Repository and View API Tokens

Repository and View API tokens enable granular API access to an individual repository, view, or asset in a view. The API token is limited only to the repository where the API token is created, and to the corresponding permissions granted to that token. API tokens are limited to a single view within the UI but can be created through the GraphQL API to cover multiple views and repositories.

Note

Repository and view are used interchangeably as are the token names. In the UI, the terms View Tokenand Repository Token may be used, but refer to the same object.

The diagram above illustrates how a view token may apply to all assets in a view, such as Repo Token 1, or may be limited to one or more specific assets in a view, such as Repo Token 2. The asset permissions control what is allowed for a specific asset. The repo permissions apply to the entire view.

Access includes:

  • Data read access (including querying and searching the repository events)

  • Data management, such as data retention and deleting stored events

  • Searching repositories, including saved queries, sharing dashboards and connecting views

  • Ingest configuration, including the ability to create ingest tokens and parsers

  • Integrations, S3 archiving, event forwarding and managing packages

  • Triggers and actions, such as scheduled searches and alerts

Repository tokens are managed from the Repository Settings page: