---
title: entities.apiAccess
description: Read api access records with the apiAccess repository, and change them with the api access mutations. Same records as the REST ApiAccesses entity.
canonical: https://developers.coevera.com/reference/graphql/api-access/
section: graphql
verification: schema
generatedFrom: schema f155746 (2026-10-20)
publisher: Coevera
---

# entities.apiAccess

Read api access records with the apiAccess repository, and change them with the api access mutations. Same records as the REST ApiAccesses entity.

REST: [ApiAccesses](https://developers.coevera.com/reference/rest/api-accesses.md).

## Queries

- `getById(entityId: ID!): ApiAccessEntity` Returns the record with the given id, or null when there is none. Deleted records are returned as well.
- `getByIds(entityIds: [ID!]!): [ApiAccessEntity!]!` Returns the records with the given ids; ids without a record are left out. Deleted records are returned as well.
- `getAll(limit: Int, offset: Int, filter: ApiAccessFilterInput, orderBy: [ApiAccessOrderByInput!], includeDeleted: Boolean): [ApiAccessEntity!]!` Returns the records that match the filter, paged with limit and offset.
- `getByCriteria(filter: ApiAccessFilterInput, orderBy: [ApiAccessOrderByInput!], includeDeleted: Boolean, before: String, after: String, first: Int, last: Int): ApiAccessEntityConnection` Returns the records that match the filter as a cursor-paginated connection.
- `getChangedFieldsSinceRevision(id: UUID!, revision: Int!): [UUID!]!` Returns the ids of the fields of a record that changed after the given revision. Returns an empty list for entities without change tracking.
- `getAllForAdmin(limit: Int, offset: Int, filter: ApiAccessFilterInput, orderBy: [ApiAccessOrderByInput!], includeDeleted: Boolean): [ApiAccessEntity!]!` Returns API accesses of the space for administration, leaving out accesses of hidden applications.

## Mutations

- `copyApiAccess(input: CopyApiAccessInput!): CopyApiAccessPayload` Copy a record. GraphQL only.

## Types

### ApiAccessEntity (object)

API credentials that an integration uses to access the space, with the parts of the API they may read or write.

- `isDeleteProtected: Boolean!` True when the record is protected against deletion because it must always exist in the space. Deleting a record that is not protected can still fail on other checks. Read-only.
- `id: ID!` Unique identifier of entity. Must match with Application id.
- `isDeleted: Boolean` Specifies if the entity is considered deleted.
- `modified: DateTime` Last modification time.
- `created: DateTime` Creation time.
- `email: String` Contact email associated with this API access. Used for credential change notifications.
- `isActive: Boolean` Whether this API access can authenticate. Set to false to disable the credentials without deleting the record; existing tokens stop working immediately.
- `lastUsed: DateTime` Timestamp of the most recent successful authentication using this API access. Updated automatically on each use; empty for credentials that have never been used.
- `permissions: ApiAccessPermissions` Per-section access permissions (records, administration, misc) granted to this API access. Determines which entities and operations the credentials can read or write.
- `type: ApiAccessTypeEnum!` Authentication type of this API access (e.g. standard API key vs. OAuth client). Set automatically on create and cannot be changed.
- `name: String` Name for the api access.
- `username: String` Formerly API Access.
- `plainPassword: String` Formerly API Password. Only available during create or for migrated legacy access. Otherwise, it is null.
- `instancePermissions: [EntityPermsEnum!]! (1 args)` Permissions the current user has on this record, out of the requested ones.

### ApiAccessEntityConnection (object)

Paginated list of ApiAccess records.

- `pageInfo: PageInfo!` Pagination data for this connection.
- `edges: [ApiAccessEntityEdge]!` Contains the nodes in this connection.
- `totalCount: Int` Total number of items in the connection.

### ApiAccessEntityEdge (object)

A Relay edge containing a `ApiAccessEntity` and its cursor.

- `node: ApiAccessEntity` The item at the end of the edge
- `cursor: String!` A cursor for use in pagination

### ApiAccessFilterInput (input)

Filter conditions for ApiAccess records. Conditions on different fields are combined with AND; use OR, AND and NOT for other combinations.

- `OR: [ApiAccessFilterInput!]` Matches records that meet at least one of the listed filters.
- `AND: [ApiAccessFilterInput!]` Matches records that meet all of the listed filters.
- `NOT: ApiAccessFilterInput` Matches records that do not meet this filter.
- `globalSearchQuery: String` Search term matched against the fields that the global search covers for this entity.
- `id: EntityFilterStringField` Unique identifier of entity. Must match with Application id.
- `isDeleted: Boolean` Specifies if the entity is considered deleted.
- `modified: EntityFilterDateTimeField` Last modification time.
- `created: EntityFilterDateTimeField` Creation time.
- `email: EntityFilterStringField` Contact email associated with this API access. Used for credential change notifications.
- `isActive: Boolean` Whether this API access can authenticate. Set to false to disable the credentials without deleting the record; existing tokens stop working immediately.
- `lastUsed: EntityFilterDateTimeField` Timestamp of the most recent successful authentication using this API access. Updated automatically on each use; empty for credentials that have never been used.
- `type: ApiAccessTypeEnumFilterInput` Authentication type of this API access (e.g. standard API key vs. OAuth client). Set automatically on create and cannot be changed.

### ApiAccessOrderByInput (input)

Sorting of ApiAccess records. Set exactly one field in each item; list several items to sort by more fields, in order of priority.

- `id: OrderByEnum` Unique identifier of entity. Must match with Application id.
- `isDeleted: OrderByEnum` Specifies if the entity is considered deleted.
- `modified: OrderByEnum` Last modification time.
- `created: OrderByEnum` Creation time.
- `email: OrderByEnum` Contact email associated with this API access. Used for credential change notifications.
- `isActive: OrderByEnum` Whether this API access can authenticate. Set to false to disable the credentials without deleting the record; existing tokens stop working immediately.
- `lastUsed: OrderByEnum` Timestamp of the most recent successful authentication using this API access. Updated automatically on each use; empty for credentials that have never been used.
- `type: OrderByEnum` Authentication type of this API access (e.g. standard API key vs. OAuth client). Set automatically on create and cannot be changed.

### ApiAccessTypeEnumFilterInput (input)

Conditions on an enumeration field. Several conditions given together must all match.

- `eq: [ApiAccessTypeEnum!]` Matches any of the listed values.
- `NOT: ApiAccessTypeEnumFilterInput` Matches values that do not meet this condition.

### CopyApiAccessInput (input)

Parameters of the copyApiAccess mutation.

- `id: ID!` Identifier of the ApiAccessEntity to perform the action on.
- `clientMutationId: String` Optional client-supplied identifier passed on a mutation input and echoed back unchanged on its payload, so a client can correlate the response with its request (Relay convention).

### CopyApiAccessPayload (object)

Result of the copyApiAccess mutation.

- `result: ApiAccessEntity` The new API access.
- `clientMutationId: String` Optional client-supplied identifier passed on a mutation input and echoed back unchanged on its payload, so a client can correlate the response with its request (Relay convention).

### ApiAccessPermissionAdministrationTab (object)

Access levels an API access grants to administration areas, such as users, pipelines, fields and products.

- `unitsAndRoles: ApiPermissionEnum!` Access level to users, sales units and user roles, including the pipelines and record types each role may use.
- `pipelines: ApiPermissionEnum!` Access level to pipelines, lead processes, their steps and step checklists.
- `currencies: ApiPermissionEnum!` Access level to currencies and exchange rate lists.
- `productsAndPrices: ApiPermissionEnum!` Access level to products, product categories and price lists.
- `commonList: ApiPermissionEnum!` Access level to the common lists: account hierarchy, account and contact relation types, account roles, sales roles and tags.
- `fieldsAndForms: ApiPermissionEnum!` Access level to fields, forms, dropdown options, translations and record types, including online form types and health and scoring settings.
- `settings: ApiPermissionEnum!` Access level to the space settings and the company email addresses and phone numbers.
- `automationHub: ApiPermissionEnum!` Access level to the Automation Hub apps and their categories, and to the apps enabled in the space. These are read-only, so Write grants Read.
- `security: ApiPermissionEnum!` Access level to the audit log.

### ApiAccessPermissionMiscTab (object)

Access levels an API access grants to reports, webhooks, documents and the remaining areas.

- `reports: ApiPermissionEnum!` Access level to reports, report folders, report schedules and forecasts.
- `webhooks: ApiPermissionEnum!` Access level to webhooks and their events.
- `data: ApiPermissionEnum!` Access level for the Data area. Kept with the other levels, but no part of the API currently depends on it.
- `documents: ApiPermissionEnum!` Access level to files, document folders and document templates.
- `others: ApiPermissionEnum!` Access level to the remaining areas: automation processes, approvals, email sequences, online form submissions, notes, targets, saved screen views, solutions and change and event logs.

### ApiAccessPermissionRecordsTab (object)

Access levels an API access grants to records, such as accounts, opportunities and custom entities.

- `accounts: ApiPermissionEnum!` Access level to accounts, with their relations, sharing and statistics.
- `contacts: ApiPermissionEnum!` Access level to contacts, with their account relations, sharing and statistics.
- `leads: ApiPermissionEnum!` Access level to leads.
- `opportunities: ApiPermissionEnum!` Access level to opportunities, with their product lines, revenue schedules and recurrence, and to quotes.
- `tasks: ApiPermissionEnum!` Access level to tasks, with their reminders and recurrence.
- `appointments: ApiPermissionEnum!` Access level to appointments, with their invitees and reminders, and to appointment schedules.
- `emails: ApiPermissionEnum!` Access level to emails, email labels, email templates and unsubscribed email addresses.
- `messages: ApiPermissionEnum!` Access level to memos and their comments, chat conversations and text messages.
- `projects: ApiPermissionEnum!` Access level to projects and their objectives.
- `customEntities: [CustomEntityApiAccessPermission!]!` Access level to the records of each custom entity of the space; a custom entity without its own entry has Write access.

### ApiAccessPermissions (object)

Access levels an API access grants, grouped into records, administration and other areas.

- `records: ApiAccessPermissionRecordsTab!` Access levels to records, such as accounts, opportunities and custom entities.
- `administration: ApiAccessPermissionAdministrationTab!` Access levels to administration areas, such as users and units, pipelines, fields and products.
- `misc: ApiAccessPermissionMiscTab!` Access levels to reports, webhooks, documents and the remaining areas.

### ApiAccessTypeEnum (enum)

How an API access authenticates.

- `Basic` Authenticates with an access key and secret sent as HTTP Basic credentials.
- `OAuth` Authenticates as an OAuth 2 application.

### ApiPermissionEnum (enum)

Level of access an API access grants to an area of the space.

- `Write` Records in the area can be read and changed.
- `Read` Records in the area can be read but not changed.
- `Disabled` The area is not accessible.

### CustomEntityApiAccessPermission (object)

Access level an API access grants to the records of one custom entity.

- `access: ApiPermissionEnum!` Access level to the records of the custom entity.
- `entityApiName: String!` API name of the custom entity.

Types several repositories share, such as `PageInfo` and the filter fields, are in the [types index](https://developers.coevera.com/reference/graphql/types.md). The [SDL](https://developers.coevera.com/graphql/schema.graphql) has the whole schema in one file.

## Example

```graphql
query FirstApiAccesss {
  entities {
    apiAccess {
      getByCriteria(first: 3, orderBy: [{ modified: Desc }]) {
        totalCount
        edges { node { id name modified } }
      }
    }
  }
}
```

```bash
curl 'https://{region}.api.coevera.com/api/v100/app/space/{space_id}/graphql/public' \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '{"query":"query FirstApiAccesss { entities { apiAccess { getByCriteria(first: 3, orderBy: [{ modified: Desc }]) { totalCount edges { node { id name modified } } } } } }"}'
```