Managing API tokens in Striim Cloud

Use a PAT for personal API tasks such as testing, local scripts, and developer utilities. Each PAT is bound to a single user and should not be shared with other users or embedded in shared code.

To create a new PAT:

To replace an existing PAT, rotate (also referred to as regenerate) the token. Rotating a PAT immediately invalidates the current token and generates a new one. Only one active PAT is allowed per user.

To rotate a PAT:

If a PAT is no longer required or you suspect it has been exposed, revoke it. Revoking a PAT immediately invalidates the token and prevents any further API requests using that token.

To revoke a PAT:

To create a service account token:

Administrators can rotate a service account token to generate a new token value and reset its expiry period. Rotating a token immediately invalidates the existing token.

To rotate a service account token:

If a service account token is no longer required or has been compromised, revoke it. Revoking a token permanently deletes it and immediately prevents any further API requests using that token.

To revoke a service account token:

Administrators can disable personal access tokens across the entire organization. When disabled, all existing PATs become invalid immediately and users cannot create new PATs. Use this control for rapid security lockdowns. Re-enabling PATs does not restore previously disabled tokens; users must create new PATs.

All token operations (creation, rotation, and revocation) are recorded in account-level audit logs. Audit entries include the actor, action, target token, and timestamp, allowing administrators to trace usage and enforce compliance. Metrics such as the number of service accounts and PATs created, rotated, or revoked, as well as API usage by token type, provide visibility into adoption and help inform security policies.

Striim Cloud automatically sends email notifications before tokens expire. Owners of PATs receive notifications seven and three days prior to expiry. Administrators are notified about service account tokens that are about to expire.

API requests must be sent to your account-specific subdomain. Replace {your-account} with your Striim Cloud account short name.

The base URL for your account is also displayed on the Personal Token tab of the Token Management page in the Striim Cloud portal.

The following endpoints manage service account tokens. All service account endpoints require administrator-level authentication (a bearer token of an account admin or another service account token).

curl -X GET "https://{your-account}.striim.cloud/api/v1/service-accounts" \
  -H "Authorization: Bearer <your-token>"

curl -X POST "https://{your-account}.striim.cloud/api/v1/service-account" \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app_automation",
    "description": "Token for automation",
    "expires-at": "2027-02-09T00:00:00Z"
  }'

{
  "token-id": 12345,
  "name": "app_automation",
  "token": "9AbCdEfG3h4I-jKlMn-OpQrStUvWx",
  "expires-at": "2027-02-09T00:00:00Z"
}

curl -X POST "https://{your-account}.striim.cloud/api/v1/service-account/rotate" \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app_automation",
    "expires-at": "2028-02-09T00:00:00Z"
  }'

{
  "name": "app_automation",
  "token-id": 9121,
  "token": "3XnFhHLnzuMH.5eN78ZMlKaVUjibC",
  "updated-at": "2026-03-11T06:19:25.758175685Z",
  "updated-by": 8509,
  "expires-at": "2028-02-09T00:00:00Z"
}

curl -X DELETE \
  "https://{your-account}.striim.cloud/api/v1/service-account?name=ci-pipeline" \
  -H "Authorization: Bearer <your-token>"

The following endpoints manage personal access tokens. Users can manage their own tokens, while administrators can also manage tokens for other users.

curl -X GET "https://{your-account}.striim.cloud/api/v1/user-token" \
  -H "Authorization: Bearer <your-token>"

curl -X GET \
  "https://{your-account}.striim.cloud/api/v1/user-token?email=user@example.com" \
  -H "Authorization: Bearer <your-token>"

curl -X POST \
  "https://{your-account}.striim.cloud/api/v1/user-token/rotate" \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "expires-at": "2027-02-09T00:00:00Z"
  }'

curl -X DELETE \
  "https://{your-account}.striim.cloud/api/v1/user-token?email=user@example.com" \
  -H "Authorization: Bearer <your-token>"

curl -X DELETE \
  "https://{your-account}.striim.cloud/api/v1/user-token?user-id=1234" \
  -H "Authorization: Bearer <your-token>"

The following endpoints manage account-level token governance settings. These endpoints require administrator-level authentication.

curl -X GET "https://{your-account}.striim.cloud/api/v1/user-token/status" \
  -H "Authorization: Bearer <your-token>"

curl -X PATCH "https://{your-account}.striim.cloud/api/v1/user-token/status" \
  -H "Authorization: Bearer <your-token>"

The following table lists the common HTTP status codes returned by the API.

Striim Cloud enforces the following rate limits per token management operation.

Implement exponential backoff in automated workflows to avoid hitting rate limits.