API keys

Use an API key to call the Exploit Shield API from your own scripts or a SIEM. A key acts as you. It has your current role and nothing more.

For the full list of endpoints, query parameters, and schemas, see the API reference.

Create a key

1. Open the user menu (your name, bottom left).
2. Select API keys. The key page opens in a new tab.
3. Create a key. Choose an expiry: 2 weeks to 1 year, or never.
4. Copy the key now. It is shown only once.

Store the key like a password: in a secret manager, not in code or chat.

Use a key

Send the key as a Bearer token to https://api.<your-domain>/v1/...:

curl -H "Authorization: Bearer $EXPLOIT_SHIELD_API_KEY" \
  "https://api.<your-domain>/v1/users/me"

/v1/users/me returns the user the key belongs to. Use it to check a new key.

Page through exposures (for a SIEM poller, for example). Raise offset by limit for the next page:

curl -H "Authorization: Bearer $EXPLOIT_SHIELD_API_KEY" \
  "https://api.<your-domain>/v1/secrets/search?limit=100&offset=0"

See the API reference for all /v1/* routes, filters, request bodies, and response schemas.

What a key can do

• The key has the role of the user who created it. See Roles.
• If an admin changes your role, the key changes with it on the next request.
• If you are removed from Users, the key stops working.

Revoke a key

Archive the key on the API keys page. It stops working within about one minute.

Integrations and SIEM

• Create a dedicated user for each integration (for example siem@yourcompany.com) with the lowest role that works. When a person leaves, their keys stop, and an integration tied to them would stop too.
• Poll at a steady interval, such as every 5 minutes. Don't send bursts.
• Handle these responses:

Status	Meaning	What to do
401	Key is unknown, expired, or archived; the user was removed; or the user's sign-in account is locked, disabled, or unverified	Stop and alert someone. Retrying will not help.
403	The key's role can't do this	Use a user with the right role.
429	Too many requests	Wait, then retry. Honor Retry-After when present.
503	Sign-in service unavailable	Retry with backoff.