The UserVoice API – Connect Your Systems
Connect UserVoice to your own systems with API keys, OAuth, webhooks, and privacy endpoints, and know when the MCP or a native integration fits better.
On this page
The UserVoice API lets your own code read and change the data in your UserVoice account. Teams use it to sync ideas to a data warehouse, send feedback from in-house tools, post status updates from a release pipeline, and keep user and account details current. This guide covers what the API can do, keys and sign-in, common integrations, webhooks, privacy requests, limits, security, and when the UserVoice MCP or a native integration fits better.
What the API does
The UserVoice API is a REST API for your account's ideas, feedback, people, and settings. Your code reads and writes the same data your admins work with in the admin console.
List ideas, feedback, comments, status updates, users, and accounts, and filter by what changed since your last run.
Create ideas and feedback, post status updates, add comments and notes, and attach labels.
Send user and account details, such as plan or revenue, from the systems that own them.
Webhooks tell your systems when an idea is posted, a comment is added, or a status changes.
This guide covers concepts, not every endpoint. The full reference, with every field and parameter, is at developer.uservoice.com/docs/api/v2/reference. Admins can also reach it from the API keys page in Settings.
What you can work with
| In the admin console | In the API | Common uses |
|---|---|---|
| Ideas | Suggestions | Read, create, update, merge, assign an owner, and mark as spam |
| Feedback captured on behalf of a customer | Feedback records | Add a customer's feedback, linked to an idea |
| Status updates | Status updates and internal status updates | Change an idea's status and post the message that goes with it |
| Comments and notes | Comments and notes | Add or read public comments and internal notes |
| Labels, categories, and forums | Labels, categories, and forums | Organize ideas, and attach or remove labels |
| People and accounts | Users, external users, and external accounts | Look up people, and send user and account details from other systems |
| Supporters and importance | Supporters and importance responses | See who supports an idea and how important it is to them |
| Custom fields | Custom fields | Read and set the fields you've defined on ideas |
The API calls ideas “suggestions.” It's the same object. The reference uses suggestion, and the admin console uses idea.
Get an API key
Every integration starts with an API key. An admin who can change settings creates it.
- In Settings, open Integrations, and choose UserVoice API keys.
- Select Add API key.
- Give the key a Name that says what uses it, such as “Data warehouse sync.”
- If you're building a web app where people sign in, add its Application URL and Callback URL. Scripts don't need them.
- Tick Trusted? only if the key will be kept on a secure server. The next section explains why.
- Select Add API key. The key appears in the list with its Key and Secret.
| On each key | Use it to |
|---|---|
| Edit | Rename the key, change its URLs, or change whether it's trusted |
| Create | Create an access token that acts as you, for testing or a personal script |
| Delete | Remove the key. Integrations that use it stop working. |
API access depends on your plan. Your UserVoice rep can confirm whether it's included in yours.
Authenticate
Your code trades its key for an access token, then sends the token with each request. Which way you get the token decides whose permissions the integration has.
| Way to get a token | Who it acts as | Fits |
|---|---|---|
| Key and secret (trusted keys only) | An admin account, with full admin access | Server jobs with no person present, such as a nightly sync |
| A person signs in (OAuth) | The person who signed in, with their permissions | Apps and tools that act for a specific teammate |
| Create, on the API keys page | You | Testing, and personal scripts |
- Trusted keys can get a token with just the key and secret. Keep them only where no one else can read them.
- Untrusted keys can't. A person has to sign in to UserVoice and approve access, and the token acts as them.
- Signed-in tokens follow the person's permissions. If they can only view ideas, so can the integration.
- Sign-in supports PKCE (S256), for apps that can't keep a secret, such as desktop or browser tools.
Plan for tokens to stop working. Tokens can expire or be revoked. Build your integration to request a new token when a call is refused, instead of storing one forever.
Common integrations
These are examples of what teams build. Each uses a small part of the API.
| Integration | What it does | Good to know |
|---|---|---|
| Sync ideas to a data warehouse | Each night, lists ideas, supporters, and status updates that changed since the last run, and loads them into your warehouse | Lists filter by update time, so each run only fetches what changed |
| Send feedback from an in-house tool | Your support or success tool adds a customer's feedback, linked to an idea | The feedback shows API as its source, and the customer counts as a supporter |
| Update statuses from a release pipeline | When a release ships, posts a status update that moves its ideas to your shipped status | Status updates from the API don't email subscribers unless your code asks them to |
| Sync users and accounts | Sends each user's account, plan, revenue, and your own fields from the system that owns them | Import in batches, and match on your own external IDs |
| Label ideas from another system | Attaches labels based on rules in your own tooling | Labels must exist first. Create them in UserVoice or through the API. |
Before you build
The CRM sync replaces account data you send another way. If you connect Salesforce or HubSpot later, it becomes the source for accounts, and fields you sent through the API are removed. Pick one source for account data, and talk to your UserVoice rep before switching.
Decide who hears about API status changes. A status update posted with notifications on emails everyone subscribed to the idea, as it does in the admin console. Test on one idea before you run your pipeline across a release.
- Check for a native integration first. Jira, Azure DevOps, Salesforce, HubSpot, Zendesk, Slack, and Microsoft Teams connect from Settings without code.
- Use your own IDs. External users and accounts take an external ID, so your sync can update the same record each run.
- Name the key after the integration, so anyone can tell what stops working if it's deleted.
Webhooks
Service hooks send an event to your own web address when something happens in UserVoice, so your systems react without asking the API for changes.
- In Settings, open Integrations, and choose Service hooks.
- Select Add custom web hook, and enter your URL.
- Choose a Content type: JSON or XML.
- Tick the events to send. For idea events, you can Choose individual forums.
- Save, then use Send Test Event to check your endpoint receives it.
| Events you can send |
|---|
| New Idea, New Comment, Idea Status Update, Idea Internal Status Update, and Idea Votes Update (per forum, or all forums) |
| New User Feedback, New Forum, and Feature Status Update |
Check the signature on every request. Each request posts the event name, the data, and a signature: an HMAC-SHA256 of the data, signed with your account's SSO key (Settings, Authentication). Recompute it on your side and reject anything that doesn't match.
Webhooks only go to public addresses. UserVoice doesn't send to private network addresses, so your endpoint has to be reachable from the internet.
Privacy requests
The API has two calls built for data protection requests, such as those under GDPR. Use them when a privacy request comes in through your own process.
| Request | API call | What happens |
|---|---|---|
| Right to erasure, or opt-out | Delete a user | Deletes the person and anonymizes what they submitted, so ideas and comments stay without their identity |
| Right of access | Export a user | Emails the person everything they submitted: ideas, ideas they supported, comments, and uploads. You can add your own message. |
- Look the person up first, and check you have the right user before you delete.
- Deleting can't be undone. Keep a record in your own system of the request and when you acted on it.
- Block a user instead, if you only need to stop someone posting.
Connect privacy requests to the same workflow you use for other tools. If your privacy team already runs deletion and access requests across systems, add UserVoice to that workflow with these two calls.
Limits and paging
Requests are limited per minute for your whole account. Every integration that uses your API keys shares the same limit, and your plan sets it.
| Response header | Tells you |
|---|---|
| X-Rate-Limit-Limit | Requests allowed per minute |
| X-Rate-Limit-Remaining | Requests left this minute |
| X-Rate-Limit-Reset | When the count starts again |
- Over the limit, you get a 429 with a Retry-After header. Wait that many seconds, then try again.
- Slow requests count extra. A request that takes more than two seconds uses more of your limit, so ask for smaller pages.
- Lists come in pages of up to 100 records. Read the paging details in each response to get the next page.
- Ask for what changed. Most lists filter by update time, so a sync can fetch only records updated since its last run.
Spread big jobs out. Run large backfills at quiet times, and pause when the remaining count gets low, so your other integrations keep working.
Keep it secure
An API key with a secret is a way into your feedback data. Treat it like a password.
- One key for each integration, named for what uses it.
- Keys and secrets kept in a secrets manager or your server's environment.
- Trusted keys only on servers you control.
- Sign-in tokens for tools that act for a person, so they follow that person's permissions.
- A new key, then the old one deleted, when someone who had the secret leaves or it may have leaked.
- A regular review of the API keys and service hooks lists, removing what's no longer used.
- Secrets in source code, chat messages, tickets, or browser code.
- A trusted key in a mobile app, desktop app, or web page.
- One shared key for every script, so you can't tell what broke or turn off one integration.
- Webhook requests accepted without checking the signature.
Rotate by replacing. Add a new key, move the integration to it, check it works, then delete the old key. Deleting a key stops everything that uses it.
API, MCP, or a native integration?
The API is one of four ways to connect UserVoice to other tools. Pick the one that needs the least code for the job.
| Option | Best when | Examples |
|---|---|---|
| Native integration | UserVoice already connects to the tool. Set it up in Settings, with no code. | Salesforce or HubSpot account sync, Jira, Azure DevOps, Zendesk, Slack, Microsoft Teams, and the browser extension |
| UserVoice MCP | A person wants answers or changes in plain language from their AI assistant. No code. | “Which ideas gained the most revenue this quarter?” or “Merge these duplicates.” |
| Webhooks | Another system needs to know when something happens. | Post new ideas to an internal tool, or start a workflow when a status changes |
| UserVoice API | Your own code needs to read or change data on a schedule or from another system. | Warehouse sync, release pipeline status updates, and feedback from an in-house tool |
The MCP and the agent follow each person's permissions. View-only admins can read through the UserVoice agent and the UserVoice MCP, but can't make changes.
Try it with your AI assistant
1 of 4 prompts in the PDFAttach the PDF to Claude, ChatGPT, or another assistant, then paste:
Using the UserVoice guide I attached, help me decide whether to use the UserVoice API, the UserVoice MCP, or a native integration for [what we want to connect]. Ask me about our tools and team first.
Three more prompts and the checklist are in the full guide. Get it by email →
Read next
Get the full guide
We'll email you the 14-page PDF. It adds two things that aren't on this page:
- A seven-step checklist to put the guide into practice
- Four AI prompts for Claude, ChatGPT, or your assistant of choice, including one that uses the UserVoice MCP to work with your own feedback data
