Overview
Before you connect a system to the Mobaro API, it helps to know exactly what an API key can reach, the one way you can restrict it, and the rate limits that apply. This article covers all three.
At a glance |
|
Who can do this | Users with Organization › Administrate create API keys. Each key then has Super User-level access to its organization. |
Where | Configuration › API › API Keys |
Works on | Public API |
Availability | Enabled per organization by Mobaro — ask your CSM |
What an API key can access
⚠️ Heads-up: An API key is not tied to a person's access. Every key can read all data in your organization, whoever created it. Treat each key like an administrator password.
A key belongs to one organization. It works only with that organization's data. A separate organization, for example a test environment, needs its own key.
A key has Super User-level access to that organization. It sees every Location, User, Result and other record, regardless of Roles, User Groups or Location access. The permissions of the person who created the key don't apply. See What is a Mobaro Super User?
Read-only is the only restriction. A key marked Read-only can read data but gets 403 Forbidden on any create, update or delete. There are no per-module, per-location or per-endpoint scopes.
Read-only API keys
When you create a key under Configuration › API › API Keys, the Read-only checkbox is ticked by default: "Read-only keys cannot be used to create, update or delete data." Untick it only for integrations that genuinely need to write.
If your organization is set to read-only API access, the Read-only checkbox is ticked and locked when you create a key. For creating keys, see Creating and Managing API Keys.
API rate limits
To keep Mobaro fast and reliable for everyone, API requests are rate-limited. Limits are counted per API key, except for User writes:
What | Limit | Counted |
All API requests | 10 requests per second | Per API key |
Location group writes | 1 request per 15 seconds | Per API key |
Requests over a limit get 429 Too Many Requests. Back off and retry; see Handling errors, rate limits, and retry logic.
ℹ️ Note: Because limits are per key, separate integrations using separate keys don't slow each other down. User writes are the exception: they share one limit, so send them one at a time and retry on 429.
How much data per API request
List endpoints return pages. Most accept
Limitfrom 1 to 128 (default 128). Results accept 1 to 20 (default 20).Use
Offsetto step through pages. Each list response includestotal, so you know when you've reached the end.Some date-range queries, such as schedule slots and RideOps data, are limited to a maximum of 31 days per request.
For every parameter, see Mobaro API parameter reference.
Best practices
Create one key per integration, give it a clear name (for example "Power BI reporting"), and keep it read-only unless the integration writes. You can then delete a single key without breaking other integrations.
Cache results locally instead of re-fetching unchanged data.
Filter to reduce what you fetch, for example
Locations,LocationGroupsorAnsweredAfteron Results.Always page with
LimitandOffset.Avoid polling on short intervals. Use webhooks where they fit; see Using webhooks in Mobaro.
Never expose your API key in front-end code, spreadsheets you share, or public repositories.
Frequently asked questions
I'm a Super User, but there's no API tab or API Keys panel in Configuration. Why?
API access isn't enabled for your organization. Mobaro turns it on per organization: ask your CSM or contact Mobaro Support. Once it's on, reload the page to see the API Keys panel on the API tab. If the tab shows only Webhooks, API keys aren't enabled.
Do API keys inherit the permissions of the user or Role that created them?
No. A key isn't linked to its creator's Roles, User Groups or Location access. Every key can reach your whole organization's data; the only restriction is Read-only.
Can I limit a key to certain calls or data, for example to share it with another company?
No. The only option is Read-only, which blocks creating, updating and deleting. A read-only key can still read all of your organization's data, so control which endpoints are called in your own scripts or services.
Who can create API keys?
Super Users and users whose Role has Organization › Administrate, under Configuration › API › API Keys. If you don't have that access, ask one of them. See Creating and Managing API Keys.
Can I see which of our API keys are in use?
No. The API Keys panel shows each key's Name, Prefix, Created date and Read-only setting, but not when it was last used. Contact Mobaro Support if you need usage details before deleting a key.