Key takeaways

  • There is no official LinkedIn API for searching people or sending outreach, at any price tier.
  • The strongest detection signal is one session used from two places — a cloud tool replaying your cookie from a datacentre while you browse from your laptop.
  • Safe working limits: around 20 invites a day and 80 a week per user, messages only inside working hours, and a full stop on the first CAPTCHA.
  • Work from search result cards, not individual profiles, and split searches by experience bucket and geography to get past the ~100-page ceiling.
  • Two legal lines: collect only what is visible to everyone (CNIL fined KASPR €240,000 for the opposite), and include the GDPR Article 14 notice in the first message.

Every sourcing tool demo skips the same slide: what happens when the account gets restricted. It is worth starting there, because it is the only outcome that actually costs you a quarter.

The uncomfortable base fact: LinkedIn offers no official API for searching people or sending outreach. Not on Recruiter, not on Sales Navigator, not for money. Everything that automates those actions works against the User Agreement, so the whole category lives on a spectrum of risk rather than a line between allowed and forbidden.

Given that, the useful question becomes narrow and practical: what actually triggers detection, and how do you stay far from it?

What gets accounts flagged

From what is publicly reported and what we have seen, the strongest signals are not clever heuristics. They are blunt:

Nothing you gain from a faster tool is worth a recruiter losing the network they spent five years building.

The approach that survives

Ours is deliberately unglamorous: the browser is the recruiter's own, logged in as them, on their own connection. An AI assistant works inside that browser and files what it finds into the ATS through our own server. Nothing about the session ever leaves their machine.

On top of that sit limits that live on the server, not in a settings screen, because a limit a user can raise is not a limit:

Before every single action the assistant has to ask the server for permission. If the window, the cap or the pause says no, it gets a structured refusal and stops. No prompt phrasing gets around it, because the decision is not made by the model.

The insurance policy: every person found and every reply received is mirrored into your own database. If an account is restricted tomorrow, your pipeline, your notes and your conversation history are still yours.

Read the result pages, not the profiles

A detail that matters more than it sounds: work from search result cards, not from individual profiles. Opening a thousand profiles is slow, expensive and exactly the pattern that gets noticed. Sales Navigator's result cards already carry the name, title, company and location — enough to create a prospect record and enrich it later from other sources.

Which leaves the paging problem. Sales Navigator caps out around 100 pages, so a search returning 4,000 people hides most of them. The fix is arithmetic, not automation: read the count first; under a thousand, page through; over a thousand, split by the five official years-of-experience buckets; still over, split by geography; then one job title at a time. Report the count of each segment as you go, so nobody quietly loses two thirds of the market.

Two legal lines worth knowing

Collect only what anyone can see. In December 2024 the French regulator fined KASPR €240,000, largely for collecting data visible only to first- and second-degree connections. Public means public to everyone, not public to you because you connected.

Tell people how you found them. Under GDPR Article 14, a first cold message needs to say who you are, that you found their public profile, what you will do with the data, and how to opt out. We build this into the first touch of every sequence so it cannot be forgotten. It also, in our experience, reads better than the alternative.

The boring rules that keep it working

None of this is the fastest possible sourcing. It is the fastest sourcing you can still be doing next quarter.

Frequently asked questions

Is there an official LinkedIn API for sourcing candidates?

No. LinkedIn offers no public API for searching people or sending connection requests, InMails or messages, on any plan including Recruiter and Sales Navigator. Every tool that automates those actions operates against the User Agreement, so the practical question is how much detection risk a given approach carries.

How many LinkedIn connection requests per day are safe?

Community-reported limits cluster around 20 invites per day and 80 per week per account, with messages and profile views also capped. LinkedIn does not publish thresholds, so treat these as conservative working numbers and keep all sending inside normal working hours.

What gets a LinkedIn account restricted?

The clearest signals are a session used from two locations at once, unusual volume or rhythm such as dozens of invites in minutes or activity at 03:00, mass profile viewing, and continuing after a CAPTCHA or a checkpoint redirect. Automation that runs in the recruiter's own browser at human pace avoids most of these.

What must a first cold outreach message include under GDPR?

Under Article 14 you must tell the person who you are, that you obtained their data from their public profile, the purpose and legal basis, how long you will keep it, their rights including the right to object, and how to opt out. Building this into the first touch of every sequence is the only reliable way to make sure it happens.

Sources LinkedIn User Agreement §8.2. CNIL decision on KASPR, December 2024 (€240,000). GDPR Article 14. Community-reported LinkedIn limits; LinkedIn does not publish thresholds.
The ISTL Recruit teamWe build recruiting software for in-house teams, and use it ourselves.