API Overview
Plan
API access is included on the Starter and Pro plans. See Credits & Usage.
Use the Syft APIs to pull Syft data into your own systems and send data to Syft from your servers. Every call is made with your workspace's server secret key. Get it, then follow Authentication to make your first call.
Base URLs
| Base URL | Used by |
|---|---|
https://app.syftdata.com/api/... | Lookup API, Export API, inbound webhook URLs |
https://e2.sy-d.io | Events API |
Your two keys
Syft gives your workspace two different keys. They are not interchangeable.
| Public tag key | Server secret key | |
|---|---|---|
| What it is | The data-api-key / sourceId value in your tag snippet | A secret that starts with sk_live_ |
| Used for | The Syft tag on your website (Install & SDK) | Every API in this section, plus MCP clients |
| Safe in browser code? | Yes | No. Server-side only |
| Where to find it | Your snippet on Data Collection | The API Secret Key card on /dashboard/settings/snippets |
Errors
The Lookup API, the Export API and inbound webhook URLs return errors as JSON with an error field:
| Status | Body | Description |
|---|---|---|
400 | { "error": "Invalid input" } | The request is missing a required field or has an invalid value. Each API page lists its own 400 cases. |
401 | { "error": "Unauthorized" } | The server secret key is missing or invalid |
403 | { "error": "..." } | Your workspace's plan doesn't include API access |
404 | { "error": "Not found" } | The record or motion doesn't exist, or belongs to another workspace |
What Alpha means
An API marked Alpha, such as the Lookup API, is still changing. Its request and response shapes may change as we iterate based on feedback, and it may be available only to select customers. Contact us if you'd like access.