BigML
DEVELOPER · DEVELOPER
Datasets, models, and predictions built under that account’s own key.
Connecting BigML in practice
BigML authenticates by "appending your username and BigML API Key to the query string of every request", so a full-account credential travels in the URL on every call and lands in access logs and referrers by design. Narrowing it is a web-interface-only operation — an alternative key with per-resource, per-operation grants cannot be created through the API — and the published ceiling of 1,000,000 requests per key per hour is never the real one, because the subscription is, and it surfaces as a 402.
Scopes that draw scrutiny
username and api_key query-string parametersBigML’s documented request form is {base_url}/source?username=...&api_key=..., so the credential is in the URL rather than a header on every single request. There is no documented header alternative.Alternative keyThe only documented way to narrow access, and it is not automatable: "To create an alternative key you need to use BigML’s web interface. There you can define what resources an alternative key can access and what operations (i.e., create, list, retrieve, update or delete) are allowed with it."administratorOne of BigML’s four organization membership types. "An administrator has the full access to all projects and resources in the organization, and can manage the users and their membership", and BigML notes a user with several roles keeps only the highest.
Rate limits
- "BigML.io is currently limited to 1,000,000 (one million) requests per API key per hour."
- The binding limit is the plan rather than the rate: a 402 means "Your subscription plan does not allow to perform this action because it has exceeded your subscription limit. Please wait until your running tasks complete or upgrade your plan."
- Plan ceilings have their own error codes: -1107 Too many projects, -1108 Too many tasks, -1109 Subscription required.
- Listing is capped at 200: "limit | Integer, default is 20 | Specifies the number of resources to retrieve. Must be less than or equal to 200."
Worth knowing
- Organization mode changes the wire protocol, not just the permissions: every organization request needs project=project/<id> in the query string, and BigML warns that "even if project is defined in the HTTP POST body, it will simply be ignored in favor of the project property in the query string". The same code does not work unchanged against a personal account.
- Moving data into an organization is one-way: "once personal resource is moved under a organization project, it cannot be moved back to the personal account".
- Omitting the API version silently pins you to the newest one: "If you omit the version name in your API requests, you will always get access to the latest API version", and "it is possible that a future API release could cause your application to fail". The current version is named andromeda.
- A shared WhizzML script or library can only be changed by whoever made it: when public_in_organization is true, "only the creator of the resource or administrators can update or delete the resource".
Checked against BigML authentication (2026-09-29), BigML API overview (2026-09-29), BigML organizations (2026-09-29), BigML status codes (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put BigML behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.