Guardrail Ledger documentation
API keys and scopes
Guardrail Ledger has one kind of key, the ingest token. It has no configurable scopes.
| Key | Used for | Who can manage it |
|---|---|---|
| Ingest token | Posting SARIF to /api/v1/ingest/sarif from a pipeline. It cannot read findings or change settings. | Workspace owners and admins |
Handling tokens
- Mint a token on the Pipeline page. It is shown once and only its hash is kept.
- Store it as a secret variable. Never put it in a repository file or a screenshot.
- Use one token per pipeline, so you can revoke one without touching the others.
- Revoking a token stops ingest with it at once. Revoke through the API with
DELETE /api/v1/tokens/<id>, signed in as an owner or admin, with a JSON content type and an empty JSON body.
Every mint and revoke is written to the audit log with who did it.