From 99941666c3e89b036b3c4af867475f58180b91d8 Mon Sep 17 00:00:00 2001 From: amosd92 Date: Wed, 5 Aug 2026 11:14:21 +0300 Subject: [PATCH 1/3] Add API token roles docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit API tokens now carry a role (feature flag api-token-roles), and nothing documented it — the legacy Manage API Tokens page predates the feature. New page at docs/open360/settings/api-tokens.md covers: - The four roles: Admin, User and Read-only are assignable; Custom is a fine-grained permission set assigned outside the UI and can't be edited from this table. - Every new token defaults to Admin, including tokens created before roles existed (legacy/rollout tokens are Admin-equivalent on the backend). - Why it matters: scoping a token narrows the blast radius of a leak to what the token was actually issued for. Links out to the existing Manage API Tokens page for create/delete, which is unchanged and out of scope here. Co-Authored-By: Claude Opus 5 (1M context) --- docs/open360/settings/api-tokens.md | 41 +++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 docs/open360/settings/api-tokens.md diff --git a/docs/open360/settings/api-tokens.md b/docs/open360/settings/api-tokens.md new file mode 100644 index 00000000..98050207 --- /dev/null +++ b/docs/open360/settings/api-tokens.md @@ -0,0 +1,41 @@ +--- +sidebar_position: 2 +title: API Tokens +description: API tokens now carry a role that scopes what they can do - Admin, User, or Read-only. +image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg +keywords: [logz.io, api tokens, api token roles, permissions, read-only token, security, manage tokens, settings, observability] +--- + +API tokens under **Settings → Manage Tokens → API tokens** now carry a **role**, so a token can be scoped to what it actually needs rather than defaulting to full account access. + +For creating and deleting tokens, and how each account type gets its own tokens, see [Manage API Tokens](https://docs.logz.io/docs/user-guide/admin/authentication-tokens/api-tokens/) — that part is unchanged. This page covers roles. + +:::note +API token roles are rolling out gradually. If you don't see a **Role** column, it isn't enabled for your account yet — contact [Logz.io support](https://logz.io/support-page/). +::: + +## Roles + +| Role | Assignable | Meaning | +|---|---|---| +| **Admin** | Yes | Full access. The default for any token, including tokens created before roles existed. | +| **User** | Yes | Standard access. | +| **Read-only** | Yes | Read-only access — the one to reach for when a token only needs to pull data out, such as an export job or a read-only integration. | +| **Custom** | No | A fine-grained permission set assigned outside this UI. Custom-role tokens can't be edited here — their role can only be changed through whatever set it in the first place. | + +Every token created here gets **Admin** by default, so if you want a scoped token, set the role explicitly rather than leaving it at the default. + +## Set a token's role + +Select the **Role** column on an existing token to change it, or set it while creating a new one. Read-only and User can be switched freely; a **Custom**-role token shows its role but can't be edited from this table. + +## Why this matters + +A leaked or over-shared token used to mean full account access, whatever it was actually for. Scoping tokens by role means the blast radius of a leaked token matches what it was issued for — a Read-only token used in a dashboard export script can't be used to modify anything, even if it ends up somewhere it shouldn't. + +If you're issuing a token for something read-only — a metrics scrape, a log export, a BI integration — set it to **Read-only** rather than leaving the Admin default. + +## Related + +* [Manage API Tokens](https://docs.logz.io/docs/user-guide/admin/authentication-tokens/api-tokens/) +* [API cookbook](https://docs.logz.io/docs/user-guide/integrations/api-cookbook/cookbook/) From 478bd96e77e55a0a2aae5b6ad9fbef759c6f1824 Mon Sep 17 00:00:00 2001 From: amosd92 Date: Wed, 5 Aug 2026 11:15:49 +0300 Subject: [PATCH 2/3] Drop Custom role from the API tokens page Custom isn't assignable through this UI, so documenting it alongside the three real options added noise without adding anything actionable. Co-Authored-By: Claude Opus 5 (1M context) --- docs/open360/settings/api-tokens.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/docs/open360/settings/api-tokens.md b/docs/open360/settings/api-tokens.md index 98050207..2c40a92a 100644 --- a/docs/open360/settings/api-tokens.md +++ b/docs/open360/settings/api-tokens.md @@ -16,18 +16,17 @@ API token roles are rolling out gradually. If you don't see a **Role** column, i ## Roles -| Role | Assignable | Meaning | -|---|---|---| -| **Admin** | Yes | Full access. The default for any token, including tokens created before roles existed. | -| **User** | Yes | Standard access. | -| **Read-only** | Yes | Read-only access — the one to reach for when a token only needs to pull data out, such as an export job or a read-only integration. | -| **Custom** | No | A fine-grained permission set assigned outside this UI. Custom-role tokens can't be edited here — their role can only be changed through whatever set it in the first place. | +| Role | Meaning | +|---|---| +| **Admin** | Full access. The default for any token, including tokens created before roles existed. | +| **User** | Standard access. | +| **Read-only** | Read-only access — the one to reach for when a token only needs to pull data out, such as an export job or a read-only integration. | Every token created here gets **Admin** by default, so if you want a scoped token, set the role explicitly rather than leaving it at the default. ## Set a token's role -Select the **Role** column on an existing token to change it, or set it while creating a new one. Read-only and User can be switched freely; a **Custom**-role token shows its role but can't be edited from this table. +Select the **Role** column on an existing token to change it, or set it while creating a new one. ## Why this matters From 87a6fb7d746c741c9d625214a8ef760a021267f8 Mon Sep 17 00:00:00 2001 From: amosd92 Date: Wed, 5 Aug 2026 11:19:50 +0300 Subject: [PATCH 3/3] Drop the "Why this matters" section Co-Authored-By: Claude Opus 5 (1M context) --- docs/open360/settings/api-tokens.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/docs/open360/settings/api-tokens.md b/docs/open360/settings/api-tokens.md index 2c40a92a..2b55eaf9 100644 --- a/docs/open360/settings/api-tokens.md +++ b/docs/open360/settings/api-tokens.md @@ -28,12 +28,6 @@ Every token created here gets **Admin** by default, so if you want a scoped toke Select the **Role** column on an existing token to change it, or set it while creating a new one. -## Why this matters - -A leaked or over-shared token used to mean full account access, whatever it was actually for. Scoping tokens by role means the blast radius of a leaked token matches what it was issued for — a Read-only token used in a dashboard export script can't be used to modify anything, even if it ends up somewhere it shouldn't. - -If you're issuing a token for something read-only — a metrics scrape, a log export, a BI integration — set it to **Read-only** rather than leaving the Admin default. - ## Related * [Manage API Tokens](https://docs.logz.io/docs/user-guide/admin/authentication-tokens/api-tokens/)