Public API reference (REST, /v1)

Traqio's public API is a versioned REST API, under /v1, over the same reports as the console: ROAS by campaign, ad set and ad, daily ROAS, install cohorts, revenue, refused data, connector health and tracking links. The same operations are available as tools to Claude, Cursor and other MCP clients through the MCP server. Both are authenticated by one scoped API key.

Authentication#

Create a key in the console under Settings → API keys, tick its scopes, and send it as a bearer token. Keys start with tq_live_ and are shown once — Traqio stores only a hash and the key's visible prefix. A console login token is refused by the API, and an API key is refused by the console.

export TRAQIO_API_KEY=tq_live_…

# 1. Which apps do I have? Every report takes a productId.
curl -s "https://api.traqio.app/v1/products" -H "Authorization: Bearer $TRAQIO_API_KEY"

# 2. Which ads made money in September? (`to` is exclusive)
curl -s -G "https://api.traqio.app/v1/reports/roas" -H "Authorization: Bearer $TRAQIO_API_KEY" \
  -d productId=app_… -d from=2026-09-01 -d to=2026-10-01 -d level=ad

# 3. Is the spend pull healthy, or is every ROAS stale?
curl -s "https://api.traqio.app/v1/reports/connectors" -H "Authorization: Bearer $TRAQIO_API_KEY"

Scopes#

No scope implies another — links:write does not grant links:read — and a key can never do more than the role of the member who created it. Revoking a key takes effect at its next call.

Endpoints#

The complete machine-readable reference is unauthenticated, at https://api.traqio.app/v1/openapi.json (OpenAPI 3.1). It is generated from the same description the routes are tested against, so it cannot describe an endpoint that does not exist.

Conventions#

• Dates are YYYY-MM-DD in UTC. from is inclusive and to is exclusive: from=2026-09-01&to=2026-10-01 is September.
• Report routes take productId, from and to; store=ios|android is optional and both stores are combined without it.
• Money is never summed across currencies: each currency is its own row, and spend is in each ad account's billing currency.
• POST /v1/reports/sync-spend is safe to call twice: a day is overwritten, never doubled — which is also how a network's restatement of recent spend lands.

Creating a tracking link#

curl -s -X POST "https://api.traqio.app/v1/links" \
  -H "Authorization: Bearer $TRAQIO_API_KEY" -H "content-type: application/json" \
  -d '{
    "productId": "app_…",
    "label": "Meta / autumn / video B",
    "network": "meta",
    "campaignExtId": "1203…",
    "code": "autumn-b",
    "deepLink": "/offers/autumn"
  }'

See Tracking links for what each field does once the link is live.

Errors#

Errors are JSON, with a human-readable message.

Frequently asked questions#

Is the API included in every plan?

Yes. The API and the MCP server are not gated by plan: every account can create API keys.

Can an API key create other keys or change billing?

No. A key reads reports and, with the matching write scopes, triggers a spend pull, mints tracking links or erases a user's data on request. Managing keys, credentials, members or billing always needs a signed-in person.

What happens to a key when its creator leaves the team?

Nothing: a key belongs to the workspace, not to the person who created it, so an integration does not break when they leave. Revoke the keys you no longer want from the console; each shows when it was last used, and a revoked key is refused at its next call.

Will the API change under my integration?

Not within /v1. Additive changes — a new endpoint, a new field in a response — happen inside /v1; anything that could break a working integration gets /v2, and /v1 keeps answering.