List flags
Returns every flag in the workspace, with the configuration of the credential's environment. Pass tag to return only flags that have at least one of the given tags.
Requires a management key.
bearerAuthorizationBearer <token>Send a credential in the Authorization header: Authorization: Bearer <token>.
Each credential belongs to one environment of one workspace, so the API never takes a workspace or environment in the URL.
- Management key (
ffk_…, secret): manages flags, segments, environments, and API keys, and reads the audit log and analytics. It can also do everything an evaluation key can. - Evaluation key (
ffk_…, secret): for server SDKs. It evaluates flags, reads flag definitions for local evaluation, and sends telemetry. - Public token (
ffp_…, not secret): for browser and mobile apps. It evaluates flags through OFREP and sends telemetry. It cannot read flag definitions.
Keep secret keys on your server. A 401 response means the credential is missing or not valid. A 403 response means the credential is valid but its role cannot perform the operation.
tag?array<string>Return only flags that have this tag. Repeat the parameter to match any of several tags, such as ?tag=checkout&tag=growth.
OK
application/json- response
[index: integer]?A feature flag. The key, type, name, description, tags, and metadata are shared by all environments. The variants, enabled state, and targeting rules belong to the environment of the credential.
curl -X GET 'https://api.toggld.io/api/v1/flags'[ { "key": "new-checkout", "name": "New checkout", "description": "Serve the redesigned checkout flow.", "type": "boolean", "enabled": true, "variants": { "on": true, "off": false }, "defaultVariant": "off", "offVariant": "off", "targeting": [ { "id": "beta-users", "conditions": [ { "attribute": "plan", "operator": "eq", "value": "beta" } ], "serve": { "type": "variant", "variant": "on" } }, { "id": "rollout", "conditions": [], "serve": { "type": "rollout", "bucketBy": "targetingKey", "splits": [ { "variant": "on", "weight": 20 }, { "variant": "off", "weight": 80 } ] } } ], "metadata": { "team": "growth" }, "tags": [ "checkout", "growth" ], "version": "b7e1c0d2-4f3a-4c8e-9a1b-2d3e4f5a6b7c.0a9b8c7d-6e5f-4a3b-8c2d-1e0f9a8b7c6d", "createdAt": "2026-05-01T12:00:00.000Z", "updatedAt": "2026-05-02T09:30:00.000Z" }]Rate limits
The request budgets that protect the Toggld API, and how to handle HTTP 429.
Create a flag POST
Creates a flag in every environment of the workspace. Every environment gets the same variants, default variant, and off variant. Only the credential's environment gets `enabled` and `targeting`. Other environments start off, with no targeting rules. Requires a management key. Returns `409` if the key is already in use, `422` if the flag is not valid, and `402` if the workspace has reached the flag limit of its plan.