Skip to main content

​
API Keys

All API requests require a Bearer token in the Authorization header. 
curl -H "Authorization: Bearer bzy_proj_abc123..." \
  https://bugzy.ai/api/v1/projects/{project-id}/executions

​
Key Types

TypePrefixScopeStatus
Project keybzy_proj_Single projectAvailable
Team keybzy_team_Selected team endpointsAvailable
Personal access tokenbzy_pat_All projects you have access toComing soon

​
Generating a Project Key

  1. Go to Dashboard → Project Settings → API Key
  2. Click Generate API Key
  3. Copy the key immediately — it’s only shown once
  4. The key prefix (e.g., bzy_proj_abc1...) is stored for identification
Generating a new key revokes the previous one. In-flight requests with the old key will receive 401.

​
Generating a Team Key

Go to Team Settings → API Keys. Team keys are required for /api/v1/teams/{team-id}/... endpoints. Team keys are currently limited to selected team-scoped configuration surfaces such as integrations, environments/env vars, and automations. Execution, test-run, bug-report, and onboarding APIs remain project-scoped. Project keys cannot call team endpoints, and team keys cannot call project endpoints.

​
Rate Limiting

All endpoints are rate-limited per API key. Current limits:
  • 60 requests per minute per key
Rate limit headers are included in every response:
HeaderDescription
X-RateLimit-LimitMaximum requests per window
X-RateLimit-RemainingRequests remaining in current window
X-RateLimit-ResetUnix timestamp when the window resets
When the limit is exceeded, the API returns 429 Too Many Requests.

​
Error Responses

All errors follow a consistent format: 
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  }
}

​
Error Codes

StatusCodeDescription
400VALIDATION_ERRORInvalid request body or parameters
401UNAUTHORIZEDMissing or invalid API key
404NOT_FOUNDResource not found (or not accessible)
429RATE_LIMITEDRate limit exceeded
500INTERNAL_ERRORInternal server error
Note: A 404 is returned for both non-existent resources and resources the API key doesn’t have access to (to avoid leaking existence).