Every request to https://api.statusbee.co/user/* carries a bearer token in the Authorization header. For integrations that token is an API key. The dashboard uses the same endpoints with a session token, so anything you can do in the dashboard you can do with a key that has the right scope.
curl "https://api.statusbee.co/user/workspaces" \
-H "Authorization: Bearer sb_live_…"Create a key
Keys are created in the dashboard under Settings, API keys, or with the API keys endpoints. Each key has a name, a scope, and optionally a workspace. The raw key is shown exactly once; only a hash is stored, so a lost key must be revoked and replaced.
Keys start with sb_live_. Keys from a test environment start with sb_test_.
Scopes
| Scope | Grants |
|---|---|
read | Every read permission on the key's workspace: pages, components, incidents, maintenance, monitors and their checks, subscribers (masked), analytics, the audit log. |
write | Everything, including creating incidents, changing component status, managing monitors, pages, subscribers and webhooks. |
A key can have both scopes. There is no finer-grained scope; if you need a key that can only post incidents, create it in a workspace that only holds the relevant page.
Workspace-bound and organisation-wide keys
A key created with a workspace_id acts inside that workspace only. A key created without one is organisation-wide and must say which workspace each request is for, with the X-Workspace-Id header:
curl "https://api.statusbee.co/user/incidents?workspace_id=5" \
-H "Authorization: Bearer sb_live_…" \
-H "X-Workspace-Id: 5"Requests for a workspace the key's organisation does not own answer 404, the same as a workspace that does not exist.
Limits
The number of keys per organisation depends on the plan: none on Free, three on Starter, ten on Team. Revoked keys do not count. Creating a key past the limit answers 403 with the code PLAN_LIMIT.
What keys cannot do
- Start a checkout or change billing. Those need a signed-in person.
- Invite or manage team members.
- Read another organisation's data, under any circumstances.