Skip to main content
The Public API, organization API keys, and personal access tokens are available on Pro and Enterprise plans with an active subscription.
Use the Public API to manage incidents, teams, on-call, integrations, status pages, users, organizations, and audit logs from anywhere. You authenticate with either an organization API key (machine-to-machine) or a personal access token (as a specific person).

​
Hosted APIs

​
US Hosted API (allquiet.app)

​
EU Hosted API (allquiet.eu)

​
Authentication

You can authenticate your API requests in two ways. Both methods are equivalent — choose the one that best fits your client.
  1. Using the X-Api-Key header:
  1. Using the standard Authorization Bearer token:
Use an organization API key or a personal access token in place of your-api-key. Out-of-scope calls return 403.

​
Choose a credential

Organization API keys are for pipelines and other machine-to-machine automation. Personal access tokens never do more than that person can do in the product, even if the token’s scopes look broader.

​
Organization API keys

Create and manage organization API keys under Organizations → [your organization] → API Keys. Creating or editing a key is available to the Organization Owner and the Billable User. When you create or edit a key, you can configure:
  1. Display name, optional expiry, and an optional IP Filter (public IPs or CIDR ranges; private/local IPs are not allowed).
  2. Resources and permissions — grant only what the key needs, per resource (for example Incidents, Teams, On-Call, Integrations, Status Pages, Audit Log). Permissions are get, list, create, update, and delete where that resource supports them. SCIM uses a separate provision permission on organization keys only.
  3. Teams — optionally Scope to specific teams. If you leave this off, the key can act on all teams in its organization scope.
Organizations — on a root organization, optionally Scope to specific organizations (the root and/or child orgs). Child-org keys stay bound to that org.
Leaving Unrestricted resources on grants full read and write to every API resource. That is not recommended. Scope the key to the resources and teams your pipeline actually needs.

​
Expired keys and last used

Expired organization keys stay in the list, marked expired. They are read-only except Revoke — you cannot edit scopes after expiry. Each key shows last used time, IP, user agent, and action.

​
Personal access tokens

A personal access token (PAT) lets a person (or an agent acting as that person) call the Public API as themselves. Create tokens under Account → Security → Personal Access Tokens → Create personal access token. The control surface matches organization keys:
  1. Display name, optional expiry Optional IP Filter
  2. Resource scopes and permissions (get / list / create / update / delete)
  3. Optional Scope to specific organizations (orgs you belong to)
  4. Optional Scope to specific teams
Effective access is the intersection of (1) the token’s scopes and (2) the user’s live roles. If the person cannot do it in the UI, the agent cannot do it either. Out-of-scope calls return 403. PATs cannot: Any user on Pro or Enterprise can create a PAT, unless their organization has disabled PAT creation. On Standard, the Security tab explains that PATs are a Pro/Enterprise feature. Expired PATs stay in the list, marked expired. They are read-only except Revoke. Each token shows last used time, IP, user agent, and action.

​
Organization control of personal access tokens

Organization owners can stop new PATs and govern PATs that belong to users in the org. Open Organizations → [your organization] → API Keys, then the Personal Access Tokens section. Policy and revocation are available to the organization Owner and the billing account holder.
  1. Disable personal access token creation — when on, users cannot create new PATs that would be tied to this organization, and existing PATs can no longer access this organization’s resources.
  2. Enforced IP Filter — optional org-wide rule. All public API requests that act on this organization (PATs and organization API keys) must come from these public IPs or CIDR ranges.
  3. Manage Tokens — view and revoke personal access tokens of users provisioned into this organization (display name, scopes, teams/orgs, expiry, last used). For compliance, only provisioned users’ tokens are listed.

​
Provisioned resources

Provisioned means the resource is treated as managed outside the click UI and is read-only in the web app, so Git/Terraform stay the source of truth. Provisioned resources include teams, integrations, status pages, routings, memberships, and similar. How it works:
  • Create without provision=true → the resource stays editable in the UI.
  • Update without a provision flag → the existing lock state is preserved (unlocked stays unlocked; already locked stays locked).
  • Terraform → still provisioned / UI-locked. That provider behavior is unchanged.
  • PAT → cannot lock; cannot edit already locked resources.
To lock a resource with an organization API key (for example a custom automation that should behave like Terraform), pass provision=true on create or update. Pass provision=false on update if you intentionally want to release the lock. This parameter is not available on PATs. If you do nothing, resources you create via PAT or organization API key remain editable in the product. Existing automations that assumed “anything we write via API is locked in the UI” need to either use Terraform or pass provision=true on organization keys.

​
Using the API with agents

All Quiet is the control plane for your agents — not a vendor chatbot over your incident data. You bring your own LLM. Inference stays on your side (EU or US data residency for All Quiet data). We do not run models on your incidents.
  • Every user can get a scoped PAT; organization keys remain for pipelines and Terraform.
  • The public API covers incidents, teams, escalations, on-call, overrides, inbound/outbound integrations, mappings, payloads, status pages, routing, users, organizations, and audit logs — each with its own get/list/create/update/delete scopes.
  • Guardrails: per-resource scopes, optional team and org allowlists, expiry, IP filters. Out-of-scope calls return 403.
Agents can triage, check who is on-call, create overrides, and configure integrations as a specific engineer, under least privilege. See AI Incident Management and the Swagger docs linked above.

​
Audit logging of keys

Revealing an organization API key or personal access token is recorded as a read/view for security — not only create, update, and revoke.
  • Auditing — the standard audit log records an API key reveal as Viewed.
  • Auditing → API Key Events — dedicated key lifecycle: Created, Updated, Revoked, Viewed, Authenticated, Authentication Failed (with IP and user agent).
When someone reveals the full secret in the product, both the organization audit log and the API key event log record that view. Creates, updates, and deletes of other auditable resources continue to be attributed to the key that performed them. Auditing is an Enterprise add-on.