API tokens - application access

API tokens (available from version v5.17) enable B2B access to the TAS API without logging in via a user account. They are used to integrate external systems or automated scripts that need to call the TAS API under the identity of a specific system user.

The token is sent in the header of every request:

Authorization: Bearer <token>

Where tokens are managed

Administration → API Tokens

How to generate a token

  1. Go to Administration → API Tokens.
  2. Click the Generate Token button.
  1. Fill in the form:
    • System User (required) — the system user under whose permissions the token will operate,
    • Expiration (days) (optional) — token validity in days (e.g. 365); if left empty, the token never expires,
    • Description (optional) — description of the token's purpose, max. 500 characters.
  2. Click Generate Token.
  3. The token is displayed — copy it immediately.
The token is displayed only once. Once you close the dialog, you can no longer retrieve it — if you don't copy it, you must generate a new one.

Managing existing tokens

The table shows all tokens, including the following details:

  • who created the token,
  • which user the token is bound to,
  • the creation and expiration date,
  • whether the token has been invalidated (Invalidated at).

A token can be invalidated by its creator or by a superadmin.

Invalidating a token is irreversible. If you invalidate a token, you must generate a new one.

Important

  • The token is bound to a system user (not to the logged-in consultant) — API permissions correspond to that user's rights.
  • Invalidating a token cannot be undone — you must generate a new one.
  • Never share a token over unsecured channels.

Frantisek Brych Updated by Frantisek Brych

DB View

Contact

Syca (opens in a new tab)

Powered by HelpDocs (opens in a new tab)