Skip to content
api
Integration

API & webhooks

Everything the console does, it does through the same REST API you can call. Authenticate with a workspace API key, trigger runs, read results, and subscribe to outbound webhooks for workspace events.

Read
6 min
Module
API

API keys

Keys are created under Settings → API keys and are scoped to a single workspace. The secret is shown once, at creation — only a hash is stored, so a lost key is rotated, not recovered. Each key carries a role, which means an integration can be given viewer rights rather than the rights of whoever created it.

Scope
One workspace, one role. A key cannot switch workspaces the way a user session can.
Rotation
Create the replacement, migrate callers, then revoke the old key. Revocation takes effect immediately.

Authenticating

Send the key as a bearer token. The API is versioned in the path; breaking changes get a new version rather than mutating the current one.

run a saved querybash
curl -X POST https://api.datarunner.app/api/v1/queries/{queryId}/run \
  -H "Authorization: Bearer dr_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "parameters": { "since": "2026-07-01" } }'
Treat a key like a database password. Anything holding it can read every result the key’s role can reach — put it in a secret store, never in a repository or a browser bundle.

What you can call

Rate limits
Per key and per endpoint class. A 429 carries a Retry-After header; respect it rather than tightening a retry loop.
Idempotency
Mutating calls accept an idempotency key so a retried request cannot double-apply.
AreaTypical use
QueriesRun a saved query and read the result set inline
Reports & schedulesTrigger a report out of band; pause or resume a schedule during a deploy
Runs & historyPoll the status of an execution, fetch logs
Monitors & hostsRead current status, open and resolve incidents
MetricsQuery the semantic layer for a defined number
Contacts & campaignsSync an audience from your own system
FormsSubmit from your own frontend instead of the embed

Outbound webhooks

Rather than polling, subscribe to events. Endpoints are registered under Settings → Webhooks with a list of event types; each delivery is signed so you can verify it came from DataRunner and not from someone who guessed your URL.

Delivery semantics
At least once, with exponential backoff on non-2xx. Deduplicate on the event id.
Verification
HMAC signature over the raw body plus a timestamp. Reject anything older than a few minutes to block replay.
EventFires when
run.completedAny execution finishes, successfully or not
run.failedAn execution ends in error
report.deliveredA delivery route completes
watch.triggeredA watch condition matched new rows
monitor.incident_openedA monitor crossed into failure
monitor.incident_resolvedA monitor recovered

Embedding

Dashboards and status pages can be embedded in your own product using a workspace embed key. The embedded view carries no session and is scoped to the single resource, so it cannot be walked back into the console.

Embed key
Signed per workspace, revocable. Rendered in an iframe with the console chrome removed.
Public share
A token URL for a single dashboard or status page, optionally with an expiry.