Authentication & roles
Every request carries an API key in the Authorization header. Each key belongs to one workspace and has one role.
Authorization: Bearer v77_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxCreating and revoking keys
Workspace admins manage keys in Settings → API keys. The full key is shown once; V77 stores only a SHA-256 hash. Revoke a key there and it stops working immediately. Use one key per integration, so you can revoke one without breaking the others; GET /me shows which key a request used.
Roles
A key can do what its role allows. Each endpoint in the reference shows the lowest role it needs.
| Role | Can | Typical use |
|---|---|---|
auditor | Read everything; no changes | External auditors, BI and data-lake exports, the CI/CD gate |
reviewer | Read; review and approve in the app | Compliance reviewers |
ai_owner | Read, create and update systems, classifications, controls, evidence, findings, incidents and tests | MLOps pipelines, inventory sync |
admin | Everything, including webhook endpoints | Platform team |
For a CI/CD gate, use an
auditor key: it can check the gate but can't change anything if it leaks.Keeping keys safe
- Keep keys in a secrets manager or your CI's encrypted secrets, never in code or front-end apps.
- Call the API from your servers only. The API doesn't allow browser (CORS) requests.
- Rotate keys regularly: create the new key, deploy it, then revoke the old one.
- Every change made with a key is recorded in the audit log with the key id.