Docs

Quickstart

Get an API key and read your first entry in five minutes.

In five minutes you will have an API key, confirm which user and account it belongs to, list your forms, and read the entries of one form.

Before you start

You need a user in your Tepez account. If your user has a password, create the key through the API (step 1, option A). If you sign in to Tepez with Google, create it in the API reference instead (option B). If you have no user yet, ask support (option C).

The examples use cURL, JavaScript (Node.js 18 or later, for the built-in fetch) and Python with the requests package.

1. Get an API key

Option A: create the key through the API

First sign in with POST /auth/login to get a login token. The examples read your password from the TEPEZ_PASSWORD environment variable, and the JavaScript and Python ones read your email from TEPEZ_EMAIL, so the password stays out of your shell history and your code:

curl -X POST https://api.tepez.co.il/v1.0/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "'"$TEPEZ_PASSWORD"'"}'
{
  "token": "<token>",
  "user": {
    "id": "<userId>",
    "account": "<accountId>",
    "email": "you@example.com",
    "name": "Integration user",
    "settings": { "locale": "he", "theme": "bs3" },
    "hasPassword": true,
    "lastLogin": "2026-09-30T14:18:08.423Z",
    "createTime": "2026-08-16T12:47:45.105Z",
    "modifyTime": "2026-08-16T12:47:45.105Z",
    "changedAt": "2026-09-30T14:18:08.424Z"
  }
}

Put the token in the TEPEZ_TOKEN environment variable. Then create the key with POST /api-keys: send the login token in the Authorization header and an empty JSON body.

curl -X POST https://api.tepez.co.il/v1.0/api-keys \
  -H "Authorization: $TEPEZ_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
{
  "_id": "<apiKeyId>",
  "account": "<accountId>",
  "user": "<userId>",
  "email": "you@example.com",
  "createTime": "2026-09-30T14:18:09.057Z",
  "modifyTime": "2026-09-30T14:18:09.057Z",
  "token": "<apiKey>"
}

The token is your API key. This response is the only time Tepez shows it, so store it in your secret manager now. Keep the _id as well: you need it to revoke the key later.

Option B: create the key in the API reference

This works for any user, including one who signs in with Google:

  1. Open the API reference and sign in with your Tepez user, with Google or with a password.
  2. Open POST /api-keys.
  3. Click Try it out, then Execute. The API reference sends the request as your signed-in user.
  4. Copy the token from the response body. It has the same shape as the response above.

Option C: ask support

If you can't use either option, email support to request an API key. Tell us which account and user the key is for.

Store the key

The rest of this page reads the key from the TEPEZ_API_KEY environment variable:

export TEPEZ_API_KEY="<apiKey>"

2. Check who you are

GET /me returns the user the key belongs to. Its account is the account every other request works in.

curl https://api.tepez.co.il/v1.0/me \
  -H "x-api-key: $TEPEZ_API_KEY"
{
  "id": "<userId>",
  "account": "<accountId>",
  "email": "you@example.com",
  "name": "Integration user",
  "settings": { "locale": "he", "theme": "bs3" },
  "hasPassword": true,
  "lastLogin": "2026-09-02T07:57:06.111Z",
  "createTime": "2026-08-16T12:47:45.105Z",
  "modifyTime": "2026-08-16T12:47:45.105Z",
  "changedAt": "2026-09-02T07:57:06.112Z"
}

3. List your forms

GET /form lists the forms of your account. A full form definition is large, so ask only for the fields you need with fields, a JSON array. List id explicitly: fields drops every field you don't name, id included.

curl -G https://api.tepez.co.il/v1.0/form \
  -H "x-api-key: $TEPEZ_API_KEY" \
  --data-urlencode 'fields=["id","name"]' \
  --data-urlencode 'limit=10'
{
  "data": [
    { "id": "<formId>", "name": "Contact details" }
  ]
}

List responses wrap their items in data. When there are more results than limit, the response carries a Link header with the URL of the next page (rel=next). No Link header means you have the last page.

4. List a form's entries

GET /entry lists entries. Always filter by form with query, a JSON object. Copy a form id from step 3 into it.

curl -G https://api.tepez.co.il/v1.0/entry \
  -H "x-api-key: $TEPEZ_API_KEY" \
  --data-urlencode 'query={"form":"<formId>"}' \
  --data-urlencode 'fields=["id","status","changedAt"]' \
  --data-urlencode 'limit=5'
{
  "data": [
    {
      "id": "<entryId>",
      "status": "submitted",
      "changedAt": "2026-09-30T14:16:43.517Z"
    },
    {
      "id": "<entryId2>",
      "status": "saved",
      "changedAt": "2026-09-30T14:16:44.306Z"
    }
  ]
}

A submitted entry is final. A saved entry is a draft the person can still continue.

5. Read one entry

GET /entry/{entryId} returns the whole entry. The values the person filled in are under data, keyed by the names of the form's fields.

curl https://api.tepez.co.il/v1.0/entry/<entryId> \
  -H "x-api-key: $TEPEZ_API_KEY"
{
  "id": "<entryId>",
  "form": "<formId>",
  "account": "<accountId>",
  "status": "submitted",
  "idx": 1,
  "submitIdx": 1,
  "data": {
    "fullName": "Dana Levi",
    "email": "dana@example.com"
  },
  "actions": [
    {
      "id": "<actionId>",
      "type": "submit",
      "time": "2026-09-30T14:16:43.494Z",
      "ip": "<ip>",
      "userAgent": "curl/8.16.0",
      "user": "<userId>"
    }
  ],
  "sentEmails": [],
  "archivedRenders": [],
  "deleted": false,
  "createTime": "2026-09-30T14:16:43.496Z",
  "modifyTime": "2026-09-30T14:16:43.496Z",
  "changedAt": "2026-09-30T14:16:43.517Z",
  "submitTime": "2026-09-30T14:16:43.494Z",
  "cloneUrl": "https://app.tepez.co.il/c/<entryId>/",
  "editUrl": "https://app.tepez.co.il/admin/entries/<formId>/<entryId>/"
}

sentEmails lists the emails the form sent for this entry. When the form is set up to keep a PDF of each submission, archivedRenders lists that PDF with a download URL.

Troubleshooting

ResponseCause and fix
401 Missing authenticationThe request had no credential. Send the key in the x-api-key header, not as a query string parameter.
401 Invalid API keyThe key is mistyped, cut short, or was revoked. Copy the whole key again, or create a new one.
401 Wrong username/ passwordThe email or password sent to POST /auth/login is wrong, or the user has no password (signs in with Google only). Use option B in step 1.
403 You have insufficient permissions to perform the action.The object belongs to an account other than the key's. A key reaches only the account of the user who created it.
404 Could not find an entry with ID …No object has that id. Check you used a form id in a /form URL and an entry id in an /entry URL.
400 "query" must be of type objectquery isn't valid JSON. Quote the keys: {"form":"<formId>"}.
200 with empty items ({"data":[{},{}]})fields was sent as a comma list. Send a JSON array: fields=["id","name"], not fields=id,name.

Errors explains the error format and lists more messages.

Every response carries an x-tepez-request-id header. Quote it when you contact us, so we can find your request in our logs.

Email support with the request id

Next steps

Question about this page? Email support@tepez.co.il

On this page