Pulling data with a script

A script can download the same files as the Export tab without a browser.

Making a token

1. Open Configure › API tokens and computers (or Your account in the account menu).
2. Choose Create token, give it a name, and copy the token. It is shown only once; the server keeps only a hash of it.

Anyone who may read data (reviewers and up) can make their own tokens, up to 20 at a time. A data collector has none, and an external client never has one.

Using it

Send the token with every request as a header:

Authorization: Bearer <token>

For example:

The attachment links in an export also open with the token. A token only reads: every other request with it is refused.

curl -H "Authorization: Bearer $JORIPO_TOKEN" \
  "https://<your server>/api/projects/<workspace id>/reports/surveycto_wide.csv?form=hh_survey" \
  -o hh_survey_WIDE.csv

What a token sees

A token is its person, checked at every use: their organisation, the workspaces they see (restricted workspaces apply), and their identity access. It is masked exactly as their own downloads would be.

What stops a token

• Revoke on the tokens page;
• an owner or the server's maintainer setting that person a new password;
• the person changing their own password, unless they untick Also revoke my API tokens;
• the person being deactivated or made a data collector, or the organisation being suspended.

Every use counts as an API call of your organisation. Making and revoking a token, and each token's first use of the day, are recorded in the activity log.

The API reference

Signed in as an owner, the console links to the full REST API reference at /api/docs. It is not public, because it names every address that serves respondent data.