Moz User Management API Guide

Auth method: HTTP Basic Auth using Access ID and Secret Key (HMAC-signed requests also supported for v1 legacy)

Setup steps

1. Log in to Moz Pro and navigate to API Access under account settings.
2. Generate an Access ID and Secret Key from the API credentials page.
3. Base64-encode 'AccessID:SecretKey' and pass as the Authorization header: 'Authorization: Basic '.
4. Include 'Content-Type: application/json' for POST requests.

User object field mapping is not yet verified for this app.

Get URL Metrics (Links API)

• Method: POST
• URL: https://lsapi.seomoz.com/v2/url_metrics
• Watch out for: This is an SEO metrics endpoint, not a user-management endpoint. No user CRUD endpoints exist in the public Moz API.

Request example

POST /v2/url_metrics
Authorization: Basic <base64>
Content-Type: application/json

{"targets":["moz.com"]}

Response example

{
  "results": [
    {"page": "moz.com", "domain_authority": 91, "page_authority": 72}
  ]
}

• Rate limits: Rate limits are tied to the API subscription plan. The Links API v2 enforces per-month row limits and concurrent request limits depending on plan tier.
• Rate-limit headers: No
• Retry-After header: No
• Rate-limit notes: Moz API quotas are row-based (number of URL rows returned), not simple request counts. Exact concurrent limits per plan are not fully published in official docs. No standard rate-limit response headers documented.
• Pagination method: offset
• Default page size: 25
• Max page size: 25
• Pagination pointer: next_token (cursor-like token returned in response for Links API v2 pagination)

• Webhooks available: No
• Webhook notes: Moz does not document any webhook functionality in its public API or help center.
• Alternative event strategy: Poll the Links API or Moz Pro UI for data changes. No event-driven mechanism is available.

• SCIM available: No
• SCIM version: Not documented
• Plan required: Enterprise
• Endpoint: Not documented

Limitations:

• Moz does not publish a native SCIM 2.0 endpoint.
• User provisioning is available only via OneLogin's Moz connector, which acts as an intermediary.
• No direct SCIM endpoint URL is documented by Moz in official developer or help center docs.
• Enterprise plan may be required for any SSO/provisioning integration per context data.

Three integration scenarios are relevant to identity and access workflows. For provisioning, there is no REST or SCIM endpoint - the only option is the OneLogin connector, which introduces a dependency on OneLogin's infrastructure and propagation latency.

For SEO data queries, POST to https://lsapi.seomoz.com/v2/url_metrics with Authorization: Basic <base64token> and a JSON body containing target URLs; parse domain_authority and page_authority from the response results array.

For deprovisioning, the same constraint applies as provisioning: no direct API exists, and the OneLogin connector is the sole automated path.

Any identity graph that needs to reflect Moz Pro seat state in real time cannot rely on event-driven signals - there are no webhooks documented, requiring a polling strategy against the Moz Pro UI or periodic reconciliation via the OneLogin connector.

Provision a new Moz Pro user seat

1. No API available. Log in to Moz Pro as an account admin.
2. Navigate to Account Settings > Manage Users.
3. Send an email invitation to the new user from the UI.
4. Alternatively, configure OneLogin's Moz connector to push user provisioning if your organization uses OneLogin.

Watch out for: There is no REST or SCIM endpoint to automate this. OneLogin connector is the only semi-automated provisioning path documented.

Authenticate and query SEO metrics via Links API

1. Retrieve Access ID and Secret Key from Moz Pro API credentials page.
2. Base64-encode 'AccessID:SecretKey'.
3. POST to https://lsapi.seomoz.com/v2/url_metrics with Authorization: Basic and JSON body containing target URLs.
4. Parse 'domain_authority' and 'page_authority' from the response results array.

Watch out for: Quota is consumed per URL row returned, not per API call. Batching many URLs in one request still consumes quota proportionally.

Deprovision a user from Moz Pro

1. No API available. Log in to Moz Pro as account admin.
2. Navigate to Account Settings > Manage Users.
3. Remove the user from the UI.
4. If using OneLogin, deprovision the user in OneLogin and the connector will propagate the removal.

Watch out for: Deprovisioning is not automatable via direct API. Dependency on OneLogin connector introduces latency and requires OneLogin enterprise setup.

The most significant technical caveat is quota behavior: Moz API limits are row-based (URL rows returned), not request-count-based. Batching many URLs into a single POST still consumes quota proportionally, making bulk enrichment workflows unexpectedly expensive against monthly row limits.

Concurrent request limits vary by plan tier (1 for Free/Trial, up to 25 for Premium) and are not fully published in official documentation. No standard rate-limit response headers are returned, so clients must implement their own quota tracking.

Additionally, the legacy Mozscape v1 API used HMAC-SHA1 signed requests; v2 uses Basic Auth - mixing authentication methods across any multi-version integration will cause silent auth failures.

For any identity graph integration, the absence of user-scoped API credentials and the lack of a native SCIM endpoint mean Moz Pro access state cannot be queried or mutated programmatically without routing through OneLogin.