API Tokens

API tokens authenticate machine access to the platform. A token bypasses the interactive sign-in flow entirely, which makes it the most sensitive credential in the account.

Where API tokens live

API tokens are managed on Settings → Advanced → Permissions, on that page's API Tokens tab (URL path /settings/permissions/APITokens) — the tab shown when the page opens.

Open the Settings page with the gear icon in the navigation bar, then click Advanced in the sidebar. The group expands in place to reveal GitHub, AWS Roles, and Permissions:

Choose Permissions. The page is titled Permissions, subtitled A list of roles and policies for users, with four tabs — API Tokens, Roles, API Policies, and Data Policies — and an Add button on the right whose label matches the active tab.

The API Tokens table lists every token in the account with the access attached to it:

• Name — the token's name.
• Description — what the token is for.
• Roles — the roles the token carries, and with them the policies those roles bundle.
• Data Policies and API Policies — policies attached to the token directly, over and above its roles.
• Actions — a blue edit button and a red delete button for the row.

A pagination bar below the table reports the range and total.

Adding a Token

Click Add API Token to open the Add API Token dialog, subtitled Enter the API Token information to add to the system.

• Name (required) — a name for the token.
• Description — an optional description. Use it to record who or what holds the token and when it was issued; it is the only place that context survives.
• Roles — a Select Values drop-down of the roles defined on the Roles tab.
• Data Policies — a Select Values drop-down of data policies.
• API Policies — a Select Values drop-down of API policies.

Click Save to create the token, or Cancel to close the dialog without saving.

Warning: The token value is shown only when it is created and cannot be retrieved through the interface again. Store it in a secure vault at the moment of creation.

Once created, the token's reference appears in the table.

Editing a Token

A token's information can be modified with the blue edit button on its row.

Edit should only be used to change an existing token when access to the issued token is outside the control of the Fluency admin. Normal practice is to delete the token and create a new one, noting the change in the description of the new token.

Deleting a Token

Deleting a token is done with the red delete button on its row. Accepting the confirmation permanently deletes the token from the system, and any client still using it starts failing immediately.

API Policies

The API Policies tab lists the resource-level grants that roles and tokens are built from. Its table has Name, Description, Resources, and Actions columns, with an Add API Policy button on the right.

Each policy's Resources value is the grant itself, written as resource:[actions] — the first part names the resource and the second the actions permitted on it. The default set pairs an admin policy with a review policy for most resources:

Policy	Description	Resources
audit	audit management	audit:[*]
collector_admin	collector management	collector:[*]
collector_review	collector review	collector:[read]
data_admin	data management	data:[*]
data_review	data review	data:[read]
entity_admin	manage entityinfo	entity:[*]
entity_review	review entityinfo	entity:[read]
event_search	event search	search:[read]
import_admin	import management	import:[*]
import_review	import review	import:[read]

The default instance carries 17 API policies in total, so the table pages; the remainder follow the same *_admin / *_review pattern for the other resources.

Data Policies

The Data Policies tab governs access to the data itself, independently of the API. Its table has Name, Description, and Actions columns, with an Add Data Policy button on the right.

Two policies ship by default:

Policy	Description
data_admin	review flow and event data; see original value
data_review	review flow and event data

The distinction is the "see original value" clause: data_review grants sight of flow and event data, while data_admin additionally exposes the original, unmasked values.

Demo

An interactive demo of managing API tokens is available here: API Tokens (Storylane)

Related

• Managing Roles — the Roles tab of the same page, and what each default role bundles.
• Managing Users — assigning roles to people rather than to tokens.
• Managing Roles — the permission model in context.