Personal Access Tokens

Personal Access Tokens (PATs) allow you to authenticate to the SenseOn Customer Accessible API (CAA) programmatically, without using your account password. Tokens are scoped, expiring, and fully audited.

Common uses include scripting integrations, automating case exports, and feeding SenseOn data into external SIEM or SOAR platforms.

Relationship to SenseOn Connect: PATs use the same underlying token mechanism as the SenseOn Connect API. See SenseOn Connect for a full description of the available API endpoints.

Creating a Token

Navigate to Settings > Integrations > API Configuration.
Click Create Token.
Enter a name that describes the token's purpose (for example, SIEM export or nightly-case-sync).
Set an expiry date. Tokens cannot be created without an expiry.
Select the scopes the token requires (see below).
Click Create.

The token value is displayed once. Copy it immediately: it cannot be retrieved again. If lost, revoke the token and create a new one.

Available Scopes

Scopes control which parts of the API the token can access. Grant only the scopes your integration requires.

Scope	Access granted
`cases/read`	Read case details, observations linked to cases, and AI case summaries
`cases/write`	Update case status and add comments
`devices/read`	Read device and identity records
`observations/read`	Read security observations
`telemetry/read`	Read raw telemetry data
`observations/write`	Create observations (requires prior approval from SenseOn: contact support)
`settings/read`	Read appliance settings, including escalation contacts
`settings/write`	Update appliance settings

Listing Your Tokens

To view all tokens you have created:

Go to Settings > Integrations > API Configuration.
Your tokens are listed with their name, creation date, expiry date, scopes, and last-used timestamp.

Expired tokens are shown with an Expired badge and can no longer be used for authentication.

Revoking a Token

To revoke a token immediately:

Go to Settings > Integrations > API Configuration.
Find the token you want to revoke.
Click the three-dot menu next to it.
Select Revoke.

Revoked tokens are listed with a Revoked status. They cannot be restored. Create a new token if access is still required.

Admin: Viewing All Tokens

Admins can view tokens created by all users in the organisation:

Go to Settings > Integrations > API Configuration.
Toggle the Show all users' tokens switch at the top of the table.

This view shows the token name, owning user, scopes, expiry, and last-used date for every token in the organisation. Admins can also revoke tokens created by other users.

Service Accounts

A service account is a non-human identity for an integration, such as a SIEM export or an automation pipeline. Instead of tying the integration to an individual's personal access token, the integration authenticates as the service account through a single Customer Accessible API token that the account owns.

Service accounts are managed by an Admin at Settings > Service Accounts. A service account holds no role: its access to the API is determined entirely by the scopes granted to its token.

Why use a service account? A personal access token belongs to the user who created it and stops working if that user's account is deleted. A service account is independent of any individual, so an integration keeps running when a team member leaves, and its actions are attributed to the integration rather than to a person.

Service accounts compared to personal access tokens

	Personal access token	Service account
Belongs to	The individual who creates it	The organisation (a non-human identity)
Created by	Any user, for their own use	An Admin, at Settings > Service Accounts
Number of tokens	A user can hold several	Exactly one active token at a time
Expiry	Required	Optional (a token can be set never to expire)
Attribution	The individual's name	The service account's name, with a service-account badge

Creating a Service Account

Go to Settings > Service Accounts.
Click Create service account.
Enter a Name that identifies the integration (for example, SOC Automation).
Optionally enter a Description of its purpose.
Click Create.

The account is created without a token. An identifier is derived from the name at creation and does not change if you later rename the account. Each name must be unique across your service accounts.

Issuing and Rotating the Token

A service account holds at most one active token.

On the Service Accounts page, find the account and click Issue token (or Rotate token if the account already has one).
Under Select the type of access you want to grant, choose the scopes the integration requires (see Available Scopes).
Set an Expiry date, or tick Token never expires.
Click Issue token (or Rotate token).

The token value is displayed once. Copy it immediately: it cannot be retrieved again.

Rotating replaces the existing token immediately. When an account already has a token, issuing a new one revokes the current token straight away. Copy the new token and update the integration immediately after rotating — the old token stops working the instant you rotate.

You cannot issue a token for a disabled account. Re-enable the account first.

Managing a Service Account

Use the row menu on the Service Accounts page to:

Edit details — change the account's name or description.
Disable / Enable — disabling stops the account's token from authenticating without deleting the account. The token works again once the account is re-enabled.
Revoke token — revoke the active token without deleting the account.
Delete — permanently delete the account and revoke its token.

Disable, revoke and delete ask you to confirm first.

Deleting a service account cannot be undone. Its token is revoked and the integration loses access immediately.

Identifying Service Account Actions

Wherever a service account acts through the API, its name is shown with a service-account badge (a key icon) so automated actions are not mistaken for a person's. The badge appears against a service account in case history and case comments, and its tokens are labelled by account name in the Show all users' tokens view of Settings > Integrations > API Configuration.

Token Audit Events

All token lifecycle events are recorded in the audit log:

Event	Description
`caa__pat_created`	A new token was created
`caa__pat_deleted`	A token was revoked

See Audit Log for information on how to access and filter audit events.

Security Best Practices

Use the minimum scopes required: do not create tokens with broad access if your integration only needs to read cases.
Set short expiry dates: rotate tokens regularly, especially for automated pipelines.
Revoke tokens when no longer needed: for example when an integration is decommissioned or a team member with access to the token leaves.
Store tokens securely: treat a PAT like a password. Do not commit tokens to source control or share them in plaintext.