Skip to main content
An API key authenticates programmatic requests to the 2501 API without a user session. Generate one from Settings to script against your inventory — hosts, agents, tasks, and the rest of the versioned API — from outside Command Center.
API Keys

Settings → API Keys: name, scope, and expiry, each row with revoke.

​
Creating a key

Only administrators can create API keys. Open Settings → API Keys and click New API Key.
  • Name — a label to recognize the key later, e.g. cmdb-sync.
  • Scope — This organization limits every call made with the key to your current organization. Tenant-level administrators can instead choose Entire tenant, which lets the key act on any organization in the tenant. Org-level administrators can only mint org-scoped keys.
  • Expiration — 30 days, 90 days, or 1 year, or check Never expires for a key with no expiry (up to 10 years out).
The raw key is shown exactly once, immediately after creation. Copy it before closing the dialog — 2501 stores only its hash and cannot show it to you again. If you lose it, revoke it and create a new one.

​
Using a key

Send it as a bearer token on the versioned API:
A request with a valid key is treated as an administrator within the key’s scope — full read/write on that organization, or the whole tenant for a tenant-scoped key. This reach is fixed at creation time: it does not change if the user who created the key is later demoted, removed, or loses org access. Only revoking or expiring the key changes what it can do. An API key cannot be used to create, list, or revoke other API keys — key management stays session-only, so a leaked key can’t mint itself a successor.

​
Revoking a key

Any administrator can revoke any key in the tenant from the API Keys list, regardless of who created it. Revoking is immediate and permanent — there is no un-revoke, only creating a new key. An expired key stops working on its own once its expiration date passes; you don’t need to revoke it separately.