Our Platform. Your Vision.

Search

Creating an API Key

API keys allow external systems to connect to the Redpoint HQ Admin API for your organization.

Our GraphQL API reference documentation is linked here.
 

Before You Start

You need staff permission to Manage API Keys.
 

Create an API Key

  1. Go to the Manage (Menu) > Organization and Facility Settings.
  2. Open API Keys.
  3. Select Add API Key.
  4. On the General tab, enter:
    • Name: A recognizable name for the integration or system using the key.
    • Description: Optional internal notes about what the key is for.
  5. Use Show API Key to reveal the generated key.
  6. Copy the API key and store it securely.
  7. Configure the permission tabs for what this key should be allowed to do.
  8. Save the API key.

Treat the API key like a password. Anyone who has it can use the API permissions assigned to that key.
 

API Key Permission Sections

Query Permissions

Controls which top-level API queries the key can run.
Queries are used to retrieve information from Redpoint HQ, such as customers, facilities, products, reports, or other available API data. If a query is not enabled, the API key cannot request that root query.
Query permissions may also be needed when a mutation response includes a query object.
 

Mutation Permissions

Controls which API actions the key can perform.
Mutations are operations that create or change data, such as creating a customer, updating a customer, adding a tag, or creating a check-in. Only enable the mutations the integration actually needs.
 

Node Permissions

Controls whether the key can look up records by global ID using the API’s node(id: ...) lookup.
This does not replace field permissions. It only controls whether the key may retrieve that type of object through the generic node lookup.
 

Type Permissions

Controls which fields the key can read on each API object type.
For example, a key may be allowed to access the Customer type, but only certain customer fields such as name or barcode. Use # All Fields only when the integration should be able to read every exposed field for that type.
 

Find Your Organization Identifier

Your organization identifier is in your Redpoint HQ URL.
If you are using a facility-specific URL, it may look like this:
 

https://examplegym-abc.rphq.com

In that case:

  • examplegym is your organization identifier
  • abc is the facility code

For API requests, use only the organization identifier in the API URL:
 

https://examplegym.rphq.com/api/graphql

Do not include the facility code in the API hostname. If an API request needs a facility, send the facility code separately in the facility header:
 

X-Redpoint-Hq-Facility: ABC

 

Example API Request

Replace YOUR_API_KEY with your API key and examplegym with your organization identifier.
 

curl -i \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'X-Redpoint-Hq-Facility: ABC' \
  -X POST \
  -d '{"query": "query { ping }"}' \
  https://examplegym.rphq.com/api/graphql

 

Troubleshooting

If an API request fails, check the following:

  • The API key was copied correctly.
  • The request uses the organization URL, not the facility-specific URL.
  • The required Query, Mutation, Node, and Type permissions are enabled.
  • Facility-specific requests include the X-Redpoint-Hq-Facility header.
  • The facility code is correct.

Every API response includes a Request-Id header. If you contact Redpoint HQ support, include that request ID so support can help investigate.