Skip to main content

​
Overview

Every request to the Opsmatic API is authenticated with an API key sent as a bearer token. Keys are scoped by role (a preset bundle of permissions) and, optionally, to a single organization or a single connection.
Requests without a valid Authorization: Bearer … header are rejected with 401 Unauthorized.

​
API Key Format

Opsmatic keys always start with the ops_ prefix:
The full key is shown only once, at creation time. Store it in a secret manager or environment variable — Opsmatic keeps only a hash and can never display the secret again. If a key is lost or leaked, revoke it and generate a new one.

​
Creating a Key

1

Open API Keys

In the dashboard, go to Settings → API Keys (or the API Access area).
2

Choose a role

Pick the role that grants the least access your integration needs (see the table below).
3

Scope it (optional)

Optionally bind the key to a specific organization so it only ever sees that organization’s data.
4

Copy and store

Copy the ops_… value immediately and store it securely.

​
Key Roles

Each role maps to a fixed set of permissions:
usage-ingestion keys are generated automatically when you create an OpenClaw connection and are bound to that connection. You normally don’t create them by hand — see the OpenClaw setup guide.

​
Permission Model

Permissions are expressed as resource: action pairs. The API checks the required permission for each endpoint against your key’s role. If a key lacks the permission an endpoint requires, the request returns 403 Forbidden.

​
Personal vs. Organization Keys

  • Personal keys can access your own connections and connections belonging to any organization you’re a member of.
  • Organization keys are scoped to a single organization and only ever see that organization’s data.
This scoping is applied automatically on every request — you don’t pass an organization ID to “switch” context; the key determines what’s visible. See Organizations for details.

​
Errors

​
Next Steps

Connections API

List, create, update and delete connections

Analytics API

Query executions, availability, incidents and aggregated metrics