API Keys (Developer)

Generating a key

Keys are created via the dashboard at Account → API Keys → Create API key. There is no API endpoint for creating keys — this is intentional, to prevent a compromised key from creating new keys.

When you create a key, you specify:

• Name — a human-readable label (e.g., “CI pipeline”, “Grafana integration”)
• Scopes — which data the key can access (see Scopes)
• Expiry — optional expiration date; if set, the key automatically becomes invalid after this date

The key value is shown once at creation time. Copy it immediately and store it in a secrets manager. It cannot be retrieved again from the dashboard or API.

Key format

vis_live_<32-character hex string>

Example: vis_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

Always include the full string — prefix and all — as the bearer token value.

Using a key in requests

curl https://visibilityiq365.com/api/v1/projects \
  -H "Authorization: Bearer vis_live_YOUR_KEY_HERE"

Or in code:

const response = await fetch('https://visibilityiq365.com/api/v1/projects', {
  headers: {
    'Authorization': `Bearer ${process.env.VISIBILITYIQ_API_KEY}`,
  },
});

Never hardcode a key in source code. Use environment variables or a secrets manager.

Rotating a key

To rotate a key safely without downtime:

1. Create a new key with the same scopes as the old one
2. Deploy the new key to your integration (update the environment variable or secret)
3. Verify the new key is working correctly
4. Revoke the old key

Step 4 is important — leaving old keys active is a security risk.

Revoking a key

Go to Account → API Keys, find the key, and click Revoke. Revocation is immediate — the key will return 401 Unauthorized on the next request.

There is no undo. If you revoke a key that’s still in use, you must create a replacement.

Key hygiene

• Use a unique key per integration (CI, monitoring, reporting dashboard, etc.)
• Set expiry dates for keys used in temporary environments
• Rotate keys after any potential exposure (leaked log, compromised system)
• Scope keys to minimum required access
• Never share keys across team members — each integration should have its own key

Listing active keys

Go to Account → API Keys to see all active keys, their scopes, creation dates, last-used timestamps, and expiry dates. Last-used timestamp is updated at most once per hour to avoid write amplification.