Cybatar Security Hub · Governance · Risk Management · Threat Resilience · Compliance & Audit
Unified enterprise security operations for modern organisations
Security Hub
Client login Open portal
Cybatar / Developers / API-key management
Developer guide

API-key management

Cybatar includes an API-key issuance workflow for integration access. The presence of API-key records does not by itself define a complete public API contract, so integrations should verify the exact endpoints and scopes available in the deployment.

Published 2026-08-17Reviewed 2026-08-17

Implementation facts

Issued tokens use a Cybatar-prefixed random token value. The application stores a SHA-256 token hash and a shortened preview rather than the full issued token. API-key records include a name, scope, status, last-used time and expiry metadata. The current default scope string references event write access plus report and incident read access, but deployers should verify which routes consume those scopes.

Recommended implementation workflow

STEP 1

Define the integration purpose and least-privilege scope required.

STEP 2

Issue the API key from the authenticated Cybatar administration workflow.

STEP 3

Copy the full token at issuance and store it in an appropriate secret store.

STEP 4

Confirm which deployment endpoints and middleware actually enforce the intended scope.

STEP 5

Monitor status, expiry and last-use metadata and rotate credentials when necessary.

Security and claim boundary

This guide documents the API-key record and issuance behaviour visible in the application. It does not claim that every listed scope is currently enforced by every route or that Cybatar exposes a complete public REST API.

Frequently asked questions

Does Cybatar store full API tokens after issuance?

The current issuance workflow stores a one-way SHA-256 hash plus a shortened preview, not the issued token value itself.

Do Cybatar API keys expire?

The current issuance workflow creates expiry metadata one year from issuance. Deployment policy can require earlier rotation.

Does the presence of API keys mean every Cybatar module is accessible by API?

No. Available endpoints and scope enforcement must be verified in the actual deployment.