Quickstart
Get an API key and read your first entry in five minutes.
In five minutes you will have an API key, confirm which user and account it belongs to, list your forms, and read the entries of one form.
Before you start
You need a user in your Tepez account. If your user has a password, create the key through the API (step 1, option A). If you sign in to Tepez with Google, create it in the API reference instead (option B). If you have no user yet, ask support (option C).
The examples use cURL, JavaScript (Node.js 18 or later, for the built-in fetch) and Python
with the requests package.
1. Get an API key
Option A: create the key through the API
First sign in with POST /auth/login to get a login token.
The examples read your password from the TEPEZ_PASSWORD environment variable, and the JavaScript
and Python ones read your email from TEPEZ_EMAIL, so the password stays out of your shell history
and your code:
curl -X POST https://api.tepez.co.il/v1.0/auth/login \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com", "password": "'"$TEPEZ_PASSWORD"'"}'{
"token": "<token>",
"user": {
"id": "<userId>",
"account": "<accountId>",
"email": "you@example.com",
"name": "Integration user",
"settings": { "locale": "he", "theme": "bs3" },
"hasPassword": true,
"lastLogin": "2026-09-30T14:18:08.423Z",
"createTime": "2026-08-16T12:47:45.105Z",
"modifyTime": "2026-08-16T12:47:45.105Z",
"changedAt": "2026-09-30T14:18:08.424Z"
}
}Put the token in the TEPEZ_TOKEN environment variable. Then create the key with
POST /api-keys: send the login token in the
Authorization header and an empty JSON body.
curl -X POST https://api.tepez.co.il/v1.0/api-keys \
-H "Authorization: $TEPEZ_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'{
"_id": "<apiKeyId>",
"account": "<accountId>",
"user": "<userId>",
"email": "you@example.com",
"createTime": "2026-09-30T14:18:09.057Z",
"modifyTime": "2026-09-30T14:18:09.057Z",
"token": "<apiKey>"
}The token is your API key. This response is the only time Tepez shows it, so store it in your
secret manager now. Keep the _id as well: you need it to revoke the key later.
Option B: create the key in the API reference
This works for any user, including one who signs in with Google:
- Open the API reference and sign in with your Tepez user, with Google or with a password.
- Open
POST /api-keys. - Click Try it out, then Execute. The API reference sends the request as your signed-in user.
- Copy the
tokenfrom the response body. It has the same shape as the response above.
Option C: ask support
If you can't use either option, email support to request an API key. Tell us which account and user the key is for.
Store the key
The rest of this page reads the key from the TEPEZ_API_KEY environment variable:
export TEPEZ_API_KEY="<apiKey>"2. Check who you are
GET /me returns the user the key belongs to. Its account is the
account every other request works in.
curl https://api.tepez.co.il/v1.0/me \
-H "x-api-key: $TEPEZ_API_KEY"{
"id": "<userId>",
"account": "<accountId>",
"email": "you@example.com",
"name": "Integration user",
"settings": { "locale": "he", "theme": "bs3" },
"hasPassword": true,
"lastLogin": "2026-09-02T07:57:06.111Z",
"createTime": "2026-08-16T12:47:45.105Z",
"modifyTime": "2026-08-16T12:47:45.105Z",
"changedAt": "2026-09-02T07:57:06.112Z"
}3. List your forms
GET /form lists the forms of your account. A full form
definition is large, so ask only for the fields you need with fields, a JSON array. List id
explicitly: fields drops every field you don't name, id included.
curl -G https://api.tepez.co.il/v1.0/form \
-H "x-api-key: $TEPEZ_API_KEY" \
--data-urlencode 'fields=["id","name"]' \
--data-urlencode 'limit=10'{
"data": [
{ "id": "<formId>", "name": "Contact details" }
]
}List responses wrap their items in data. When there are more results than limit, the response
carries a Link header with the URL of the next page (rel=next). No Link header means you
have the last page.
4. List a form's entries
GET /entry lists entries. Always filter by form with query,
a JSON object. Copy a form id from step 3 into it.
curl -G https://api.tepez.co.il/v1.0/entry \
-H "x-api-key: $TEPEZ_API_KEY" \
--data-urlencode 'query={"form":"<formId>"}' \
--data-urlencode 'fields=["id","status","changedAt"]' \
--data-urlencode 'limit=5'{
"data": [
{
"id": "<entryId>",
"status": "submitted",
"changedAt": "2026-09-30T14:16:43.517Z"
},
{
"id": "<entryId2>",
"status": "saved",
"changedAt": "2026-09-30T14:16:44.306Z"
}
]
}A submitted entry is final. A saved entry is a draft the person can still continue.
5. Read one entry
GET /entry/{entryId} returns the whole entry. The
values the person filled in are under data, keyed by the names of the form's fields.
curl https://api.tepez.co.il/v1.0/entry/<entryId> \
-H "x-api-key: $TEPEZ_API_KEY"{
"id": "<entryId>",
"form": "<formId>",
"account": "<accountId>",
"status": "submitted",
"idx": 1,
"submitIdx": 1,
"data": {
"fullName": "Dana Levi",
"email": "dana@example.com"
},
"actions": [
{
"id": "<actionId>",
"type": "submit",
"time": "2026-09-30T14:16:43.494Z",
"ip": "<ip>",
"userAgent": "curl/8.16.0",
"user": "<userId>"
}
],
"sentEmails": [],
"archivedRenders": [],
"deleted": false,
"createTime": "2026-09-30T14:16:43.496Z",
"modifyTime": "2026-09-30T14:16:43.496Z",
"changedAt": "2026-09-30T14:16:43.517Z",
"submitTime": "2026-09-30T14:16:43.494Z",
"cloneUrl": "https://app.tepez.co.il/c/<entryId>/",
"editUrl": "https://app.tepez.co.il/admin/entries/<formId>/<entryId>/"
}sentEmails lists the emails the form sent for this entry. When the form is set up to keep a PDF
of each submission, archivedRenders lists that PDF with a download URL.
Troubleshooting
| Response | Cause and fix |
|---|---|
401 Missing authentication | The request had no credential. Send the key in the x-api-key header, not as a query string parameter. |
401 Invalid API key | The key is mistyped, cut short, or was revoked. Copy the whole key again, or create a new one. |
401 Wrong username/ password | The email or password sent to POST /auth/login is wrong, or the user has no password (signs in with Google only). Use option B in step 1. |
403 You have insufficient permissions to perform the action. | The object belongs to an account other than the key's. A key reaches only the account of the user who created it. |
404 Could not find an entry with ID … | No object has that id. Check you used a form id in a /form URL and an entry id in an /entry URL. |
400 "query" must be of type object | query isn't valid JSON. Quote the keys: {"form":"<formId>"}. |
200 with empty items ({"data":[{},{}]}) | fields was sent as a comma list. Send a JSON array: fields=["id","name"], not fields=id,name. |
Errors explains the error format and lists more messages.
Every response carries an x-tepez-request-id header. Quote it when you contact us, so we can
find your request in our logs.
Next steps
Authentication
How keys work, how to revoke them, and how to keep them safe.
Prefill a form
Open a form with values your system already knows.
Get notified
React in your system when someone submits a form.
Query and export entries
Filter a form's entries, page through them, and export them to CSV, Excel or PDF.
Download PDFs and files
Download entries' PDFs and uploaded files, and keep a local copy of everything a form collects.
API reference
Every endpoint, parameter and response schema.
Question about this page? Email support@tepez.co.il