Everything an AI agent can do with the Rollbar API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints31
API versionv1
Last updated23 June 2026
Orientation

How the Rollbar API works.

The Rollbar API is how an app or AI agent works with a Rollbar project: reporting errors as occurrences, listing and reading the items those occurrences group into, marking an item resolved or muted, recording deploys, and querying error trends. Access is granted through an access token sent in a request header, where a project token stays inside one project and an account token reaches account-wide settings, each scoped to read or write. Rather than a generic event feed, Rollbar sends a message to a configured channel, like Slack or a webhook, when an item matches a notification rule.

31Endpoints
7Capability groups
19Read
12Write
3Permissions
Authentication
Every call sends an access token in the X-Rollbar-Access-Token header. There are two token types, and the type is the real boundary. A project access token works inside one project and carries scopes for read (GET), write (PATCH and DELETE), post_server_item (server-side reporting), and post_client_item (client reporting). An account access token works across the whole account with a read or write scope, and is required for account-level work like managing projects, tokens, users, and teams.
Permissions
Rollbar scopes access by token type and scope rather than per-method permissions. The choice of project versus account token sets how far a call reaches, and the read, write, post_server_item, and post_client_item scopes set what it can do. A read token cannot write, a project token cannot touch account-level endpoints, and a reporting-only token (post_server_item or post_client_item) can send occurrences and deploys but cannot read or modify items.
Versioning
The API is served under a single path version and is not dated. New fields are added in place rather than behind a version flag, so there is no version header to send and no migration between dated versions. An integration tracks the current API.
Data model
The API is resource-oriented JSON over HTTPS at https://api.rollbar.com/api/1/. Reported occurrences (the raw error events) are grouped into items (the deduplicated errors), which carry a status of active, resolved, or muted. Deploys, projects, access tokens, users, teams, and notification rules are the other core resources. Every response is wrapped in an envelope with an err field, where err is 0 on success with a result object, and 1 on failure with a message.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Rollbar determines what it can reach. There is a route for working with one project's errors and a route for account-wide settings, plus a hosted server that exposes Rollbar tools to agents, and each is governed by the access token behind it and the scope that token carries.

Ways to connect

REST API

The REST API answers at https://api.rollbar.com/api/1/. Every call sends an access token in the X-Rollbar-Access-Token header, and the type of token, project or account, read or write, decides what the call can reach.

Best forConnecting an app or AI agent to Rollbar.
Governed byThe access token and the scope it carries.
Docs ↗

MCP server (Model Context Protocol)

Rollbar's official Model Context Protocol server lets an agent call Rollbar through MCP. It runs locally over stdio and is configured with a project access token in the ROLLBAR_ACCESS_TOKEN environment variable. Its tools include list-projects, list-items, get-item-details, get-top-items, get-deployments, get-version, get-replay, and update-item. The source is at github.com/rollbar/rollbar-mcp-server.

Best forConnecting an AI agent to Rollbar through MCP.
Governed byThe project access token and the scope it carries.
Docs ↗

Notification rules

Rather than a generic event feed, Rollbar sends a message to a configured channel, like Slack, email, PagerDuty, or a webhook URL, when an item matches a rule. The rules are set per project through the notifications endpoints.

Best forReceiving alerts about new or reactivated errors without polling.
Governed byThe project access token and the scope it carries.
Docs ↗
Authentication

Project access token

A project access token works inside one project and carries one or more scopes: read for GET calls, write for PATCH and DELETE calls, post_server_item for reporting server-side occurrences and deploys, and post_client_item for reporting from browser, Android, or iOS. The scope set is the real boundary on what the token can do.

TokenProject access token (X-Rollbar-Access-Token)
Best forWorking with one project's errors, occurrences, deploys, and rules
Docs ↗

Account access token

An account access token works across the whole account and carries a read or a write scope. It is required for account-level work, like listing or creating projects, managing project access tokens, and reading users and teams. A project access token cannot reach these endpoints.

TokenAccount access token (X-Rollbar-Access-Token)
Best forAccount-wide work across projects, tokens, users, and teams
Docs ↗
Capability map

What an AI agent can do in Rollbar.

The Rollbar API is split into areas an agent can act on, like errors grouped into items, the raw occurrences behind them, deploys, projects, and notification rules. Each area has its own methods, and the token type decides whether a call stays inside one project or reaches the whole account.

Items

5 endpoints

List and read the errors Rollbar groups into items, report a new occurrence, and update an item's status, level, assignment, or snooze.

Writes here change real item data, like marking an error resolved or muted.
View endpoints

Occurrences

4 endpoints

List the raw occurrences behind an item or across a project, read a single occurrence, and delete one.

A delete here permanently removes occurrence data.
View endpoints

Deploys

4 endpoints

Report a deploy, list deploys, read a single deploy, and update a deploy's status.

Writes here record real deploy data tied to a project.
View endpoints

Metrics & RQL

4 endpoints

Aggregate occurrence counts over time, and run SQL-like queries over item and deploy data with Rollbar Query Language.

Reads here return aggregated error and usage data across the project.
View endpoints

Projects

6 endpoints

List, read, create, and delete projects, and manage each project's access tokens.

A delete here permanently removes a project and its data; token writes change what other integrations can reach.
View endpoints

Users & teams

4 endpoints

List and read the users and teams on an account, and see which projects and teams a user belongs to.

Reads here return account membership, including people's names and email addresses.
View endpoints

Notification rules

4 endpoints

Configure a notification channel, like Slack, email, PagerDuty, or a webhook, and create, list, update, and delete the rules that decide when it fires.

Writes here change where and when an account is alerted about errors.
View endpoints
Endpoint reference

Every Rollbar API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Items

List and read the errors Rollbar groups into items, report a new occurrence, and update an item's status, level, assignment, or snooze.5

Needs a project access token with read scope. The token decides which single project is reachable.

Acts onitem
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope. The itemId is the id field from other calls, not the counter in the web URL.

Acts onitem
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope. The counter is the number visible in the item's web URL.

Acts onitem
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Server-side reporting uses a post_server_item token; client platforms, like browser, Android, or iOS, use a post_client_item token instead. Returns the occurrence UUID.

Acts onitem
Permission (capability)post_server_item
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts against the per-token occurrence rate limit

Needs a project access token with write scope. Setting status to resolved or muted is done here. Team assignment is available on Advanced and Enterprise plans only.

Acts onitem
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Occurrences

List the raw occurrences behind an item or across a project, read a single occurrence, and delete one.4

Needs a project access token with read scope.

Acts onoccurrence
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts onoccurrence
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope. The payload can contain whatever data the reporting app attached to the occurrence.

Acts onoccurrence
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with write scope. The deletion is permanent.

Acts onoccurrence
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deploys

Report a deploy, list deploys, read a single deploy, and update a deploy's status.4

Needs a project access token with post_server_item scope. A deploy reported with status started must be updated to succeeded, failed, or timed_out within the time window, or Rollbar marks it timed_out.

Acts ondeploy
Permission (capability)post_server_item
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts ondeploy
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts ondeploy
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with write scope.

Acts ondeploy
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Metrics & RQL

Aggregate occurrence counts over time, and run SQL-like queries over item and deploy data with Rollbar Query Language.4

Needs a project access token with read scope. The Metrics API is part of Rollbar Analyze, available on Advanced and Enterprise plans.

Acts onmetric
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope, even though it is a POST, because the job only reads data. RQL is part of Rollbar Analyze, available on Advanced and Enterprise plans.

Acts onrql job
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts onrql job
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts onrql job
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Projects

List, read, create, and delete projects, and manage each project's access tokens.6

Account-level call: needs an account access token with read scope, not a project token.

Acts onproject
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with read scope.

Acts onproject
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with write scope. The name is up to 32 characters and must start with a letter.

Acts onproject
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with write scope. The deletion removes the project and its data.

Acts onproject
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with read scope. The response includes the token values, which grant access to the project.

Acts onaccess token
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with write scope. The new token can carry read, write, post_server_item, and post_client_item scopes.

Acts onaccess token
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Users & teams

List and read the users and teams on an account, and see which projects and teams a user belongs to.4

Account-level call: needs an account access token with read scope. The response includes people's names and email addresses.

Acts onuser
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with read scope. Returns the person's name and email address.

Acts onuser
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with read scope.

Acts onteam
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account-level call: needs an account access token with write scope.

Acts onteam
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Notification rules

Configure a notification channel, like Slack, email, PagerDuty, or a webhook, and create, list, update, and delete the rules that decide when it fires.4

Needs a project access token with write scope. The channel segment is the integration name, such as slack, email, pagerduty, or webhook.

Acts onnotification channel
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with write scope.

Acts onnotification rule
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with read scope.

Acts onnotification rule
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a project access token with write scope.

Acts onnotification rule
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Rollbar does not push a generic event feed. Instead, a notification rule sends a message to a configured channel, like Slack, email, PagerDuty, or a webhook URL, when an item matches the rule, so an integration learns about new or reactivated errors without polling.

EventWhat it signalsTriggered by
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Rollbar limits how fast an app or AI agent can report occurrences through a rate limit set per access token, and rejects a single request whose body is too large.

Request rate

Rollbar rate-limits occurrence reporting per access token, and each project access token can be given its own limit, set in the UI or through the access-token API. When a token's limit is reached, further POST calls to report items return 429 Too Many Requests until the window resets. The window starts when Rollbar receives the first occurrence and resets after the limit period, so a limit of 100 per minute resets a minute after the first call. Every response carries the headers X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Remaining-Seconds, and X-Rate-Limit-Reset, which report the limit, how many calls are left, the seconds until reset, and the reset time.

Pagination

List endpoints page through results. Deploys return 20 per page through a page parameter that starts at 1, and other list endpoints accept page and, where supported, a limit parameter. The newest records are returned first.

Request size

Requests and responses are JSON sent over HTTPS. A single request body is capped, and a request over the maximum returns 413 Request entity too large. Occurrence payloads should stay well under the cap, since oversized payloads are rejected rather than truncated.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad requestThe request was malformed and could not be parsed, for example invalid JSON in the body.Fix the request body or parameters so the request is well-formed, then resend.
403Access deniedThe access token is missing or invalid, or it does not carry the scope the call needs, for example a read token used for a write call, or a project token used on an account-level endpoint.Send a valid X-Rollbar-Access-Token with the right type and scope for the endpoint.
404Not foundThe URL is invalid or the referenced resource does not exist.Check the path and the resource id, then retry.
413Request too largeThe request body exceeded the maximum size Rollbar accepts.Reduce the payload, for example by trimming large occurrence data, and resend.
422Unprocessable entityThe body was valid JSON, but a parameter was missing or invalid.Read the message field, correct the named parameter, and resend.
429Too many requestsThe per-token rate limit was reached, so the request was not processed.Wait for the window to reset, shown by the X-Rate-Limit-Reset and X-Rate-Limit-Remaining-Seconds headers, before retrying.
Versioning & freshness

Version history.

Rollbar serves a single, continuously updated API under one path version. There is no dated version to pin, so new fields are added in place rather than behind a version flag.

Version history

What changed, and when

Latest versionv1
v1Current version
Single continuously updated API (version 1)

The Rollbar API is served under one path version, /api/1/, and is not dated. There is no version header to send and no migration between dated versions. New fields and endpoints are added in place, so an integration tracks the current API rather than pinning a version. The official Model Context Protocol server and the Metrics and RQL endpoints, part of Rollbar Analyze, are recent additions on top of this single version.

What changed
  • Official Rollbar MCP server published for AI agents (stdio, project access token)
  • Metrics API and RQL available under Rollbar Analyze for Advanced and Enterprise plans
  • Items, occurrences, deploys, projects, access tokens, users, teams, and notification rules all served under /api/1/

An integration tracks the current API; there is no dated version to pin or migrate between.

Rollbar changelog ↗
Questions

Rollbar API, answered.

What's the difference between a project access token and an account access token?+
It is the main access boundary in Rollbar. A project access token works inside one project and is used for items, occurrences, deploys, metrics, and notification rules. An account access token works across the whole account and is required for account-level work, like listing or creating projects, managing a project's access tokens, and reading users and teams. A project token cannot reach account-level endpoints, and the two are administered separately.
What do the read, write, post_server_item, and post_client_item scopes mean?+
They are the scopes a project access token can carry, and together they decide what the token can do. read allows all GET calls, write allows PATCH and DELETE calls like resolving an item or deleting an occurrence, post_server_item allows reporting occurrences and deploys from server-side code, and post_client_item allows reporting from client platforms like browser, Android, and iOS. A token can hold any combination, so a reporting-only token never gains read or write access.
How do the rate limits work?+
Rollbar rate-limits occurrence reporting per access token, and each project access token can have its own limit, set in the UI or through the access-token API. When a token reaches its limit, further calls to report items return 429 Too Many Requests until the window resets, which happens after the limit period measured from the first occurrence. The X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Remaining-Seconds, and X-Rate-Limit-Reset response headers report the current state.
How does an integration receive errors instead of polling?+
Rollbar does not push a generic event feed. Instead, a notification rule sends a message to a configured channel when an item matches the rule. The channel can be Slack, email, PagerDuty, or a webhook URL, and the rules are set per project through the notifications endpoints. A webhook channel posts a payload to a chosen URL, which is the closest equivalent to receiving events without polling.
How are errors reported in the response when a call fails?+
Every response is wrapped in an envelope with an err field. On success err is 0 and the data sits in a result object; on failure err is 1 and a human-readable message describes the problem. The HTTP status also signals the class of error, such as 403 for an access-denied token, 422 for an invalid parameter, and 429 for a rate limit. The message field is the place to read for the specific cause.
Does Rollbar have an official MCP server for AI agents?+
Yes. Rollbar publishes an official Model Context Protocol server at github.com/rollbar/rollbar-mcp-server. It runs locally over stdio and is configured with a project access token in the ROLLBAR_ACCESS_TOKEN environment variable. Its tools include list-projects, list-items, get-item-details, get-top-items, get-deployments, get-version, get-replay, and update-item, so an agent can read items and occurrences and change an item's status through MCP.
Why does an RQL query use a read token even though it's a POST?+
Creating an RQL job is a POST because it submits a query and starts a background job, but the job only reads data, so it needs a project access token with read scope rather than write. The job runs asynchronously: the create call returns a job id, then a separate GET call checks the status and another fetches the result. RQL is part of Rollbar Analyze, available on Advanced and Enterprise plans.
Related

More developer API guides for agents

What is Bollard AI?

Control what every AI agent can do in Rollbar.

Bollard AI sits between a team's AI agents and Rollbar. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Rollbar token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Rollbar
Triage Agent
Read items and occurrences ResourceOffReadFull use
Resolve and mute items ActionOffReadFull use
Delete projects ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Rollbar