ReportPlaneDocs
WebsiteOpen console

Query clients

Create a read identity with explicit Analytics API scope, authentication, filters, and time-window policy.

Last verified 2026-08-02

A query client represents an application or consumer that reads published analytics. It is separate from an ingest client so write and read privileges do not need to share one credential.

Create a query client

Open Access → Query Clients → New query client.

  1. Enter a name and description.
  2. Select allowed Analytics APIs.
  3. Configure authentication.
  4. Add optional CIDR restrictions.
  5. Configure supported access filters or time-window restrictions.
  6. Review the effective policy and save.

Allowed analytics

The runtime checks both the requested analytics reference and the resolved Analytics API ID/key. A valid query credential cannot execute a definition outside its allowlist.

Access filters

Client access filters apply policy constraints in addition to the Analytics API definition. They use the canonical filter operators and are validated when configured.

Time windows

Allowed time-window settings can restrict the temporal scope available to a query identity. Use these controls when a consumer should access only a bounded period even if the Analytics API supports a broader filter.

Enabled state and rotation

Disable a client to stop runtime use without immediately removing its configuration. Create separate clients for separate applications so one secret can be rotated or revoked without a shared outage.

POST/management/v1/query-clients
Create a query client.
PUT/management/v1/query-clients/{id}/authentication
Configure authentication.
PUT/management/v1/query-clients/{id}
Update the client policy.
DELETE/management/v1/query-clients/{id}
Delete the client.
Was this page helpful?Send feedback