CommCare HQ APIs

This section is for you if...

- You are a programmer 

- You are looking to write code that interacts directly with CommCare HQ through its APIs

If you are not a programmer and are looking to integrate CommCare with other platforms we recommend looking at our Zapier Integration.

Things we take for granted...

- You should have a familiarity with HTTP conventions, such as GET and POST and url parameters

- To follow the examples, you should be familiar with the standard command line tool curl. Here's the manual: https://curl.haxx.se/docs/

- Character encoding is UTF-8. Dates should be compliant ISO 8601. (In some cases we're still using RFC 3339, but we're moving towards ISO 8601.) Guids should be generated in accordance with RFC 4122.

Authentication

Read the Authentication page for information about how to authenticate your requests with CommCare HQ.

API Explorer

A tool for browsing the read-only CommCare APIs can be found at https://commcare-api-explorer.dimagi.com/. This tool will connect directly to your CommCare account using Oauth2 so you don't have to worry about handling authentication.

Documented APIs and use of Standards

In the following, [version] should always be replaced with one of v0.5, v0.4. These documents only describe the latest version - some prior versions remain available only to support backwards compatibility with deployed systems, not for general use.

The latest version is v0.5.

In addition to the permissions listed, all APIs also require the "API Access" permission. The URL endpoints listed below should be utilized as part of a curl authentication command. For more information, please review CommCare's API Authentication Documentation.

Enabling Data Integration 

Connecting to Google Sheets, Email and more using Zapier

How to enable Forms and Case Forwarding

API Clients

Note that any third party libraries are not supported by Dimagi.

• Ruby
  • https://github.com/gdeflaux/commcare_api (third party)
• Python
  • https://github.com/dimagi/commcare-hq-api

API Key Restrictions

API Keys can be restricted by two methods IP address and/or Domain. 

• The IP Allowlist restriction defines a specific IP address or comma separated list of IP addresses where the API Key can be used. The field references IPv4. There are many ways to check what your IP Address is, one simple way is to use: https://whatismyipaddress.com/
• The Domain restriction allows an API Key to be restricted to a specific domain/project space.

If either of these fields are left blank, the API Key will by default be unrestricted.

Standards used in Some APIs

^† External links to the JavaRosa/CommCare docs

API Rate Limiting

Standard rate limit thresholds

• The standard rate limit per minute is 3 API requests per mobile worker.

• The standard rate limit per hour is 130 API requests per mobile worker.

• The standard rate limit per day is 1000 API requests per mobile worker.

In the table below, you will see the calculated rate limit thresholds for each subscription plan.

(number of mobile workers) * (standard API requests per minute or hour or day etc.)

Technically Feasible API Requests

We advise you to adhere to the rate limits as outlined above.