# API Access The **API** lets your own systems read your Device Inventory Manager data: Power BI reports, a SIEM, inventory scripts. Access is **read-only** and limited to **your tenant**. > **Required:** the **API add-on**, enabled by your CyberGuard sales representative. > The API add-on is available from the **Advanced** plan. --- ## What you can read Each connection (client) is granted one or more **data scopes**. A scope is available only if the matching feature is included in your license. | Scope | Data | Status | |-------|------|--------| | `devices.read` | Devices: hardware, operating system, primary user, compliance state, encryption, lifecycle | Available | | `compliance.read` | Compliance state and encryption per device, compliance summary | Available | | `audit.read` | Audit log: activity of your users and of your API clients | Available | | `apps.read` | Installed applications | Coming soon | | `updates.read` | Windows Update, drivers, BIOS | Coming soon | | `warranty.read` | Warranties and rentals | Coming soon | | `assets.read` | Assets, extra devices, inventory | Coming soon | | `network.read` | Network devices and IPAM | Coming soon | The API never returns BitLocker recovery keys or LAPS passwords. A client sees **all the devices of the tenant**. Visibility groups apply to portal users, not to the API. --- ## Create a connection 1. Open **Tenants → Edit → API** in the portal. 2. Under **New client**, enter a name (for example `Power BI`) and select the data the client can read. 3. Click **Create client**. 4. Copy the **Client ID** and the **Client secret**. > **The secret is shown only once.** It is not stored in readable form and cannot be recovered. If you lose it, renew it. Grant only the scopes the connected system needs. If a secret is exposed, the damage stays limited to that data. The same page shows the **API address** to use. Copy it from there: it depends on the region where your data is hosted. Up to **3 active clients** per tenant. --- ## Manage connections The **Credentials** table lists every connection with its status, data scopes, secret expiry, creation and last use. | Action | Effect | |--------|--------| | **Renew secret** | Creates a new secret. The previous one stays valid, so the connected system keeps working while you update it. | | **Revoke previous secret** | Shown only while two secrets are valid. Use it once the system uses the new secret. | | **Revoke** | Disables the client and all its secrets. Calls are rejected within a few minutes. | | **Delete** | Removes a revoked client from the list. It remains recorded in the audit log. | Secrets are valid for **12 months**. Renew them before they expire. Every operation on clients, and every token issued or denied, is recorded in the **Audit log** with date, user and IP address. --- ## Limits Your API package sets three limits: | Limit | Applies to | |-------|------------| | Requests per minute | Each client | | Calls per day | The whole tenant, resets at midnight in your time zone | | Calls per month | The whole tenant | One request counts as one call, regardless of the number of records returned. The **API** page shows the calls used this month and today. When a limit is reached the API answers `429 Too Many Requests` with a `Retry-After` header. The **Endpoints** page describes the response headers. --- ## Next steps - **Authentication**: how to get a token and call the API - **Endpoints**: available data, filters, pagination, errors - **Power BI**: ready-to-use query for Power BI reports