API Bridge

The API Bridge connector gets data from any REST API into Google Sheets and Google Data Studio. Use it to report on data that Two Minute Reports has no connector for.

What you can report on

• Data from any REST API endpoint
• Custom JSON or CSV endpoints
• Internal business metrics and KPIs
• Third-party platform data that Two Minute Reports has no connector for
• Combine external data with other connectors in one report

Prerequisites

• The API endpoint URL you want to connect to
• Authentication credentials for the API (API key, Bearer token, or Basic Auth). If the API issues a short-lived token from its own auth endpoint, use Dynamic bearer token instead. It supports GET and POST token endpoints.
• Knowledge of the JSON response structure you want to query
• An endpoint that accepts requests from outside your network. If the API restricts access by IP address, see IP whitelisting

How to create a connection

1. In the Hub, open Connections & accounts.
2. Select Create connection.
3. Select API Bridge in the connector list.
4. Select Next.

5. In Name the connection, enter a name.
6. Enter the Base URL of the API.
7. Select an Authorization method, and enter the credentials it asks for. If the API issues short-lived tokens, select Dynamic bearer token (see Dynamic bearer token).
8. Select Save. To test the connection first, turn on Test before saving, enter a Test URL suffix, and select Test and save.

9. Enable the accounts you want to report on.
10. Select Done.

Advanced features

JMESPath

By default, API Bridge returns the entire JSON response from the API. Use JMESPath to extract only the fields you need and keep your reports clean.

JMESPath is a query language for JSON. In a Google Data Studio query config, enter the expression in JMESPath. In Google Sheets, set Json Processor to JmesPath, then enter the expression in JMES Path.

Selecting a field from an object:

# JSON: {"name": "Roberts", "age": 25, "profession": "teaching"}
name         # → "Roberts"

Selecting nested data:

# JSON: {"skills": {"primary-skill": "Cyber Security", "secondary-skill": "Web Development"}}
skills.primary-skill    # → "Cyber Security"

Selecting from an array:

# JSON: {"people": [{"firstName": "James"}, {"firstName": "Jacob"}, {"firstName": "Jayden"}]}
people[*].firstName     # → ["James", "Jacob", "Jayden"]

For more expressions, see the official JMESPath documentation.

Output formats

When your API returns nested JSON, choose how API Bridge should flatten it into columns and rows.

Grid format: creates a new row for each nested item and copies the parent fields down. Use this when each nested object represents a separate record.

Flat format: creates a new column for each nested field. Use this when you want a single wide row with all fields spread across columns.

Pagination

API Bridge supports three pagination methods for APIs that split results across multiple pages. Select one under Pagination.

Page parameter: specify the page parameter name and the first and last page numbers. API Bridge fetches all pages in sequence and combines the results. The parameter name varies by API (such as page, count, or p). Check your API's documentation.

Offset-Limit: for APIs that use an offset and a limit per request:

• Offset: the number of records to skip before selecting
• Limit: the number of records to fetch per request

Specify the offset parameter name, starting offset value, limit parameter name, limit value, and the total number of records to fetch.

Next page URL: for APIs that return the address of the next page in each response. Enter the field that holds that address in Field name (a JMESPath expression), and the maximum Number of pages to fetch. API Bridge stops when a response has no next page address.

Dynamic bearer token

If your API uses short-lived bearer tokens that expire and require manual regeneration, use the Dynamic bearer token option. It calls a token endpoint you specify, gets a fresh token, and uses it in the data request. You do not need to update the token by hand.

How to set it up:

1. In the connection form, set Authorization to Dynamic bearer token.
2. Enter the Token authentication URL: the URL suffix of your API's auth endpoint (for example, /auth/token). It is joined to your Base URL the same way a URL suffix is.
3. Enter the Access token name: where the token sits in the auth response. A plain field name (access_token, AccessToken) works, and so does a dotted path if the token is nested (data.token).
4. Enter the Token header: the header Two Minute Reports sends with your data requests, as a name and a value. The value must contain {{token}}. See Choosing the token header below.
5. Select the Token request method: GET or POST, whichever your auth endpoint accepts.
6. If you selected POST, enter the Token request body as JSON. See POST token endpoints below.
7. Add any headers your auth endpoint needs (for example, an API key header) under Headers. Two Minute Reports sends these with both the token request and the data requests.

Two Minute Reports calls the auth endpoint when it needs a new token, and uses the returned token to fetch your data. See How often Two Minute Reports fetches a new token.

Choosing the token header

Most APIs expect Authorization: Bearer <token>, so the usual setting is:

Some APIs want the raw token with no Bearer prefix, or want it in a header of their own name. Set the value to whatever that API documents, keeping {{token}} where the token belongs:

Authorization: {{token}}
X-Auth-Token: {{token}}

If you get a 401 or 403 on your data query while the connection test passes, a Bearer prefix the API does not want is the first thing to check.

POST token endpoints

Many APIs issue a token from a POST endpoint that takes a JSON body, such as a username and password, or a client ID and secret. Set Token request method to POST and put that body in Token request body:

{
  "Username": "[email protected]",
  "Password": "your-api-password"
}

The body must be valid JSON. Two Minute Reports sends Content-Type: application/json for you, along with any headers you added under Headers.

Timestamps and signatures in the token body

If your auth endpoint requires a timestamp or a signed request, the body supports placeholders:

For a signature, wrap the string to be signed in an HMAC placeholder and enter the shared secret in Signing secret key. Inside the brackets you can reference {{nowISO}}, {{nowEpoch}}, {{nowEpochMs}}, and any other top-level field of the same body by its name:

{
  "clientId": "acme-123",
  "timestamp": "{{nowEpoch}}",
  "signature": "{{hmacSha256({{clientId}}{{nowEpoch}})}}"
}

That signs acme-123 followed by the current Unix timestamp, and puts the result in signature.

Available HMAC placeholders. Pick the algorithm and encoding your API asks for:

hmacSha1, hmacSha1Base64, hmacSha1Base64Url, hmacSha256, hmacSha256Base64, hmacSha256Base64Url, hmacSha512, hmacSha512Base64, hmacSha512Base64Url

How often Two Minute Reports fetches a new token

Two Minute Reports caches the token and does not call your auth endpoint on every request. If the auth response includes an expires_in field, Two Minute Reports uses it with a 10% safety margin (minimum 60 seconds). Otherwise it caches the token for 15 minutes. If a data request comes back 401 or 403, Two Minute Reports discards the cached token, fetches a fresh one and retries the request once.

Spreadsheet formulas in queries

In Google Sheets, you can use cell references inside your API Bridge Url Path/Suffix or request body. This lets values in your spreadsheet set query parameters, so you do not have to edit the query each time.

Put triple plus signs (+++) on both sides of a cell reference. This tells Two Minute Reports that it is a formula, not part of the URL.

Single cell reference:

+++Sheet1!A2+++

For example, with this data in your sheet:

Setting Url Path/Suffix to /users/+++Sheet1!A3+++ fetches the user whose ID is in cell A3:

Cell references also work in the Body field for POST and PUT requests:

Cell range reference:

+++Sheet1!A3:A6+++

Two Minute Reports makes one request per row in the range and combines the results. For example, with a range of values:

Setting /users?id=+++Sheet1!A3:A6+++ runs four requests, one per row:

Multiple columns:

/users?gender=+++Sheet1!D2:D5+++&status=+++Sheet1!E2:E5+++

Two Minute Reports runs one request per row. Each request uses the values from both columns in that row.

Range references also work in the POST body:

How to get API Bridge data into Google Sheets or Google Data Studio

IP whitelisting

Some APIs only answer callers on an allowlist. This is common for a self-hosted service, an endpoint inside a company network, or a provider that ties each key to a set of addresses. Two Minute Reports calls your endpoint from its own servers, not from your browser, so your own address being allowed is not enough.

49.13.34.182
5.75.217.220
116.203.164.91
95.216.182.151
91.99.28.86

If the endpoint is reachable only from inside a private network, no allowlist will help. The endpoint has to be reachable from the public internet before a connection can read it.

Still blocked after adding all five? See Connection Blocked by a Firewall or IP Allowlist.