Manage API keys
API keys let external tools access NimbusWiz programmatically with scoped permissions. Follow least privilege: assign only the scopes each key needs.
Scopes
| Scope | Access |
|---|---|
fleet:read | Read systems, system details, system status |
fleet:write | Register systems, update system metadata |
deployments:read | Read deployment history and status |
deployments:write | Create and manage deployments |
webhooks:read | Read webhook configurations and delivery history |
Only fleet:read and fleet:write have endpoint specifications in the API reference. The others are placeholders for future resources.
Generate a key
Go to Developer Hub > API Keys > Generate Key.
| Field | Notes |
|---|---|
| Key Name | Use a descriptive label, like "CI/CD Pipeline" or "Datadog Integration" |
| Expiration | Choose Never, 30 days, 90 days, or 1 year. Rotate keys with no expiration manually on a schedule. |
| Scopes | Select only the scopes this key needs |
The full key appears once. Copy and store it securely; NimbusWiz won't display it again.
Generate is scaffolding and not yet functional. Use the NimbusWiz API directly to generate keys programmatically in the meantime.
View your API keys
On the API Keys tab, each row shows the key name and creator email, the first 14 characters of the key (masked after that), scopes assigned, last used timestamp, request count for today, and action icons for revoke and rotate.
Revoke a key
Select the trash icon to revoke the key. Revocation is instant, no confirmation required. Revoked keys remain visible in the list at reduced opacity.
This feature is in progress. Selecting the trash icon doesn't currently revoke the key. Key revocation through the UI will be available in a future release.
Any integrations or pipelines using a revoked key receive 401 Unauthorized responses. Update integrations with the new key before revoking the old one to avoid downtime.
Rotate an API key
Key rotation replaces an existing key with a new one, typically on a regular schedule or after a suspected compromise. NimbusWiz doesn't rotate keys automatically. Rotation is manual.
To rotate a key with zero downtime:
- Generate a new key with the same name and scopes as the key you're replacing.
- Update all integrations and pipelines to use the new key.
- Verify each integration is working with the new key.
- Revoke the old key.
This sequence keeps the old key valid while integrations are updated, so there's no gap in access.
View key activity
To see when a key was last used, check the Last Used column in the API Keys list. Values are relative, for example "2 hours ago" or "3 days ago," and reflect the most recent successful API request made with that key.
NimbusWiz records every key generation and revocation event in Audit Logs automatically. To review the full key history for your organization, see Review audit logs.