API Keys and REST Access: Getting EndFrame Data Into Your External Tools
When your BI tool, internal dashboard, or automation workflow needs campaign and conversion data, a REST API with proper key management is the answer. Here is how EndFrame handles API access securely.
In short
EndFrame API keys are workspace-scoped credentials you create, name, enable, disable, or revoke on the Developers page of the dashboard. On a paid plan, send one as a bearer token or X-Api-Key header to the read-only REST API to pull an analytics overview, campaigns, domains, goals, and conversions into BI tools, warehouses, and automation workflows.
Dashboards are built for people. APIs are built for systems. As teams grow, the need to get campaign and conversion data out of the dashboard and into external tools becomes unavoidable. A BI team wants to join campaign data with revenue numbers. An ops team wants to pipe visit data into a monitoring system. An AI agent needs to answer questions about campaign performance. All of these require programmatic access, and that starts with a well-managed API.
Why API key management matters
An API without proper key management is a security risk and an operational headache. You need to know which system is accessing what, be able to cut access instantly if a key leaks, and give different integrations their own credentials so revoking one does not break everything else. These are not edge cases. They are the baseline for any team running integrations in production.
How EndFrame handles API keys
EndFrame's API key management lives on the Developers page of the dashboard. The workflow is straightforward:
- 1Create a new key and give it a descriptive name that identifies the integration.
- 2Copy the key at creation time — it is shown once for security.
- 3Enable or disable a key without deleting it, useful for temporary pauses.
- 4Revoke a key permanently when an integration is retired or a key is compromised.
Keys are workspace-scoped, which means they inherit the same data isolation that protects everything else in your workspace. A key from one workspace cannot access another workspace's data.
What the REST API exposes
The REST API is read-only and designed around the data teams most commonly need to pull into external systems:
- Analytics overview: visits, actions, conversions, conversion rate, and top campaigns, sources, and goals for a date range.
- Campaigns: list the campaigns in the workspace, or retrieve one with its mapping and activity summary.
- Domains: list the connected domains in the workspace.
- Goals and conversions: read conversion goals and the conversions recorded for each one.
Common integration patterns
Most teams start with one of a few common patterns. BI integrations pull campaign and conversion data on a schedule and join it with revenue data in a warehouse. Monitoring setups poll visit and conversion totals and alert when they drop below thresholds. Automation workflows trigger actions when new campaigns are created or when visit volume spikes. The REST API is generic enough to support all of these without custom middleware.
A conversion tracking platform that traps your data behind a login screen is a reporting tool. One that lets your data flow where it needs to go is infrastructure.
Getting started with API access
On a paid plan, create a workspace-scoped API key on the Developers page (the REST API and MCP server are on by default) and start making requests. Both are read-only. The API follows standard REST conventions with JSON responses, so any HTTP client or integration platform can connect. Combined with the MCP server for AI agents and the tracking snippet that records visits and events on your site, the REST API completes the picture: data flows into EndFrame through tracking, and out through read-only APIs, so your conversion tracking platform works with your stack instead of next to it.
Frequently asked questions
How do I create an API key in EndFrame?
API keys are managed on the Developers page of the dashboard. Create a new key and give it a descriptive name; on a paid plan it is ready to use immediately (the free trial does not include API access). Keys can be enabled, disabled, or revoked at any time.
What can I do with the REST API?
The REST API is read-only. It returns an analytics overview (visits, actions, conversions, conversion rate, and top campaigns, sources, and goals for a date range), lists campaigns and connected domains, and reads conversion goals and the conversions recorded for each goal. It does not write data back to EndFrame.
Is API access secure?
Yes. Every API request requires a valid key. Keys are workspace-scoped, so they only access data within your workspace. You can disable or revoke a key instantly if it is compromised, and giving each integration its own key means revoking one does not break the others.
Try EndFrame
Add a server-side path for your conversions.
EndFrame collects events first-party and forwards conversions server-side to Meta, GA4, TikTok, and webhooks with event-ID deduplication — then credits each conversion to its campaign, with the visit-to-conversion path you can audit.
No credit card required