Documentation Index

Fetch the complete documentation index at: https://docs.supermetrics.com/llms.txt

Use this file to discover all available pages before exploring further.

Create an API key for a team

  • Updated on Jul 10, 2026
  • Published on Jul 6, 2026
Prev Next
Post
/v1/teams/{team_id}/api_keys

Create a new API key for a team. Creating a new API key through this endpoint is recorded to the audit logs.

Security
HTTP
Type bearer

API key authentication. Create API keys in the Supermetrics Hub and send them in the Authorization header: Authorization: Bearer <your-api-key>

Path parameters
team_id
integer (int64) Required

ID of the team

Minimum1
Maximum9223372036854776000
Example936506
Body parameters

API key creation parameters including permissions and access controls

{
  "description": "Marketing team API key",
  "scope_names": [
    "ds_queries_read",
    "ds_queries_run",
    "table_groups_read"
  ],
  "allow_ips": [
    "192.168.1.100",
    "10.0.0.0/24"
  ],
  "is_enabled": true,
  "behalf_of_user_id": "user_123456"
}
object
description
string

Internal API key description

Max length1000
scope_names
Array of string Required

List of permission scopes for the API key.

Max items100
string
Max length100
allow_ips
Array of string

List of fixed or CIDR formatted IP addresses allowed to use API key. Only IPv4 is supported.

Max items100
string
Max length255
is_enabled
boolean

Whether API key is enabled and can be used in requests

Defaulttrue
behalf_of_user_id
string | null Required

Supermetrics user ID the API key identifies as

Max length50
Pattern^[A-Za-z0-9_-]+$
Responses
201

API key created successfully.

Expand All
object
meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
data
object (ApiKey)
@type
string
Valid values[ "api_key" ]
api_key_id
string

Supermetrics API key ID

Max length50
Pattern^[A-Za-z0-9_-]+$
created_time
string (date-time)

ISO 8601 datetime for when API key was created

Max length50
description
string

Internal API key description

Max length1000
key_type
string

Type of API key

Max length50
key_start
string

First 10 characters from the API key value

Max length50
Pattern^[A-Za-z0-9_-]+$
key_value
string | null

API key value as plain text, when requested. Defaults to null.

Max length255
Pattern^[A-Za-z0-9_-]+$
scope_names
Array of string

List of permission scopes for the API key

Max items100
string
Max length100
allow_ips
Array of string

List of fixed or CIDR formatted IP addresses allowed to use API key

Max items100
string
Max length255
Pattern^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([0-9]|[1-2][0-9]|3[0-2]))?$
is_enabled
boolean

Whether API key is enabled and can be used in requests

behalf_of_user_info
object

Supermetrics user the API key identifies as

@type
string
Valid values[ "user" ]
user_id
string

Supermetrics user ID

Max length50
Pattern^[A-Za-z0-9_-]+$
email
string (email)

Supermetrics user email

Max length255
400

Bad request - invalid parameters

Headers
X-RateLimit-Limit
integer
Request limit per hour
Minimum1
Maximum10000
Example5000
X-RateLimit-Remaining
integer
Remaining requests in current window
Minimum0
Maximum10000
Example4999
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "BAD_REQUEST",
    "message": "The request was invalid."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.
401

Unauthorized

Headers
WWW-Authenticate
string
Bearer token required
Max length255
Pattern^Bearer.*
X-RateLimit-Limit
integer
Request limit per hour
Minimum1
Maximum10000
Example5000
X-RateLimit-Remaining
integer
Remaining requests in current window
Minimum0
Maximum10000
Example4999
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication is required."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.
403

Permission denied

Headers
X-RateLimit-Limit
integer
Request limit per hour
Minimum1
Maximum10000
Example5000
X-RateLimit-Remaining
integer
Remaining requests in current window
Minimum0
Maximum10000
Example4999
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "PERMISSION_ERROR",
    "message": "You do not have permission to perform this action."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.
422

Unprocessable Entity - validation failed for the request parameters

Headers
X-RateLimit-Limit
integer
Request limit per hour
Minimum1
Maximum10000
Example5000
X-RateLimit-Remaining
integer
Remaining requests in current window
Minimum0
Maximum10000
Example4999
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "UNPROCESSABLE_ENTITY",
    "message": "Validation failed for the request parameters."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.
429

Too Many Requests

Headers
X-RateLimit-Limit
integer
Request limit per hour
Minimum1
Maximum10000
Example5000
X-RateLimit-Remaining
integer
Remaining requests in current window
Minimum0
Maximum10000
Example4999
Retry-After
integer
Seconds until rate limit resets
Minimum1
Maximum86400
Example3600
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "TOO_MANY_REQUESTS",
    "message": "Rate limit exceeded. Retry later."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.
500

Internal server error

Headers
Access-Control-Allow-Origin
string
CORS header
Valid values[ "*" ]
Max length255
Example*
{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "INTERNAL_SERVER_ERROR",
    "message": "An unexpected error occurred."
  }
}
Expand All
object

Standard envelope returned by all error (4xx/5xx) responses.

meta
object (Meta)

Metadata included in every API response.

request_id
string

Unique identifier for the request, for tracking and debugging.

Min length8
Max length64
Pattern^[A-Za-z0-9_-]+$
ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN
error
object (Error)

Machine- and human-readable detail for a failed request.

code
string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100
Pattern^[A-Z][A-Z0-9_]*$
ExampleBAD_REQUEST
message
string

Short, human-readable summary of the error.

Max length255
Pattern^.+$
ExampleThe request was invalid.
description
string

Optional longer explanation specific to this occurrence.

Max length2048
ExampleThe field 'display_name' must not be empty.

© Supermetrics 2026