Developer API
Authentication
Create a developer token and select the correct scopes.
Send one developer token in the Authorization header:
Authorization: Bearer YOUR_TOKEN_SECRETStazus shows the secret once. You cannot recover it later. Revoke the token and create a new token if you lose it.
Scopes
| Scope | Access |
|---|---|
monitoring:read | Read projects, endpoints, checks, and alert state. |
analytics:read | Read team, project, and endpoint analytics. |
incidents:read | Read incidents and incident statuses. |
incidents:write | Create and modify incidents. |
mcp:connect | Connect an AI client through Stazus MCP. It does not grant HTTP API access. |
incidents:write does not include incidents:read. Select both scopes if an integration must read and modify incidents.
Current permissions
Each token belongs to one user and one team. Stazus checks the user's current account and team membership on every request.
The API rejects a token when:
- The token expired or was revoked.
- The token owner is not active.
- The token owner left the team or was removed.
- The token does not contain the required scope.
- A write request comes from a token owned by a viewer.
Changing a team member from editor to viewer immediately blocks that member's API writes.
Store tokens safely
- Store tokens in a secret manager or protected environment variable.
- Do not store tokens in source code.
- Do not send tokens from browser code.
- Give each integration a separate token.
- Select the minimum required scopes.
- Set an expiry when the integration has a known lifetime.
Last updated on