Management keys

Management keys (vibe_live_) are not tied to a single Bitrix24 account and are intended for automating administration: viewing your Bitrix24 accounts and managing your API keys on them. A management key is created in your Vibecode account, in the Management Keys section.

Scopes: vibe:mgmt:keys, vibe:mgmt:portals, vibe:mgmt:feedback | Base URL: https://vibecode.bitrix24.com/v1 | Authorization: X-Api-Key

Difference from Bitrix24 account keys

Management key scopes

Each management key is created with one or more scopes. Without the required scope, the endpoint returns 403 MANAGEMENT_SCOPE_REQUIRED.

Scope	Grants	Who can grant it
Scopevibe:mgmt:keys	Grants/v1/keys — list, create, update, delete and rotate your own keys	Who can grant itAny user
Scopevibe:mgmt:portals	Grants/v1/portals — list your Bitrix24 accounts	Who can grant itAny user
Scopevibe:mgmt:feedback	Grants/v1/feedback — tickets of all Bitrix24 accounts on the platform	Who can grant itVibecode platform administrator only

Keys with the vibe:mgmt:keys and vibe:mgmt:portals scopes see only the owner's resources: their Bitrix24 accounts and their keys on them.

The vibe:mgmt:feedback scope grants access to tickets of all Bitrix24 accounts, so it is granted only to a platform administrator. A regular user's request to create a key with this scope receives 403 PLATFORM_ADMIN_SCOPE_REQUIRED. A key whose owner is no longer a platform administrator receives 403 FEEDBACK_PLATFORM_ADMIN_REQUIRED on /v1/feedback.

The endpoints /v1/me, /v1/guide and /v1/openapi.json are available to any management key without a separate scope.

Owner account state

A management key acts on behalf of its owner, so the state of the owner's account is checked on every endpoint — on reads and on writes alike. This check runs before the scope check, so OWNER_DELETED, OWNER_BLOCKED and ACCOUNT_PENDING_ERASURE arrive even where the key lacks the required scope.

HTTP	Code	When returned
HTTP403	CodeOWNER_DELETED	When returnedThe key owner's account has been deleted
HTTP403	CodeOWNER_BLOCKED	When returnedThe key owner's account has been blocked
HTTP503	CodeACCOUNT_PENDING_ERASURE	When returnedThe owner requested erasure of their data — the key is frozen until the cancellation window ends. The response carries a Retry-After: 3600 header. Cancelling the request restores the key; no rotation is needed
HTTP409	CodeB24_USER_DELETED	When returnedThe key owner is no longer an active employee of the target Bitrix24 account — no key can be issued for them. Checked on issuance (POST /v1/keys) and rotation (POST /v1/keys/:id/rotate), the operations that give a new key an owner. Different from NOT_PORTAL_MEMBER: that one arrives when the owner is not a member of the account at all, this one when the record exists but the employee has been deleted or deactivated

The freeze covers all operations, including issuing, rotating and deleting API keys.

Management key self-description

GET /v1/me with a management key responds with data.type: "management" and carries no Bitrix24 account data. Instead, the response contains management-specific blocks:

Field	Description
Fielddata.scopes	DescriptionScopes of the management key
Fielddata.portals[]	DescriptionThe owner's Bitrix24 accounts: id, domain, status, role and appKeyCount — the number of the owner's keys on the account
Fielddata.totalAppKeys	DescriptionSum of appKeyCount across all accounts
Fielddata.capabilities	Descriptionendpoints — endpoints available to the management key, scopesRequired — which scope grants which path, reference — a link to this page
Fielddata.quickstart	DescriptionFour steps from the account list to working with the created API key
Fielddata.feedback	DescriptionReference of feedback ticket endpoints, statuses, categories and filters. The key can use them only with the vibe:mgmt:feedback scope
Fielddata.docs	DescriptionA link to this page

Typical workflow

1. Get your Bitrix24 accounts and their IDs: GET /v1/portals.
2. View your keys on the required account: GET /v1/keys?portalId=<id>.
3. Create an API key with the required scopes: POST /v1/keys. The key value is returned in the response only once.
4. Work with Bitrix24 data using the obtained API key (vibe_api_…).

Limitations

• A management key cannot access Bitrix24 entity endpoints (/v1/deals, /v1/tasks and others): such a request receives 403 MANAGEMENT_KEY_NO_ENTITY_ACCESS. Working with data requires an API key (vibe_api_) or an authorization key (vibe_app_).
• The /v1/keys and /v1/portals endpoints accept only a management key. A Bitrix24 account key receives 401 WRONG_KEY_TYPE on them.

Endpoint reference

Method	Path	Description
MethodGET	Path/v1/portals	DescriptionList of the owner's Bitrix24 accounts
MethodGET	Path/v1/keys	DescriptionList of the owner's API keys on a Bitrix24 account
MethodPOST	Path/v1/keys	DescriptionCreate an API key
MethodGET	Path/v1/keys/:id	DescriptionGet an API key
MethodPATCH	Path/v1/keys/:id	DescriptionUpdate an API key
MethodDELETE	Path/v1/keys/:id	DescriptionDelete an API key
MethodPOST	Path/v1/keys/:id/rotate	DescriptionRotate an API key
MethodGET	Path/v1/me	DescriptionKey self-description
MethodGET	Path/v1/guide	DescriptionAPI reference for the model
MethodGET	Path/v1/openapi.json	DescriptionOpenAPI specification
MethodGET	Path/v1/feedback	DescriptionList of tickets of all Bitrix24 accounts. Only with the vibe:mgmt:feedback scope
MethodGET	Path/v1/feedback/:id	DescriptionGet a ticket. Only with the vibe:mgmt:feedback scope
MethodPATCH	Path/v1/feedback/:id	DescriptionChange a ticket status. Only with the vibe:mgmt:feedback scope
MethodPOST	Path/v1/feedback/:id/comments	DescriptionReply to a ticket. Only with the vibe:mgmt:feedback scope

See also

• Keys and authorization
• Permissions to create keys and applications
• Scopes
• Error codes
• Recovering access to a bot