2
Add the plugin
corsair.ts
multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.3
Choose authentication
- API Key (Recommended)
No setup required yet. When you make your first request as a tenant, Corsair prompts for the API key.More: API Key
4
Connect a tenant
Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.
Example API calls
Read the account and its credit balanceWhat’s next
API reference
Every
rocketreach.api.* operation with input and output types.Connect / OAuth
createLink, Hub delivery, and tenant connect flows.
Use with agents
Expose this plugin’s operations as MCP tools.