---
title: CyberGate API Access - in depth
slug: cybergate-api-access-in-depth
docTags:
createdAt: 2026-04-08T09:00:00.000Z
---
## Overview
The API Access menu is where you manage the API secrets used to authenticate calls to the CyberGate customer API. Each API secret has a name, a validity period, and a secret value that acts as a Bearer token for API authentication.
***
## API Main functions
The CyberGate API features the following functions:
| **API command** | **Type** | **Description** |
| ------------------------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API Version | Read | Get CyberGate API version. |
| Tenant Information | Read | Get information about authenticated Tenant. |
| Devices | Read | Get all devices of the authenticated Tenant, including their online status. |
| Call Groups | Read | Get CyberGate Call Groups defined for authenticated Tenant. |
| Call Groups
Availability Status | Update | Update a Teams user’s Availability status in a CyberGate Call Group. |
| Active Call | Read | Verifies if the Teams user is in an active CyberGate call and has a door‑open code configured. |
| Active Call
Remote Door Opening | Update | Send a door‑open code for a specific user. The user must be in an active CyberGate device call, and only that device receives the command. |
| Call Log | Read | Get new entries from the CyberGate Call Log |
| Audit Trail | Read | Get new entries from the CyberGate Audit Trail |
| White-list | Read | Get the IP white-list entries of the authenticated Tenant, including their ID. |
| White-list
Add Entry | Create | Add an IP address or IP range to the white-list. |
| White-list
Update Entry | Update | Change the IP addresses, description, location or enabled state of a white-list entry. Properties you leave out keep their current value. See [Dynamic IP address and the white-list](docId\:TtspNqrFB59spgIEX-vWz) for an example. |
| White-list
Delete Entry | Delete | Remove an entry from the white-list. |
***
## Viewing API Secrets
The page displays a table of all configured API secrets with the following columns:
| Column | Description |
| ----------------- | -------------------------------------------------------------------------------------------------------------- |
| **Name** | The name of the API secret. A warning icon appears if the secret is expired or expiring soon (within 20 days). |
| **Secret** | The first few characters of the secret followed by dots. The full secret is only shown once at creation time. |
| **Creation Time** | The date and time the API secret was created. |
| **Expiration** | How many days are left until the secret expires, or how many days ago it expired. |
| **Action** | A button to delete the API secret. |
### Expiration Warnings
- A **warning icon** appears next to the name when the secret will expire within **20 days**.
- A **warning icon** also appears when the secret has already **expired**. Expired secrets can no longer be used for API authentication.
### Sorting
Click any **column header** to sort the table by that column.
***
## Creating an API Secret
You can have a maximum of **4 API secrets** at any time. If you have reached this limit, the Create button will be disabled with a tooltip explaining the restriction.
1. Click the **Create API Secret** button at the top of the page.
2. Fill in the required fields:
| Field | Description |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name** | A descriptive name for the API secret (max 256 characters). This name is used in audit logs for any actions performed with this secret. Special characters like `\ / [ ] " ! @ # $ % ^ & * ( ) = { } ; :` are not allowed. |
| **Validity Period (days)** | The number of days the secret will be valid. Minimum 10 days, maximum 365 days. Default: 90 days. |
3. Click **Generate** to create the API secret.
4. After creation, the modal displays the generated secret value along with a **Copy** button.
:::hint{type="warning"}
*Copy and store the API secret immediately. The full secret value is only shown once and cannot be retrieved later. If you lose it, you will need to create a new secret.*
:::
5. Click **Close** to dismiss the dialog. The new secret now appears in the table.
***
## Using the API Secret
Once you have created an API secret, you can use it to authenticate requests to the CyberGate customer API by including it as a **Bearer token** in the `Authorization` header.
The base URL of the customer API is `https://admin.cybergate.cybertwice.com/api/customer`. This example gets the information about your tenant:
```bash
curl -X GET https://admin.cybergate.cybertwice.com/api/customer/tenant \
-H "Authorization: Bearer "
```
For a complete reference of all available API endpoints, click the **API documentation** link on the API Access page. This opens the interactive API documentation (Swagger UI) where you can explore and test the available endpoints.
***
## Best Practices
- **Rotate secrets regularly** — Create a new secret before the old one expires, update your applications, then delete the old secret.
- **Use descriptive names** — Since the name appears in audit logs, use names that identify the application or purpose (e.g., "Monitoring Dashboard" or "Access Control Integration").
- **Monitor expiration** — Watch for the warning icons that indicate secrets expiring within 20 days. Expired secrets stop working immediately.
- **Limit secret distribution** — Treat API secrets like passwords. Store them securely and avoid sharing them through insecure channels.