Authentication and tokens
The audit log and evaluation results APIs are available for Business and MSP organizations. The token determines the organization; a Cookie or organization ID query parameter cannot select another organization.
Authorization
Authorization: Bearer $SPECTRA_AUDIT_TOKENIssue and store a token
An OWNER or ADMIN enters a name in Settings → Plans and API. Select at least one of audit:read and reports:read when issuing the token. The form defaults to audit:read. The audit log API requires audit:read; the evaluation results API requires reports:read. Issue a new token to change scopes later. The complete secret is displayed once at issuance. The display page expires after 10 minutes. Store it securely and keep it out of shared screens and logs.
Tokens expire 365 days after issuance or reissuance. Create a new token after expiry.
Suspend, resume, reissue and revoke
- Suspend: temporarily disables the token without extending its expiry.
- Resume: removes suspension. Revoked and expired tokens cannot be resumed.
- Reissue: creates a new token with the same name and scopes and revokes the old token atomically. Reissuing a suspended token produces an active replacement. Update your collector’s stored secret.
- Revoke: irreversible. Create a new token if needed.
Tokens are automatically revoked when their issuer leaves or is removed from the organization, loses OWNER / ADMIN privileges, or has their account banned. Existing tokens can still be revoked after the organization moves to an ineligible plan.
Machine Bearer requests do not need an authenticator code when organization MFA is required. The token management screens follow the organization’s authentication requirements. Source IP restrictions apply to the API too.