Integration

Scopes and least privilege

resource:action matrix, write→read implication, and separate keys per CI use case.

OpenAPI contract Issue an API key Free Solo account

Full document, no authentication, ready for your client generator.

Scopes

A scope is written resource:action. The key only reaches endpoints whose scope it carries. Out of scope → 403 naming the missing one.

Writing implies reading: scenarios:write also grants scenarios:read. runs:trigger is separate from runs:read: triggering consumes run quota.

Resource	Read	Write
Scenarios	`scenarios:read`	`scenarios:write`
Runs	`runs:read`	`runs:trigger`
Incidents	`incidents:read`	`incidents:write`
Outgoing webhooks	`alerting:read`	`alerting:write`
Maintenance windows	`maintenance:read`	`maintenance:write`
Availability targets	`sla:read`	`sla:write`
Organisation, usage, status page	`org:read`	`org:write`
Members	`members:read`	`—`

Least privilege

Issue one key per use case. Read-only CI: scenarios:read + runs:read. Pipeline that creates monitors: scenarios:write. Post-deploy smoke job: runs:trigger alone if possible. Webhooks: alerting:write only on the service that owns them.

Revoke as soon as a pipeline or workstation changes. A broad key left in a public fork is an incident, not a backlog note.

Recommended matrix

# usage              scopes
# terraform apply    scenarios:write alerting:write maintenance:write sla:write
# terraform plan     scenarios:read  alerting:read  maintenance:read  sla:read
# smoke post-deploy  runs:trigger runs:read
# dashboard RO       scenarios:read runs:read incidents:read org:read