Admin API: overview and authorization

The Admin API is the same API the panel runs on. An external request differs only in authorization: instead of logging in to the panel, you pass a token in the Api-Key header. Owners and admins can create and revoke tokens.

Base URL

All methods are available at:

https://panel.example.com/api/v1

Replace panel.example.com with your panel's domain. There is only one version in the path — v1.

On the tracking domain, the only open API addresses are the data intake endpoints, which do not need a token: /api/v1/postback, /api/v1/lead and /api/v1/lead-file. Send requests with a token to the panel domain.

During a backup, a restore from a backup and an update, any request to /api/ gets code 503 with the text Tracker maintenance in progress. This is plain text, not JSON. Retry the request later.

Creating a token

1. Open Settings → API («Настройки → API»).
2. In the API tokens («API-токены») block, click + Token («+ Токен»).
3. Fill in Name («Название»), for example, with the name of the integration. Length — up to 200 bytes: that is 200 Latin characters or 100 Cyrillic ones.
4. Choose Access («Доступ»): Summary reports («Сводные отчёты»), MCP · reports for AI («MCP · отчёты для AI») or Full access («Полный доступ»). The default is Summary reports.
5. Choose Expiration («Срок действия»): 7 days («7 дней»), 30 days («30 дней»), 90 days («90 дней») or 365 days («365 дней»). The default is 90 days.
6. Click Create («Создать»).
7. Copy the token from the “New token — copy it now, it will not be shown again:” («Новый токен — скопируйте сейчас, повторно его не показать:») block with the Copy («Копировать») button.

A token looks like trk_ followed by 40 characters: digits and letters from a to f. The full token is shown only once. Afterwards, the list shows the name, the first 12 characters of the token, the access type, the expiration, the creation date and the date of last use.

The token for the spend extension is created elsewhere: Settings → Spend («Настройки → Расходы»), the Connect profile («Подключить профиль») block, the Create key («Создать ключ») button. More on the Facebook spend extension page.

The API methods for listing, creating and revoking tokens are described on the Admin API: API tokens page, and working with the list in the panel on the API tokens page. You cannot create a new token with a request that carries the Api-Key header.

The Api-Key header

Pass the token in the Api-Key header of every request:

curl https://panel.example.com/api/v1/campaigns \
  -H "Api-Key: trk_0123456789abcdef0123456789abcdef01234567"

This request requires Full access. For a Summary reports token, check the connection with a report request:

curl -X POST https://panel.example.com/api/v1/reports \
  -H "Api-Key: trk_0123456789abcdef0123456789abcdef01234567" \
  -H "Content-Type: application/json" \
  -d '{"from":"2026-10-01T00:00:00Z","to":"2026-10-02T00:00:00Z","dimensions":["campaign"],"metrics":["clicks","leads"],"timezone":"UTC"}'

A successful response is code 200 and JSON. The report fields are described on the Admin API: reports page, and the general format of requests, responses and errors on the Request, response and error format page.

If a request has both Api-Key and Authorization, Api-Key is used. The MCP address has a different rule — see Address and headers.

For an invalid, revoked or expired token, the server responds with code 401:

{"code": "unauthorized", "message": "invalid api key"}

Who the token acts as

A request runs on behalf of the user who created the token, with that user's current role.

• The token works as long as its creator remains an owner or admin. More about roles on the Team and roles page.
• If the creator is deleted or given a role below admin, their tokens are deleted. Requests with them get 401.
• Access restrictions by section, campaign group and report field do not apply to requests with a token: they are not set for owners and admins.
• The time of the last request is shown in the token list, in the “used” («использован») line.

Access types

A token has one access type. In the API it is passed in the scopes field — an array with one value.

A request to a method outside the token's access gets code 403:

{"code": "token_scope", "message": "API token scope does not allow this action"}

What is unavailable even with full access

Two methods respond 403 with code token_scope when called with a token:

• creating a token — POST /api/v1/api-tokens. A new token is created in the panel: Settings → API;
• logging in as a user — POST /api/v1/users/{id}/impersonate. In the panel, this is the Log in as ↗ («Войти как ↗») button in Admin panel → Team («Админ-панель → Команда»). More on the Log in as a user page.

Listing tokens and revoking a token work with Full access.

Eight more methods work only in the panel, signed in as the installation owner. With a token they respond 403 with code forbidden:

• backups — GET and POST /api/v1/backups;
• updates — GET and POST /api/v1/updates;
• license activation — POST /api/v1/license/activate;
• IP2Proxy — GET and PUT /api/v1/ip2proxy, POST /api/v1/ip2proxy/update.

More on the Admin API: license, backups and updates page.

Summary reports access limits

A reports:read token builds only summary reports. Allowed fields:

• objects, in groupings and filters: campaign, stream, offer, lander, source, campaign_group;
• GEO and device, in groupings and filters: country, region, city, device, os, os_version, browser, browser_version, device_model, lang, connection, isp;
• flags, in groupings and filters: bot, unique, cloak, proxy, empty_referer;
• time, in groupings only: hour, day, week, month, year, dow, hour_of_day;
• address type, in filters only: ipv4, ipv6.

Filters also allow basic metrics, for example clicks or roi. The restriction does not apply to the list of metrics in the metrics field.

Groupings and filters by sub_id_1–sub_id_30, ip, user_agent, referer, click_id, subid, external_id, creative_id, keyword, ad_campaign_id, adset_name, ad_name are forbidden. The response to such a report is code 403:

{"code": "token_scope", "message": "report includes fields outside the aggregate report scope"}

Click logs, background exports and saved reports are not available to this token.

Extension spend access

A spend:write token is issued only on a paid license. On a trial license, creating the key and all /api/v1/spend methods respond with code 403:

{"code": "spend_paid_required", "message": "Расширение для расходов доступно после оплаты лицензии."}

The message means “the spend extension is available after the license is paid for”. The spend methods are described on the Admin API: spend page.

Expiration

• In the panel, the expiration is chosen from four values: 7, 30, 90 or 365 days.
• The expiration date must be no more than 365 days from the moment the token is created. Otherwise the server responds with code 422 and the message expires_at must be in the next 365 days.
• In the list, a valid token shows “Until” («До») and a date, and an expired one shows “Expired” («Истёк») and a date.
• After the expiration, requests get 401 with the message invalid api key. A token cannot be extended — create a new one.
• A token marked “No expiration · legacy token” («Без срока · старый токен») has no expiration set. It works until it is revoked.

To revoke a token, click the ✕ icon in its row and confirm the action. Revocation takes effect immediately.

Expired license

When the license is inactive, requests with a token get code 402:

{"code": "license_required", "message": "Доступ к трекеру закрыт до продления лицензии. Трафик и приём конверсий работают, исходящие события ожидают продления."}

The message means “access to the tracker is closed until the license is renewed; traffic and conversion intake keep working, outgoing events wait for the renewal”. The exception is GET /api/v1/license: with a Full access token it keeps returning the license state. An integration can use it to tell an inactive license from a failure.

Intake of postbacks and leads at /api/v1/postback, /api/v1/lead and /api/v1/lead-file does not stop. What else keeps working and what is closed is described on the License expiry page.

Access is checked before the license: a token that is not allowed to call a method gets 403, not 402.

Rate limits

There is no general limit on requests with a token. Individual methods are limited:

For the rate_limited and rate_limit codes, wait a minute and repeat the request. For the export_quota code, wait until active exports finish or delete the ones you do not need.

Calls from the browser

Send Admin API requests from your own server. The tracker returns the panel address in the Access-Control-Allow-Origin header, so a script on another site gets a CORS error in the browser.

The responses list the allowed methods — GET, POST, PUT, DELETE, OPTIONS — and headers — Authorization, Content-Type, Api-Key, MCP-Protocol-Version.

Audit log

The log at Logs → Audit log («Логи → Audit log») records requests with a valid token sent with the POST, PUT, PATCH and DELETE methods, including building a report through POST /api/v1/reports. GET requests are not recorded.

In the Context («Контекст») column, requests with a token show API, and actions from the panel show UI. The User («Пользователь») column shows the token creator's login and the beginning of the token in square brackets. This tells you which integration made the request.

How to read the log is described on the Audit log: user action log page.

Troubleshooting

invalid api key

The token was entered incorrectly, revoked or expired, or its creator was deleted or is no longer an owner or admin. Open Settings → API and compare the beginning of the token with the rows of the list. The token must be in the list with an “Until” date or marked “No expiration · legacy token”. If the token is not there or shows “Expired”, create a new one.

API token scope does not allow this action

The method is not covered by the token's access. Check the table in the Access types section and create a token with the access you need. You cannot change the access of an existing token.

Creating a token and logging in as a user return this response with any token. Do these actions in the panel.

missing bearer token

The request has no Api-Key header or its value is empty. Check the header name and the token value.

Access closed until license renewal («Доступ к трекеру закрыт до продления лицензии»)

The license is inactive: it has expired, been revoked or not been confirmed. How to renew is described on the Renewal and orders page. After the renewal, tokens whose expiration has not passed keep working.