SecurityTrax API Management

Requires. The SecurityTrax API Management permission. The page's actions follow the permission's access levels: View shows the page, Create enables granting access, Modify enables revoking access, and Delete enables revoking API access tokens. Buttons you lack the access level for are hidden.

The SecurityTrax API page (Administration → SecurityTrax API) is where you manage programmatic access to your SecurityTrax data: who may use the API, and every API access token that currently exists for your company. It also links to the API documentation and release notes.

Note. Two different kinds of tokens appear in SecurityTrax. API access tokens (this page) are credentials an application uses to authenticate to the SecurityTrax API. SecurityTrax Tokens are the prepaid usage credits that metered features — including API usage — draw from.

API usage costs SecurityTrax Tokens

A yellow banner at the top of the page reminds you that the SecurityTrax API is a metered feature: API requests consume SecurityTrax Tokens from your company's token wallet, apart from creating customers and leads, which is included with your subscription. Before provisioning API users, review the published API rate on the Token Pricing tab of the Account Management → Tokens page — the banner's View SecurityTrax Token pricing button takes you there (it requires SecurityTrax Account Management View; without it, the banner tells you where pricing lives so you can ask an administrator).

The badge next to the page title shows whether the API is Enabled or Disabled for your company. If it shows Disabled, you can still manage user access and API access tokens here, but API requests are rejected until the API is enabled — contact SecurityTrax support to enable it.

Review API usage

The API Usage card shows how much your company is using the API and how that usage draws on your SecurityTrax Tokens. Use the 30 Days / 90 Days buttons in the card header to change the period.

Requests are counted in two kinds, shown as an equation so the parts add up to the total:

Only successful requests are counted. Requests that fail, are rejected, or are refused for lack of tokens never draw tokens and never appear here.

Deducted and Not yet deducted

Wallet deductions are applied in batches — at least once a day, and sooner when your balance is running low. That gives you two rows:

Note. Not yet deducted does not mean the usage was missed. Every successful request is counted the moment it happens; the two rows differ only in whether the wallet deduction has been applied yet.

Because only Advanced requests draw tokens, the token cost sits on the column, not the row — the Included figure in either row never costs you anything.

Heads up. Each bar on the chart is the usage deducted on that date, which covers the period leading up to it rather than the calendar day itself. The most recent bar therefore does not include anything that has happened since — that amount is the Not yet deducted row.

On the chart, Advanced and Included requests stack in the same colours shown next to the numbers. Anything not yet deducted appears as a faded bar, dated for the deduction that will cover it, so you can see what is still to come.

If deduction history can't be loaded, the card says so and hides the totals and the chart. Not yet deducted is unaffected and still shows, because it is counted live.

Grant a user API access

Heads up. API calls are limited to what the user's permissions already allow, but most API calls consume SecurityTrax Tokens and carry a cost. Grant access with care, and only on an as-needed basis.

1. Go to Administration → SecurityTrax API.
2. In the API Users card, click Grant Access.
3. Choose the user in the searchable picker and click Save.

The user can now create their own API access tokens under Settings → API Access (the user menu → Settings). Access is per-user and explicit — it is never inherited from a group or role.

API access can also be toggled from the user's edit page (Administration → Users → edit a user) with the API access switch, when the API is enabled for your company.

Review who has access

The API Users card lists every user who has been granted API access, with:

Revoke a user's API access

1. In the API Users card, click Revoke Access on the user's row.
2. Confirm in the dialog.

Revoking access takes effect immediately: the user can no longer make API calls, and all of their existing API access tokens are revoked at the same time. If you grant the user access again later, they start with no tokens and must create new ones.

Review and revoke API access tokens

The Active API Access Tokens card lists every live API access token across all users — the owner, the token's name, a safe partial identifier (prefix and last four characters; the full token is never stored or shown), when it was created, when it was last used, and when it expires.

To revoke a single token, click Revoke on its row and confirm. The token stops authenticating immediately and disappears from the owner's Settings → API Access page. Revoking one token does not affect the user's other tokens or their API access.

Tip. Last Used is a reliable signal for cleanup: a token that has never been used, or hasn't been used in months, is a good candidate to revoke.

Documentation and release notes

Two links at the top of the page:

• API Documentation — the full API reference, including authentication and every available resource.
• API Release Notes — what's new and changed in the API, on the SecurityTrax website.

Related

• Users — create and manage users, including the per-user API access switch.
• Permissions — grant the SecurityTrax API Management permission itself.
• Account Management — your SecurityTrax Tokens wallet, including the Token Pricing tab with the API usage rate.