- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Securing API Access
API tokens grant the same access as the user who created them, so the connection and the tokens both need to be protected.
Encrypted Connections
The CertSecure Manager API accepts requests over HTTPS only, so the token and all request and response data are encrypted in transit with TLS. The calling system must trust the TLS certificate presented by the CertSecure Manager backend.
- If the backend certificate is issued by a public CA, no additional configuration is usually needed.
-
If it is issued by an internal CA, add the root and intermediate CA
certificates to the trust store of the calling system, or point your client
to them, for example with the
--cacertoption of curl. - Do not disable certificate validation in production scripts.
curl --cacert /path/to/ca-chain.pem -X GET "https://<certsecure-backend-url>/check_token" \
-H "Authorization: Bearer <token>"Protecting API Tokens
- Treat API tokens as passwords. Store them in a secrets manager or a protected configuration file, not in source code or scripts that are shared.
- Always send tokens in the Authorization header, never in the URL.
- Create a separate token for each integration so that one can be revoked without affecting the others.
- Set the shortest validity period that fits the integration, and restrict each token to trusted IP addresses where possible.
- Generate tokens from accounts that hold only the permissions the integration needs.
- Revoke tokens that are no longer used or may have been exposed, and delete them once revoked.
Access Control
Every request runs with the permissions of the user who owns the token.
Role-based access control and department scoping apply to the API exactly as
they do in the portal: a request for an operation or a resource outside the
scope of the user returns 403 Forbidden. For details, refer to
Administration > Roles &
Permissions.
Auditing
Operations performed through the API are recorded in the CertSecure Manager logs with the user who performed them, the same as operations performed in the portal. For details, refer to Miscellaneous > Logging.