Streak User Management API Guide

Auth method: API Key (HTTP Basic Auth – API key as username, empty password)

Setup steps

1. Log in to Streak and navigate to Settings → API.
2. Generate or copy your personal API key.
3. Include the API key as the username in HTTP Basic Auth with an empty password, e.g., Authorization: Basic base64(apiKey:).
4. Alternatively, pass the API key as a query parameter: ?api_key=YOUR_KEY (less preferred).

Get current authenticated user

• Method: GET
• URL: https://www.streak.com/api/v1/users/me
• Watch out for: Returns only the user associated with the API key used; cannot impersonate other users.

Request example

GET /api/v1/users/me
Authorization: Basic base64(apiKey:)

Response example

{
  "key": "agxzfm...",
  "email": "user@example.com",
  "displayName": "Jane Doe",
  "isOrgAdmin": false,
  "orgKey": "agxzfm..."
}

Get user by key

• Method: GET
• URL: https://www.streak.com/api/v1/users/{userKey}
• Watch out for: You can only retrieve users within your organization.

Request example

GET /api/v1/users/agxzfm...
Authorization: Basic base64(apiKey:)

Response example

{
  "key": "agxzfm...",
  "email": "colleague@example.com",
  "displayName": "John Smith"
}

List users in organization

• Method: GET
• URL: https://www.streak.com/api/v1/organizations/{orgKey}/users
• Watch out for: Requires the authenticated user to be a member of the specified organization. No pagination; returns all members.

Request example

GET /api/v1/organizations/agxzfm.../users
Authorization: Basic base64(apiKey:)

Response example

[
  {"key": "agxzfm...", "email": "a@example.com"},
  {"key": "agxzfm...", "email": "b@example.com"}
]

Get current user's organization

• Method: GET
• URL: https://www.streak.com/api/v1/users/me/organization
• Watch out for: Returns the organization of the API key owner only.

Request example

GET /api/v1/users/me/organization
Authorization: Basic base64(apiKey:)

Response example

{
  "key": "agxzfm...",
  "name": "Acme Corp",
  "adminKey": "agxzfm..."
}

• Rate limits: Streak enforces rate limits but does not publicly document specific numeric thresholds per plan in its official docs.

• Rate-limit headers: Unknown

• Retry-After header: Unknown

• Rate-limit notes: Official docs do not specify rate-limit headers or Retry-After behavior. Contact Streak support for enterprise-level rate limit details.

• Pagination method: none

• Default page size: 0

• Max page size: 0

• Pagination pointer: Not documented

• Webhooks available: No

• Webhook notes: Streak does not document a native webhook system for user-management events in its official API reference.

• Alternative event strategy: Use polling against /users/me or /organizations/{orgKey}/users to detect membership changes.

• SCIM available: No
• SCIM version: Not documented
• Plan required: Enterprise
• Endpoint: Not documented

Limitations:

• Streak does not offer a native SCIM 2.0 endpoint.
• No IdP-native SCIM connector (Okta, Entra ID, OneLogin) is officially documented.
• SAML SSO is available on the Enterprise plan but automated user provisioning/deprovisioning via SCIM is not supported.

Three primary automation scenarios are viable with the current API surface, all read-oriented.

For org-wide user audits: authenticate with an admin-scoped API key, call GET /users/me to retrieve the orgKey, then call GET /organizations/{orgKey}/users to pull the full member list.

Parse email, key, isOrgAdmin, and lastSeenTimestamp for downstream processing.

The API key must belong to an org member;

cross-org queries are not supported.

For inactive-user identification: retrieve the org user list, compare each record's lastSeenTimestamp against your inactivity threshold, and flag matches for manual review.

Offboarding itself must be executed in the Streak UI-there is no DELETE /users endpoint.

For directory sync: poll GET /organizations/{orgKey}/users on a scheduled interval (hourly is a reasonable baseline), diff against your internal identity graph using email as the canonical identifier, and surface additions or removals for action.

No webhook or push mechanism exists, so real-time sync is architecturally unavailable;

polling is the only option.

Integrating this into an identity graph via an MCP server with 60+ deep IT/identity integrations can reduce the per-app polling burden by centralizing the diff and reconciliation logic.

Audit all users in an organization

1. Authenticate with the API key of an org admin user.
2. Call GET /api/v1/users/me to retrieve the orgKey from the response.
3. Call GET /api/v1/organizations/{orgKey}/users to retrieve the full member list.
4. Parse the returned array for email, key, isOrgAdmin, and lastSeenTimestamp fields.

Watch out for: The API key must belong to a user who is a member of the target organization. Non-members cannot list org users.

Identify inactive users for offboarding review

1. Retrieve all org users via GET /api/v1/organizations/{orgKey}/users.
2. Compare each user's lastSeenTimestamp against your inactivity threshold.
3. Flag users whose lastSeenTimestamp exceeds the threshold for manual review.
4. Offboard identified users through the Streak admin UI, as the API does not support user deletion.

Watch out for: User removal must be performed manually in the Streak UI or via Google Workspace; there is no DELETE /users endpoint.

Sync Streak org membership to an internal directory

1. Poll GET /api/v1/organizations/{orgKey}/users on a scheduled interval.
2. Diff the returned user list against your internal directory using the email field as the canonical identifier.
3. Add or flag-for-removal users based on the diff result.
4. Because no webhooks exist, schedule polling at an appropriate interval (e.g., hourly) to detect changes.

Watch out for: No webhook or push notification is available; real-time sync is not possible without continuous polling.

The core API trap with Streak is the personal-key authentication model. Because every key is tied to a specific user account, any automated workflow breaks if that user is offboarded, changes their Google account, or rotates their key without updating dependent systems.

There is no mechanism to issue a credential that survives individual user lifecycle events.

The second structural caveat is write-scope absence: the API cannot create, update, or delete users. Any provisioning or deprovisioning automation built on this API will have a mandatory manual step at the Streak UI layer, which undermines the value of automation for user lifecycle use cases specifically.

Finally, the undocumented rate-limit behavior and absence of Retry-After headers mean that high-frequency polling or bulk audit scripts must implement conservative backoff heuristics without vendor guidance on safe thresholds. The v1 API versioning strategy is also not formally documented, so breaking-change risk on any integration should be treated as unmitigated.