API Keys and Webhooks

Pipelines and integrations need machine access. API keys authenticate inbound calls with explicit scopes; webhooks push events outbound to systems that want to react.

Plan Availability

API access and webhooks are available on the Medium plan and above.

API Keys

Create keys with only the scopes the caller needs; the key is shown once at creation. The flagship use is the conformance gate: a key holding the compliance read scope lets your CI call the release gate and the Terraform check with no user session involved. Keys can be revoked at any time, and every call they make is attributed to them in the audit trail.

Webhooks

Register an endpoint and choose the events it receives; deliveries are signed and logged, with recent attempts and outcomes visible for troubleshooting. The event worth wiring first is drift detection: a new finding can open a ticket, page a channel, or trigger your own automation the moment the approved design diverges.

Scope Tight, Rotate Boring

One key per consumer, minimal scopes, and rotation as routine maintenance. Because keys are individually attributed, a leaked key's blast radius is visible in the audit trail, and revoking it breaks exactly one integration.