API keys and the REST API

Organisation API keys let external tools read your data over a REST API — Power BI, Looker Studio, a data lake, or your own scripts. Each key is a bearer token that authenticates one integration; the API is read-only, so a key can report on your organisation but never change it.

Keys can be org-wide or scoped to a single sub-team, and every key shows its last-used time and a rolling request count, so you can tell a live integration from a dead one before you revoke anything.

Create an API key

1. Open API keys in the Admin section of the sidebar (or go to Organisation settings, then API keys).
2. Under Create a new key, give the key a Key name that identifies the integration — "PowerBI prod", "Looker staging".
3. Optionally set Expires on. Leave it blank for a key that never expires; you can archive any key at any time.
4. If your organisation uses sub-teams, optionally pick a Team scope — a team-scoped key only returns that team's projects and people. Leave it as Org-wide — every team otherwise.
5. Press Create key.

You'll see a Key created — copy it now panel with the full secret. This is the only time it's visible — the server stores a one-way hash, not the secret itself, so it can't be shown again. Copy it into your tool straight away; if you lose it, regenerate the key. Afterwards the list shows only the key's prefix (cs_live_…) so you can match it to whatever is configured in your tools.

You can hold up to 5 active org-wide keys, plus 5 active keys per team.

Connect a tool to the API

Send the key as a bearer token on every request:

Authorization: Bearer cs_live_...

The base URL is https://api.controlstandard.tools/v1. For endpoint detail — pagination, errors, the full endpoint reference and copy-paste examples for curl, Python, Power BI and Looker Studio — read the API documentation; it's also linked as Read the API docs. at the top of the API keys page. Requests are rate-limited per key: 90 per minute, 375 per hour, 750 per day.

Monitor key usage

The Your keys table shows each key's Scope, Prefix, Expires, Last used and a rolling 7-day request count, plus a status of Active, Expired or Archived. A key that hasn't been used in months is a candidate for archiving.

Revoke or rotate a key

1. Find the key in Your keys.
2. Press Archive to revoke it — it stops working immediately. Or press Regenerate to rotate it: the old secret is archived and a new one is issued with the same name, expiry and team scope, shown once as on creation.

Both actions take effect on the next API request. Every create, rotate and revoke is recorded in an audit trail with the actor, their role at the time, and IP address.

Who can do this

Managers and Admins — anyone with the manage-API-keys permission. The API itself is included on the Business plan and above; on lower plans the API keys page shows an Upgrade required notice and existing keys stop authenticating. If billing lapses, keys are refused until the subscription is active again.