Management API

The Management API is the supported automation surface for configuring ReportPlane. It lives at:

https://app.reportplane.com/management/v1

It reuses the same validated product services as the console while keeping a separate authentication and versioned route contract.

Authentication#

Create a personal token under Settings → Management Tokens and send the complete one-time secret:

Authorization: Bearer rp_mgmt_PREFIX.SECRET

The token must be enabled, unexpired, permitted for the project, and carry the exact scope required by the route. Its owner must also retain workspace/project access.

Tokens containing any :write scope require their owner to remain a workspace owner or admin. A demotion invalidates the token fail-closed.

First request#

List the projects in the token's workspace:

curl "https://app.reportplane.com/management/v1/projects?workspace_id=WORKSPACE_ID" \
  --header "Authorization: Bearer $REPORTPLANE_MANAGEMENT_TOKEN"

A successful request uses the standard envelope:

{
  "error": false,
  "data": [
    {
      "id": "PROJECT_ID",
      "workspace_id": "WORKSPACE_ID",
      "name": "Production",
      "description": "Production telemetry resources",
      "access_mode": "inherited",
      "created_at": "2026-08-02T10:00:00Z",
      "updated_at": "2026-08-02T10:00:00Z"
    }
  ]
}

Project and workspace rules#

• Collection routes require project_id unless they are project routes.
• Project list/create operations use workspace_id.
• A project-restricted token is rejected before the resource handler runs if the project is outside its allowlist.
• Creating projects requires a workspace-wide token because a new project does not yet have an ID that can appear in an allowlist.
• Existing user membership and role checks still apply after token checks.

Projects#

Required scopes: projects:read or projects:write.

Method	Path	Purpose
GET	/projects?workspace_id={workspace_id}	List accessible projects
POST	/projects	Create a project; workspace-wide token required
GET	/projects/{id}	Read a project
PUT	/projects/{id}	Update a project

Data models#

Required scopes: models:read or models:write.

Method	Path	Purpose
GET	/models?project_id={project_id}	List models
POST	/models	Create a model
GET	/models/{id}	Read a model
PUT	/models/{id}	Apply a supported additive model update
DELETE	/models/{id}	Archive a model

Hard-delete is intentionally not part of the Management API.

Warehouses and credentials#

Required scopes: warehouses:read or warehouses:write.

Method	Path	Purpose
GET	/warehouses?project_id={project_id}	List warehouses
POST	/warehouses	Create a warehouse destination
GET	/warehouses/{id}	Read a warehouse
GET	/warehouse-credentials?project_id={project_id}	List masked credential metadata
POST	/warehouse-credentials	Create encrypted warehouse credentials
GET	/warehouse-credentials/{id}	Read masked credential metadata
PUT	/warehouse-credentials/{id}	Update a credential/configuration

Credential responses never reveal a stored plaintext secret.

Runtime clients and runtime API keys#

Required scopes: clients:read or clients:write.

Method	Path	Purpose
GET/POST	/ingest-clients	List or create ingest clients
GET/PUT/DELETE	/ingest-clients/{id}	Read, update, or delete an ingest client
PUT	/ingest-clients/{id}/authentication	Configure ingest authentication
GET/POST	/query-clients	List or create query clients
GET/PUT/DELETE	/query-clients/{id}	Read, update, or delete a query client
PUT	/query-clients/{id}/authentication	Configure query authentication
GET/POST	/runtime-api-keys	List or create ingest/query runtime keys
GET/PUT/DELETE	/runtime-api-keys/{id}	Read, update, or revoke a runtime key

The /runtime-api-keys name is deliberate: it prevents confusion with the Management Token authenticating the current control-plane request. A newly created runtime key still returns its own secret once.

Analytics APIs and bindings#

Required scopes: analytics:read or analytics:write.

Method	Path	Purpose
GET/POST	/analytics-apis	List or create Analytics APIs
GET/PUT/DELETE	/analytics-apis/{id}	Read, update, or archive an Analytics API
GET/POST	/analytics-bindings	List or create destination bindings
POST	/analytics-bindings/{id}/promote	Atomically route an Analytics API through this binding while retaining older bindings

Security resources#

Required scopes: security:read or security:write.

Method	Path	Purpose
GET/POST	/client-cas	List or create Client CAs
GET/DELETE	/client-cas/{id}	Read or delete a Client CA

Intentionally excluded#

The v1 Management API does not expose:

• account registration, login, passwords, or personal profile operations;
• workspace invitations and team membership;
• plans, subscriptions, or billing;
• Dashboard playground and statistics helper routes;
• discovery capture/review controls;
• internal admin and hard-delete operations.

These exclusions keep the external contract focused on deterministic configuration workflows.

Errors#

Status	Meaning
400	Invalid JSON, missing project/workspace identifier, or invalid resource input
401	Missing, malformed, expired, revoked, disabled, or owner-invalid Management Token
403	Required scope, workspace, project allowlist, membership, or role check failed
404	Resource not found
409	A uniqueness or lifecycle conflict
413	Management request body exceeds 2 MiB