API authentication and limits
Authenticate with an API key, and understand permissions, rate limits and error codes.
Last verified
The public API is read-only and available on Professional and Enterprise plans. An organization admin creates keys on the API keys page of the dashboard.
Send your key
Keys start with bp_. Send one in the Authorization header, or in the x-api-key header:
curl -H "Authorization: Bearer bp_YOUR_API_KEY" \
"https://breakpoint.it.com/api/v1/exercises?limit=20"Permissions
Each key carries a set of permissions. A request needs the one for the endpoint it calls. A key can only ever read data from the organization that owns it.
| Permission | Allows |
|---|---|
| exercise:read | List and read exercises |
| scenario:read | List scenarios |
| audit_log:read | List audit logs (also needs a plan with audit logging) |
Limits
- Each key is limited to 120 requests per minute.
- Professional includes 10,000 API requests per month. Enterprise is unlimited.
Errors
Errors return JSON with an error code and a message.
| Status | Code | Meaning |
|---|---|---|
| 401 | INVALID_API_KEY | The key is missing, unknown, inactive or expired. |
| 402 | TRIAL_EXPIRED, PAYMENT_REQUIRED | The organization needs an active subscription. |
| 403 | FEATURE_NOT_AVAILABLE | The plan does not include API access, or the key lacks the permission. |
| 429 | RATE_LIMITED | Too many requests. Wait briefly and retry. Going over the monthly quota also returns 429. |