ℹ️ Note:
API access tokens can only be created by users with the admin role.
An Authorization bearer token must be included in the header of every request you make to the Intruder API.
API access tokens are personal access tokens, i.e., they are linked to your Intruder user account.
Understanding API token permissions
The Intruder API is exclusively available to Admin users. Manage, Scan, and Read-only users cannot create API tokens. When you generate an API token, it functions as a personal access token. This means the token carries the exact same full administrative permissions as the user who created it, granting account-wide access to all targets, scans, and issues.
Important notes on token scope:
No permission scoping: API tokens cannot be scoped or restricted to specific targets, tags, or narrower permission sets.
Portal vs. API restrictions: While you can use permission controls to restrict user access by tag within the Intruder web portal, these tag restrictions do not apply to the API. Anyone possessing the API token will have full, unrestricted admin access via the API.
Create an API access token
To create an API access token, head to Account > Settings > My account.
⬇️
Once you are here, click the "Create Access Token" button, enter a name that describes what this token will be used for, and (optionally) specify an expiry date after which the token will automatically be revoked.
You will then be prompted to enter your Intruder User Account password and select "Confirm Password"
And that's it! Your new token will be created and shown below. Once you've created the access token, please ensure you save the token in a safe place (e.g., a password manager) as you won't be able to access it again.
Revoke an API access token
If you need to revoke the access token at any time, just click the trash can icon on the right under the 'Active Access Tokens' section.
💡 Tip: For more information on how to use the Intruder API, please check out the Intruder Developer Hub.