Automate
Anything you can do in the App, you can do against the API. Personal access tokens are how non-interactive code authenticates; the four-axis scope cube is how you constrain what those tokens can do.
Create a personal access token
Mint a PAT from the App's API explorer. Stash the secret once — it can't be re-read.
Scope a token
Four axes — method × path × tenant × account. Pick the smallest cube that lets the job run.
Exchange a PAT for a JWT
Long-lived PAT becomes a short-lived JWT. The standard move for systems that don't want to carry the secret in every request.
Connect an AI agent
Point an MCP client at Airbrx so an agent can observe, propose, preview, and write — inside your own permissions.
Audit configuration changes
Numbered revisions of every config and rules write. Read the timeline, diff two revisions, restore forward.
When to reach for the API instead of the App
- You're scripting rule changes from a config repo.
- You're pulling analytics into a custom dashboard or alert.
- You're integrating with a sibling service — your ETL platform posts a marker after every load.
- You're running a one-off audit and want output you can grep.
- You're giving an AI agent a scoped seat on the control plane.
Anything else — a single rule edit, an investigation, an invite — stays in the App. The API surface and the App surface are equivalent in what they can do; one is meant for hands-on work, the other for software.
The audit trail follows the token
Every API call carries the identity behind the token: the person who minted it, the tenant it was scoped to, the action taken. Tokens that aren't tied to a real person (service accounts) get a clearly-named PAT and are audited as that PAT — the audit log doesn't lose its meaning when the actor is a script.
Mint your first PAT
Open the API explorer in the App. The mint flow is one form.
Create a personal access token