API & Integrations

Compatibility mode accepts the trusted internal UI model while authenticated local HTTP can still be configured.

Require tokens externally should be enabled before exposing API access beyond trusted internal use. Create an administrator-scoped client first so you do not lock out management access.

New API client creates a named integration with a type, expiration, optional rate-limit override and selected scopes.

Use presets such as Read only, Automation, Profiles or Administrator as a starting point, then keep only the scopes the integration genuinely needs.

Client tokens are shown only once and stored as one-way hashes. Save the token securely at creation time.

Network policy controls which addresses/origins can reach the external API.

Rate limits control request volume and burst allowance globally or per client.

Audit policy controls operation metadata retention and maximum log size.

Use health, uptime, latency, active streams, client sessions and recent traces to distinguish client, network and server failures. Reset metrics only when you intentionally want a fresh diagnostic baseline.

The audit log records bounded operation metadata, result and duration. Request inputs, response payloads, tokens, cookies and script source should not be recorded there. Use filters to find a client or operation before clearing audit history.