Frequently Asked Questions

Frequently Asked Questions about the Upwork API.

General

Q: Is there a sandbox or staging environment for testing?
A: No. We do not provide a special sandboxing environment at the moment. Use your Upwork’s account for testing.

Q: What is “API Usage” on the “Create an Application” page?
A: It is a number of requests per hour, approximately.

Q: What if my application exceeds the per-hour-limit? Is there any day-limit?
A: The maximum number of requests per day is 40K. If your app exceed the limit, we will contact you at first. You should be ready to cooperate ASAP.

Security and Authentication

Q: How long does the Request token live?
A: OAuth Request token expires in 600 sec.

Q: How long does the Access token live?
A: The Access token never expires.

Resources and requests

Q: Are search results limited to a specific number of results?
A: Yes, Freelancers and Jobs search results are limited to 5,000 results.

Q: I get the response message This APP has no access to requested resource. What does it mean?
A: It means that your API Key does not have enough permissions/scopes. You need to visit API Center and edit key’s permissions.

Q: What is the ciphertext field?
A: It is an alias to the profile_key field.

Q: Where can I find the Company or Team ID?
A: The easiest way to get the Company or Team ID is to use
Companies & Teams API. Note that Company ID is represented by the parent_team__reference field in the API response.

Error handling messages

Q: I’m making a POST request for getting a token and I get an HTML message with code 411.
A: This usually happens when the POST request is incomplete. For example, when you use the POST method with parameters as a part of URL, but your Content-Length header is invalid. In other words, for an empty request body you have to use “Content-Length: 0” or calculate it correctly, if body exists.

Q: I’m getting error 429. What does that mean?
A: Please check the section Rate Limits

Q: The API fails with status 401 if there are spaces in parameter using OAuth, what’s wrong?
A: Parameters must be encoded according to RFC1738. For example, in Python you can use urllib.quote(), in PHP there is a function called rawurlencode().

Q: I’m getting other error messages not listed here, what can I do?
A: Please check the Errors Handling section in our Getting Started guide.