FAQ

How do I get an API key?

A brand admin creates one in VYG under Settings → API Keys (vyg_… VYG API keys) or Settings → Data API Keys (vyg_ba_… conversations and providers keys). See API keys.

Why can't my API key call this operation?

Either the key does not carry a scope the operation needs, or no API key can call the operation at all. Campaign changes, discounts, segment changes, Shopify, Klaviyo and key management need a sign-in (OAuth) token. The Scopes page shows which scopes a key can hold.

Why can't I use my API key to create, rotate or revoke keys?

Key management needs a sign-in token with the keys:manage scope, available to brand admins.

Why do I get a 404 for a record I expected to exist?

Check the record ID and the account used by your connection. See Account context.

Why does my list stop at 10,000 rows?

Commerce orders, subscriptions and customers at risk stop at row 10,000: the page that reaches it has next_cursor: null, and a cursor at or past row 10,000 returns 400. Narrow the request with the endpoint's filters (dates, status, customer) to reach older rows. See Pagination.

What does a list return?

Every list returns { data, next_cursor }. Pass next_cursor back as cursor for the next page; it is null on the last page and on lists that return everything at once. Single records are returned as the object itself, not wrapped in data. See Pagination.

A field I read before is missing. Where did it go?

On 2026-09-28 every request and response field became snake_case (for example total_spend), the offset parameter was replaced by cursor, and single records stopped being wrapped in data. No old names are kept. The migration guide has the full old and new tables.

A route I used before answers 404. Where did it go?

Campaign, stats and search routes were renamed on 2026-09-27 with no aliases. Campaigns are under /v1/campaigns (GET /v1/campaigns, GET /v1/campaigns/{campaign_id}, GET /v1/campaigns/compare) and performance stats are GET /v1/stats. The migration guide lists every renamed route, tool and scope.

Can I call the API from a browser?

The API answers the browser's CORS preflight, so requests from a web page work. Do not put an API key in browser code: anyone who loads the page can read it. Call the API from your server.

Do collect requests need a credential?

The browser ingest endpoint (POST https://cdp.vyg.app/cdp/ingest) takes no credential. The server-side events endpoint (POST https://cdp.vyg.app/cdp/events) needs a vyg_ API key. See Data collection.

Where did cdp.vyg.app, mcp.vyg.app and the Brand Data API host go?

API reads now use api.vyg.app. Data collection still uses cdp.vyg.app. See the migration guide.

Is there an SDK?

No. The API is plain HTTPS and JSON, and the OpenAPI document at https://api.vyg.app/v1/openapi.json can be used to generate a client.