API overview

Overview

Hightouch exposes a REST API that lets users interact with resources like syncs, models, sources, and destinations. Though the REST API is open to all Hightouch users, we aim to build features so you don't need to rely on it directly. For example, Git Sync lets you manage workspace resources programmatically.

If you're looking to create a custom destination, it's best to use the HTTP Request destination as your base. If you find you still need to use the REST API directly, about your use case.

To start using the API, you must first create and retrieve an API key from your workspace.

Required permissions

To use Hightouch programmatically through the API, you must use an API key created by an Admin user of your Hightouch workspace. See Roles for more information.

API keys authenticate as the user who created them. If that user is deactivated or loses access to the workspace (for example, when they leave your organization or when your organization migrates to SSO and their pre-SSO user is removed), their API keys stop working. Before removing a key's creator, create replacement keys as another Admin user and update any integrations that use the old keys.

Create an API key

From the API keys tab on the Settings page, select Add API key.
Enter a descriptive Name for your key.
Copy your API key and store it in a safe location. The key will only be displayed once.
Click Create API key.

Once you have an API key, you can follow the API Reference documentation to start using the API.

Base URL and authentication

Send all API requests to the following base URL:

https://api.hightouch.com/api/v1

Append the endpoint path to the base URL. For example, to list syncs, send a request to https://api.hightouch.com/api/v1/syncs.

Authenticate each request by passing your API key as a bearer token in the Authorization header:

curl https://api.hightouch.com/api/v1/syncs \
  -H "Authorization: Bearer YOUR_API_KEY"

Revoke an API key

Your API key provides read/write access to sensitive Hightouch resources and should be kept secure. If you believe your API key may have been compromised, revoke it immediately.

From the API keys tab on the Settings page, select the API key or keys you want to revoke.
Select Delete selected.
In the modal that appears, select Delete.

Hightouch API Rate Limits

The Hightouch API rate limit is 200 requests per 10 seconds per workspace.

TLS requirements

The Hightouch REST API requires TLS 1.2 or later. The API rejects requests that use an older protocol version.

The API supports the following cipher suites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384

On July 10, 2026, Hightouch removes support for several weaker cipher suites. After that date, the API rejects requests that negotiate any of the following:

ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384

If your API client only supports the deprecated cipher suites, update it before July 10, 2026 to avoid failed requests. Most modern HTTP libraries and TLS stacks already negotiate one of the supported suites.

Tips and troubleshooting

If you encounter issues using the Hightouch API, check our status page or for assistance.

Common Errors

The following errors indicate an issue with your API key. Check that the creator of the API key is an Admin user of your Hightouch workspace and still has access to it. If the creator has been deactivated or removed, for example after an SSO migration, the key no longer works and an active Admin user must create a replacement.

{
  "message": "Authentication error",
  "details": "No user found"
}

{
  "message": "Authentication error",
  "details": "Workspace is invalid"
}