Guides

Keys

Make keys on your account's Developers page. A key is shown once; we keep only a fingerprint. Send it on every call:

Authorization: Bearer cck_live_…

Keys come with a CadCraft license: a Team Cloud Plan seat (or managing a team on the plan), a cloud storage plan, an owned license, a SuperCad Studio license, or an active place in the Student Program. If the license ends, the account's keys pause (not_licensed) and start working again when it comes back.

A key acts as your account, and can never do more than your account can on this website. On top of that you can limit each key: its scopes, one workspace, an expiry date, and (live keys) the addresses it may be used from. Roll gives a new value while the old one keeps working for 24 hours; Revoke stops it at once.

Scopes

Each endpoint needs one scope. A :write scope includes its :read.

Scope	Lets the key
account:read	See the account and its workspaces
licenses:read	See license counts and seat lists
licenses:write	Assign, unassign and give seats; request SuperCad Studio seat changes
education:read	See the students you enrolled
education:write	Enroll, edit and end students
library:read	See your library items and uploads
library:write	Upload library blocks and add them
storage:read	See cloud storage use
projects:read	See projects and the drawings in them (names and sizes, never the files)

Workspaces

Seats, storage and projects belong to a workspace: your personal one or a team. Get their ids from GET /v1/account/workspaces and pass workspace=<id>. A key limited to one workspace may leave it out. Moving seats needs the owner or admin role in that team, the same as on the website.

Answers

Every answer is JSON in the same envelope, with X-Request-Id also in the headers. Quote the request id if you write to us.

{
    "status": "success",
    "message": "Seat assigned to Sam Lee.",
    "data": {
        "seat": {
            "id": "9a8b7c6d-\u2026"
        }
    },
    "meta": {
        "request_id": "3f2a\u2026",
        "mode": "live"
    }
}

{
    "status": "error",
    "message": "Check the highlighted fields.",
    "code": "invalid",
    "errors": {
        "email": "Required."
    },
    "meta": {
        "request_id": "3f2a\u2026",
        "mode": "live"
    }
}

Ids are opaque strings. Times are UTC in ISO 8601 (2026-11-03T18:00:00Z). Sizes are bytes. Send bodies as JSON (Content-Type: application/json); uploads as multipart/form-data.

Errors

Check the HTTP status, then code. Messages are for people and may change; codes don't.

Code	HTTP	Means
invalid	400	A parameter is missing or wrong; errors{} names each field.
invalid_key	401	No key, or not a key we know.
key_revoked	401	The key was revoked.
key_expired	401	The key has expired.
not_licensed	401	The account no longer holds a CadCraft license, so its keys are paused.
insufficient_scope	403	The key was not given the scope this endpoint needs.
forbidden	403	The account may not do this (for example, it is not a team owner or admin).
wrong_workspace	403	The key is limited to another workspace.
ip_not_allowed	403	The call came from an address the key does not allow.
not_found	404	No such thing, or the account cannot see it.
method_not_allowed	405	That path takes a different method.
conflict	409	The thing is not in a state where this can happen.
idempotency_mismatch	409	This Idempotency-Key was used with a different request.
throttled	429	Too many calls. Wait for Retry-After seconds.
not_built	501	The endpoint is planned and documented, but not open yet.
server_error	500	Something broke on our side. Quote the request_id.

Paging

Lists take limit (1–200, default 50) and answer meta.page.next. Pass it back as cursor for the next page; null means the end.

Retrying safely

Send an Idempotency-Key header (any string up to 80 characters, like a UUID) on POST and PATCH calls. If the network drops and you send the same call again with the same key within 24 hours, you get the first answer back (meta.replayed: true) and nothing happens twice. The same key with a different body answers 409 idempotency_mismatch.

Limits

Per key: 600 calls and 120 changes every 10 minutes. Every answer carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; over the limit is 429 throttled with Retry-After in seconds. Many calls with keys that don't work from one network are refused for ten minutes.

Sandbox

Sandbox keys (cck_test_…) will run every call against a practice copy of your account: a team of made-up members with seats, a SuperCad Studio license, a class of students and some projects. The calls really run, so a seat you assign shows up in the next list, but nothing reaches a real person: no email is sent (you can read what would have gone out on your Developers page) and nothing is charged. Answers say meta.mode: "sandbox". The sandbox is opening soon. Sandbox keys answer 503 sandbox_unavailable until then.

Versions

This is version 1 (CadCraft-Api-Version: 1). New fields and new endpoints are added in place, so ignore fields you don't know. A change that could break your code would come as /v2, announced on the changelog first.