Managing API keys

An API key authenticates requests to the Sublime API. This page covers the Sublime platform API keys you manage from the API page, not the third-party integration credentials (for example, the CrowdStrike Falcon Sandbox client ID and secret) that live on the Account page for each specific integration.

The API page

Go to API in the left nav, under Developers, to see every API key in your org: its name, its key value, who created it, that user's role at the time of creation, when it was created, and its expiration date and status (Active or Expired).

📘

Redacted key display

Depending on your deployment, the Key column shows either the full key value or a redacted prefix followed by .... Copy a key's full value at creation time. Sublime doesn't display it again afterward.

Creating an API key

1. Go to API, under Developers in the left nav.
2. Click Create API key.
3. Enter a name for the key.
4. Set an expiration date, if required (see below).
5. Click Create, then copy the key value. You won't be able to view it again.

Setting an org-wide expiration policy

Admins can require every new API key to expire within a maximum duration, reducing exposure from unused or outdated credentials.

1. Go to Admin > Account.
2. Find the API Keys section and choose a maximum duration from Set API key expiration (for example, 90 days, 1 year, or None).
3. Click Apply.

Once a maximum duration is set, an expiration date becomes required for every new key, capped at that duration. Existing keys aren't affected. Setting the policy back to None removes the requirement for new keys.

Permissions

Creating, reading, and deleting API keys each require their own permission (create_api_keys, read_api_keys, delete_api_keys). By default, an Engineer or Analyst can only manage the API keys they created, while an Admin can manage any API key in the org. See Role-Based Access Control (RBAC) for the full permission table.