Account and API keys

Retrieve the account

GET /v2/me (no scope needed; tier cheap)

Authentication and API version requirements still apply. The Redbark app can read this endpoint even when its mobile plan is gated, so it can show the plan screen. This exception does not apply to other endpoints or third-party API credentials.

{
  "id": "acc_5c9bQm2vT1xWz8nR4pLk7D",
  "object": "account",
  "email": "jo@example.com",
  "name": "Jo Citizen",
  "first_name": "Jo",
  "last_name": "Citizen",
  "plan": "developer",
  "status": "active",
  "entitlements": { "api_access": true, "brokerage": false },
  "limits": { "connections": 6, "accounts": 24, "syncs": -1, "destinations": -1 },
  "usage": { "connections": 2, "accounts": 5, "brokerage_connections": 0 },
  "plan_fit": {
    "plans": [
      { "plan": "saver", "fits": true, "reasons": [] },
      { "plan": "developer", "fits": true, "reasons": [] },
      { "plan": "professional", "fits": true, "reasons": [] }
    ],
    "recommended": "saver"
  },
  "billing": {
    "source": "stripe",
    "interval": "month",
    "period_end": "2026-11-01T00:00:00.000Z",
    "trial_end": null,
    "app_trial": false,
    "needs_plan": false,
    "paid_before": false,
    "grandfathered": false
  },
  "timezone": "Australia/Sydney",
  "api_version": "2026-10-01.wattle",
  "key": { "id": "key_3K1nTq8cZ5yWvR2mPd7Lx9", "name": "CI", "scopes": ["account:read", "syncs:read", "syncs:write"], "legacy": false },
  "livemode": true
}

email, name, first_name and last_name identify the person, and are null unless the credential holds account:read (an OAuth token with mcp:read holds it; a key without it gets nulls). name is the display name Redbark stores; first_name is its first word and last_name the rest. -1 in limits means unlimited. usage reports current connections, accounts, and brokerage connections. plan_fit evaluates those resources, not API activity, so its recommendation may not include the features you need. billing.source is stripe for web billing, apple for App Store billing, or none without a billing record. Treat future sources and plan-fit reason codes as additive. app_trial identifies an active trial started from the app, including one started on a web-created account. needs_plan is true when the billing source is none and the account is not grandfathered, regardless of where it was created. paid_before distinguishes an expired paid subscription from an expired trial and is false while a subscription is live. grandfathered is true for a grandfathered account, which keeps API and app access whatever its subscription status unless it has explicitly chosen the Zerosum plan.

The api_key object

{
  "id": "key_3K1nTq8cZ5yWvR2mPd7Lx9",
  "object": "api_key",
  "name": "CI",
  "prefix": "rbk_live_3f9a1c2b",
  "scopes": ["syncs:read", "syncs:write"],
  "legacy": false,
  "secret": null,
  "allowed_ips": null,
  "expires_at": null,
  "expiring_at": null,
  "last_used_at": "2026-08-21T09:30:00.000Z",
  "rotated_from": null,
  "status": "active",
  "metadata": null,
  "livemode": true,
  "created": "2026-08-01T00:00:00.000Z",
  "updated": "2026-08-01T00:00:00.000Z"
}

status is active, expiring (rotated, still valid until expiring_at), expired or revoked. secret is only non-null on create and rotate responses.

Endpoints

All need the keys:write scope. Creating a key requires the caller to hold every scope being granted, and scopes are immutable after creation.

Rotation also requires the caller to hold every effective scope of the replacement key, including the read scopes implied by a legacy key. Holding keys:write alone is not enough to rotate a broader key; the request returns 403 scope_not_held.

Method and path	Tier	Notes
`GET /v2/api_keys`	cheap	Newest first
`POST /v2/api_keys`	mutating	`{ name, scopes, allowed_ips?, expires_at?, metadata? }`. Returns 201 with `secret`.
`GET /v2/api_keys/{id}`	cheap
`POST /v2/api_keys/{id}`	mutating	`{ name?, metadata? }`
`DELETE /v2/api_keys/{id}`	mutating	Revokes; returns `{ id, object, deleted: true }`
`POST /v2/api_keys/{id}/rotate`	mutating	`{ grace?: "7d" }` (max 7d, default 7d). Returns 201 with the replacement’s `secret`; the old key becomes `expiring`.

Create

curl https://api.redbark.com/v2/api_keys \
  -H "Authorization: Bearer rbk_live_..." \
  -H "Redbark-Version: 2026-10-01.wattle" \
  -H "Idempotency-Key: create-ci-key-1" \
  -H "Content-Type: application/json" \
  -d '{ "name": "CI", "scopes": ["syncs:write", "data:read"], "allowed_ips": ["203.0.113.0/24"] }'

allowed_ips accepts IPv4 addresses or CIDRs and exact colon-hex IPv6 addresses (up to 20 entries). IPv6 CIDRs and IPv6 addresses with dotted IPv4 tails, such as ::ffff:192.0.2.1, are not supported.

IPv6 entries are normalised on write to lowercase, compressed form without leading zeros. Uppercase, expanded, and zero-padded colon-hex forms of the same address match equivalently.

Guides

Account

API keys

Connections

Consents

Accounts

Transactions

Holdings

Trades

Categories

Syncs

Sync runs

Rules

Destinations

Link sessions

Destination links

Institutions

Event destinations

Events

CLI

SimpleFIN

Webhooks

Retrieve the account

The api_key object

Endpoints

Create

​Retrieve the account

​The api_key object

​Endpoints

​Create

Retrieve the account

The api_key object

Endpoints

Create