CyberGate API Access - in depth

Overview

The API Access menu is where you manage the API secrets used to authenticate calls to the CyberGate customer API. Each API secret has a name, a validity period, and a secret value that acts as a Bearer token for API authentication.

API Main functions

The CyberGate API features the following functions:

API command	Type	Description
API Version	Read	Get CyberGate API version.
Tenant Information	Read	Get information about authenticated Tenant.
Devices	Read	Get all devices of the authenticated Tenant, including their online status.
Call Groups	Read	Get CyberGate Call Groups defined for authenticated Tenant.
Call Groups Availability Status	Update	Update a Teams user’s Availability status in a CyberGate Call Group.
Active Call	Read	Verifies if the Teams user is in an active CyberGate call and has a door‑open code configured.
Active Call Remote Door Opening	Update	Send a door‑open code for a specific user. The user must be in an active CyberGate device call, and only that device receives the command.
Call Log	Read	Get new entries from the CyberGate Call Log
Audit Trail	Read	Get new entries from the CyberGate Audit Trail
White-list	Read	Get the IP white-list entries of the authenticated Tenant, including their ID.
White-list Add Entry	Create	Add an IP address or IP range to the white-list.
White-list Update Entry	Update	Change the IP addresses, description, location or enabled state of a white-list entry. Properties you leave out keep their current value. See Dynamic IP address and the white-listDynamic IP address and the white-list for an example.
White-list Delete Entry	Delete	Remove an entry from the white-list.

Viewing API Secrets

The page displays a table of all configured API secrets with the following columns:

Column	Description
Name	The name of the API secret. A warning icon appears if the secret is expired or expiring soon (within 20 days).
Secret	The first few characters of the secret followed by dots. The full secret is only shown once at creation time.
Creation Time	The date and time the API secret was created.
Expiration	How many days are left until the secret expires, or how many days ago it expired.
Action	A button to delete the API secret.

Expiration Warnings

A warning icon appears next to the name when the secret will expire within 20 days.

A warning icon also appears when the secret has already expired. Expired secrets can no longer be used for API authentication.

Sorting

Click any column header to sort the table by that column.

Creating an API Secret

You can have a maximum of 4 API secrets at any time. If you have reached this limit, the Create button will be disabled with a tooltip explaining the restriction.

Click the Create API Secret button at the top of the page.

Fill in the required fields:

Field	Description
Name	A descriptive name for the API secret (max 256 characters). This name is used in audit logs for any actions performed with this secret. Special characters like \ / [ ] " ! @ # $ % ^ & * ( ) = { } ; : are not allowed.
Validity Period (days)	The number of days the secret will be valid. Minimum 10 days, maximum 365 days. Default: 90 days.

Click Generate to create the API secret.

After creation, the modal displays the generated secret value along with a Copy button.

Copy and store the API secret immediately. The full secret value is only shown once and cannot be retrieved later. If you lose it, you will need to create a new secret.

Click Close to dismiss the dialog. The new secret now appears in the table.

Using the API Secret

Once you have created an API secret, you can use it to authenticate requests to the CyberGate customer API by including it as a Bearer token in the Authorization header.

The base URL of the customer API is https://admin.cybergate.cybertwice.com/api/customer. This example gets the information about your tenant:

curl -X GET https://admin.cybergate.cybertwice.com/api/customer/tenant \
  -H "Authorization: Bearer <your-api-secret>"

For a complete reference of all available API endpoints, click the API documentation link on the API Access page. This opens the interactive API documentation (Swagger UI) where you can explore and test the available endpoints.

Best Practices

Rotate secrets regularly — Create a new secret before the old one expires, update your applications, then delete the old secret.

Use descriptive names — Since the name appears in audit logs, use names that identify the application or purpose (e.g., "Monitoring Dashboard" or "Access Control Integration").

Monitor expiration — Watch for the warning icons that indicate secrets expiring within 20 days. Expired secrets stop working immediately.

Limit secret distribution — Treat API secrets like passwords. Store them securely and avoid sharing them through insecure channels.