# flow2act · Limits & capabilities

Know the boundaries before integrating. OpenAPI is the full machine-readable schema.

Security policy: only assigned authenticated approvers/reviewers may access private process content. Guest approvals, external document references and outbound sharedFields are disabled. Use private uploads and static outbound notifications. New Live executions retain evidence for three calendar months on Free or twelve on paid plans after final completion; open Live executions do not expire by age. Existing longer deadlines remain protected. Sandbox remains at 30 days from creation.

## Request example (replace example IDs)

```sh
curl "https://api.flow2act.com/v1/access" \
  -H "authorization: Bearer $FLOW2ACT_API_KEY" \
  -H "x-organization-id: 10000000-0000-4000-8000-000000000001"
```

Source: /docs/limits
Full schemas: /docs/openapi.json