openapi: 3.0.3 info: title: Account Account API API version: v2 servers: - url: https://api.spyfu.com/apis/accounts_api security: - Basic_Authentication_Token: [] - Query_Parameter_Token: [] - HMAC_Authentication_Header: [] tags: - name: Account API paths: /v2/usage/month/{usageDate}: get: operationId: AccountApi_GetApiUsageForMonth_GET summary: API monthly usage description: Returns stats for API usage. parameters: - name: usageDate in: path description: Date to get API usage for required: true schema: type: string example: 2025-07 example: 2025-07 responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: month: type: string format: date-time serviceLevelName: type: string nullable: true requestCount: type: integer format: int32 rowsReturned: type: integer format: int32 baseUnits: type: integer format: int32 unitsUsed: type: integer format: int32 finalCost: type: number format: double isPaid: type: boolean additionalProperties: false '400': description: Bad Request '401': description: User failed authorization '500': description: Internal Server Error tags: - Account API /v2/usage/month/{usageDate}/daily: get: operationId: AccountApi_GetApiUsageForMonthByDay_GET summary: API daily usage description: Returns stats for API usage. parameters: - name: usageDate in: path description: Date to get API usage for required: true schema: type: string example: 2025-07 example: 2025-07 responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: month: type: string format: date-time serviceLevelName: type: string nullable: true requestCount: type: integer format: int32 rowsReturned: type: integer format: int32 baseUnits: type: integer format: int32 unitsUsed: type: integer format: int32 finalCost: type: number format: double isPaid: type: boolean additionalProperties: false '400': description: Bad Request '401': description: User failed authorization '500': description: Internal Server Error tags: - Account API /v2/usage/month/{usageDate}/method: get: operationId: AccountApi_GetApiUsageForMonthByMethod_GET summary: API monthly usage by method description: Returns stats for API usage. parameters: - name: usageDate in: path description: Date to get API usage for required: true schema: type: string example: 2025-07 example: 2025-07 responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: day: type: string format: date-time requestCount: type: integer format: int32 rowsReturned: type: integer format: int32 unitsPerRow: type: integer format: int32 unitsUsed: type: integer format: int32 apiMethod: type: string nullable: true additionalProperties: false '400': description: Bad Request '401': description: User failed authorization '500': description: Internal Server Error tags: - Account API components: securitySchemes: Basic_Authentication_Token: type: http description: 'Basic Authentication is a standard that involves encoding your SPYFU_API_ID:SECRET_KEY into a Base64 string. Your SpyFu API ID and Secret Key can both be found under the Account Settings -> API Usage page. Additionally, you can find the Base64 string has been pre-generated on the same page under Base 64 Key. Finally, this encoded string is sent in the "Authorization" header prefixed with the keyword "Basic":
For example, to authorize as 00000000-0000-0000-0000-000000000000:AB12WXYZ the client would send
Authorization: Basic MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwOkFCMTJXWFla
' scheme: basic Query_Parameter_Token: type: apiKey description: An API key can be added as a query parameter. Your API key is listed as "Secret Key" found under the Account Settings -> API Usage page
For example, to authorize with the API key AB12WXY
/apis/example_api/GetExample?domain=spyfu.com&api_key=AB12WXYZ
name: api_key in: query HMAC_Authentication_Header: type: apiKey description: For even more security, each request can be individually authenticated with a timestamped HMAC (Hash Message Authentication Code) signature. Composed of your secret key, a valid timestamp, the API request path, and all request parameters.

Creating the signature:


Combine the pieces that will be converted into the signature.
StringToSign =
	HTTP-Verb + "\n" +
	Timestamp + "\n" +
	UrlPath + "\n"
	QueryParameters;

Create UTF-8 encodings of the above string and of your secret key.
byte[] SecretKeyBytes = UTF-8-Encoding-Of( Upper-Case-Of( SECRET_KEY ) );
byte[] StringToSignBytes = UTF-8-Encoding-Of( StringToSign );

Use an implementation of HMAC256 using your UTF-8 secret key to encode the combined string of your request. This should then be converted to Base64 to finish creating your signature.
Signature = Base64( HMAC-SHA256( SecretKeyBytes, StringToSignBytes ) );

Using the signature:


This signature is then sent in through an Authentication header with your username.
Authentication: UserName:Signature
name: Authentication in: header