If you want an automated job, script, RPA bot or integration platform (for example Power Automate, a Python service or a scheduled task) to send data to Bramble or pull data from it, use an API key. An API key belongs to your Bramble account, not to an individual user. Your jobs don't need anyone's login or session token, and they keep working when people change roles or leave.
You need Account Owner or Admin access in Bramble to create API keys. If you don't see the API keys tab, ask your Bramble Account Owner or contact us through the help widget.
Decide what the job needs to do (for example, read check-ins for a PTO calendar, or write check-in items from a form). This tells you which scopes to give the key.
Have a secure place ready to store the key, such as a password manager, a secrets vault or your platform's secure credential store.
Sign in to Bramble at your account's address (for example https://yourcompany.brmbl.io).
In the left-hand menu go to Settings > Account, then select the API keys tab. You can also go straight to https://yourcompany.brmbl.io/settings/api-keys.
The table lists every key on the account with its status, scopes, expiry, when it was last used, who created it and when.
Click Create API key (top right).
Name: give it a name that says what uses it, such as "EmployeeDesktop-PTO-Sync-Prod". The name appears in the Activity log against every change the key makes.
Access: choose Full access or Custom. We recommend Custom: tick Read and/or Write only for the resource groups the job needs (Checkins, Contact Center, Quality, Work Items, Plans, Inventory, Users, Groups, Process, Operations). Read covers GET requests. Write covers POST, PUT, PATCH and DELETE requests.
Expiration: choose One Month, Six Months, Twelve Months, a Custom date or No Expiry. An expiry date means you rotate the key regularly. Make a note to replace the key before it expires.
Contact Email: Bramble emails this address before the key expires. Use a team mailbox rather than one person's address.
Click Save.
The "Your API key is ready" window shows the full key value. This is the only time it is shown. Click the copy icon, paste the key into your secure store, tick "I have stored this API key in a secure location" and click Done. After this, Bramble shows only the key's prefix. If you lose the key, revoke it and create a new one.
Send every request to your account's API address and pass the key as a Bearer token:
Base URL: https://api.SUBDOMAIN.brmbl.io/v1. Replace SUBDOMAIN with the first part of your Bramble address. For example, if you sign in at yourcompany.us.brmbl.io, your API address is https://api.yourcompany.us.brmbl.io/v1.
Header: Authorization: Bearer <your-api-key>
Content type: send JSON bodies with Content-Type: application/json
Quick test (lists check-in items for one day; needs Checkins Read):
curl -X GET "https://api.SUBDOMAIN.brmbl.io/v1/checkin_items?date=2026-01-15" \
-H "Authorization: Bearer <your-api-key>"You can find every endpoint, its required scope and example requests in the Bramble developer documentation.
401 Unauthorized: the key is missing, mistyped, revoked or expired, or the Bearer prefix is missing. Check the key's status on the API keys page.
403 Forbidden ("Insufficient scope"): the key doesn't have the scope this endpoint needs. You can't change scopes on an existing key. Use Edit > Revoke and recreate to issue a new key with the right access, then update your job.
429 / blocked requests: the limit is 1,000 requests per minute per IP. Space out or batch your calls, or contact us about a higher limit.
Create one key per job or integration, so you can see each job's activity and revoke one without breaking the others.
Never put keys in source control, client-side code, spreadsheets or email.
Check the Last used column, and Settings > Activity (filter Created by = your key), to see what each key is doing.
If a key may have been exposed, revoke it immediately (Edit > Revoke).
For more on scopes, revoking and rotating keys, see API Keys. If an endpoint you need is missing, contact us through the help widget or at [email protected].