SecurityTrax API Management
Requires. The SecurityTrax API Management permission. The page's actions follow the permission's access levels: View shows the page, Create enables granting access, Modify enables revoking access, and Delete enables revoking tokens. Buttons you lack the access level for are hidden.
The SecurityTrax API page (Administration → SecurityTrax API) is where you manage programmatic access to your SecurityTrax data: who may use the API, and every API token that currently exists for your company. It also links to the API documentation and release notes.
The badge next to the page title shows whether the API is Enabled or Disabled for your company. If it shows Disabled, you can still manage user access and tokens here, but API requests are rejected until the API is enabled — contact SecurityTrax support to enable it.
Grant a user API access
Heads up. API calls are limited to what the user's permissions already allow, but they consume tokens and carry costs. Grant access with care, and only on an as-needed basis.
- Go to Administration → SecurityTrax API.
- In the API Users card, click Grant Access.
- Choose the user in the searchable picker and click Save.
The user can now create their own API tokens under Settings → API Access (the user menu → Settings). Access is per-user and explicit — it is never inherited from a group or role.
API access can also be toggled from the user's edit page (Administration → Users → edit a user) with the API access switch, when the API is enabled for your company.
Review who has access
The API Users card lists every user who has been granted API access, with:
| Column | What it shows |
|---|---|
| Name | Links to the user's edit page. |
| Username | The user's login name. |
| Active / Login | The user's account state. A user shown as inactive or unable to log in cannot make API calls, even with access granted — but their grant stays visible here so you can review or revoke it. |
| Active Tokens | How many live API tokens the user currently has. |
Revoke a user's API access
- In the API Users card, click Revoke Access on the user's row.
- Confirm in the dialog.
Revoking access takes effect immediately: the user can no longer make API calls, and all of their existing tokens are revoked at the same time. If you grant the user access again later, they start with no tokens and must create new ones.
Review and revoke tokens
The Active Tokens card lists every live API token across all users — the owner, the token's name, a safe partial identifier (prefix and last four characters; the full token is never stored or shown), when it was created, when it was last used, and when it expires.
To revoke a single token, click Revoke on its row and confirm. The token stops authenticating immediately and disappears from the owner's Settings → API Access page. Revoking one token does not affect the user's other tokens or their API access.
Tip. Last Used is a reliable signal for cleanup: a token that has never been used, or hasn't been used in months, is a good candidate to revoke.
Documentation and release notes
Two links at the top of the page:
- API Documentation — the full API reference, including authentication and every available resource.
- API Release Notes — what's new and changed in the API, on the SecurityTrax website.
Related
- Users — create and manage users, including the per-user API access switch.
- Permissions — grant the SecurityTrax API Management permission itself.
- Account Management — token billing and usage for your SecurityTrax account.