Skip to main content

​
Overview

API keys provide programmatic access for CI pipelines, integrations, and tooling. Cysmiq supports two types of keys:
  • Personal API keys: Scoped to your user account. Can be restricted to specific workspaces.
  • Workspace API keys: Scoped to a workspace (tenant). Managed by workspace admins for shared integrations.

​
Create an API key

1

Open settings

Open the Workspaces page, select Security, then scroll to API keys.
Use https://app.cysmiq.com/workspaces for Cysmiq Cloud. For self-hosted, use your Cysmiq app URL.
API keys section showing the form to create a personal API key.

Personal API keys are managed in your account security settings.

2

Configure the key

Enter a descriptive Token name to identify the key’s purpose, such as “CI read-only” or “GitHub Actions”.Select the Scopes for the key. For a CI read-only key, keep read scopes enabled and leave write scopes disabled. Available read scopes include:
  • Read vulnerabilities (vulnerabilities:read): Access vulnerability lists and summary data
  • Read policy violations (policy-violations:read): Access policy violation lists and details
  • Read scans (scans:read): Access scan lists and status
  • Read organizations (organizations:read): Access organization lists and details
  • Read repositories (repositories:read): Access repository lists and details
Choose an Expires value. Shorter expirations are more secure but require more frequent rotation.
Optionally restrict the key to specific workspaces using Restrict to workspaces. If no workspaces are selected, the key works across all workspaces you have access to.
API key form filled with token name CI read-only and 30 day expiration.

Fill in the token name and choose expiration. Workspace restrictions are optional.

3

Create and copy the key

Select Create API key. The key value is displayed once and cannot be retrieved later.
New API key created dialog showing the key value with a copy button and warning to store it securely.

Copy the key immediately. It will not be shown again.

Select Copy to copy the key to your clipboard, then store it securely in a secrets manager or environment variable.

​
Verify an API key

Use the whoami endpoint to confirm your key and tenant context.
1

Find your tenant slug

Open the Workspaces page. The tenant slug is the short identifier used in API URLs. It appears under each workspace name, such as e55cdd66.
Workspaces list showing the tenant slug under a workspace name.

The tenant slug appears under the workspace name.

2

Send a whoami request

Replace <tenant-slug> with the value from the previous step.
For self-hosted deployments, replace https://app.cysmiq.com with your Cysmiq app URL.

​
View and revoke keys

Created keys appear in a list below the creation form. Each key shows:
  • Name and Status (Active, Expired, or Disabled)
  • Created date and Last used timestamp
  • Expires date
  • Scopes assigned to the key
API key list showing a CI read-only key with Active status and details.

Keys are listed with status, usage details, and a revoke option.

To revoke a key, select Revoke and confirm. Revoked keys are permanently disabled and cannot be restored.