# Read your data with the Data API

> Make a token so a reporting tool or a script can read your activities, usage and totals.

The Data API lets a reporting tool, a dashboard or a script read your organisation's Taktyl data. It only reads: nothing can be created, changed or deleted through it. It is on the Department and Institution plans.

## What it can read

- **Read plan and usage**: your plan, the features it has, and how much of each limit you have used, with a month by month count of versions published and attempts started.
- **Read activities**: your workspaces, the activities in them (title, status, when they were published) and the interactions each one runs. Never the questions, the answers or a student's work.
- **Read student totals**: for each activity, how many attempts there were, how many students started and finished, and the average mark. Never a name, an email address or one student's answers. A total counted from fewer than five students is not given at all.

## Make a token

1. Go to **Organisation › Integrations** and open **Data API**.
2. Press **Make a token**.
3. Give it a name, such as the tool that will use it. Make one token for each tool, so you can revoke one without stopping the others.
4. Tick what it can read. Untick anything the tool does not need.
5. Choose when it expires: 30, 90 or 180 days, or a year.
6. Press **Make the token**, then **Copy** it straight away. Taktyl shows it only once.

Paste the token into your tool. It goes in an `Authorization: Bearer` header on every request, to the **Base address** shown on the page. Each token can make 120 requests a minute.

## Rotate or revoke

Each token's row shows what it can read, when it was last used and when it expires. Open the row's menu:

- **Rotate** makes a new token with the same name and the same scopes. The old one stops working at once, so paste the new one wherever the old one was. Rotate a token before it expires to keep reading.
- **Revoke** stops it for good. Anything using it is refused from its next request.

A token also stops working when your organisation is switched off or closed, or when your plan no longer includes the Data API.

## The API reference

The page links to **The API reference (OpenAPI)**, which lists every address, what each one returns and the errors it can answer. Many tools can read it to set themselves up.

Anyone on your staff can also make a key of their own on **Account › Integrations**. A personal key reads only what that person can.