API Keys & Security

Summary

This guide covers the security controls available to platform administrators on skillSYMS. You’ll learn how to review and revoke API keys, audit access logs, and triage security incidents through to resolution.

Who This Guide Is For

• Platform administrators responsible for security posture
• Security and compliance staff investigating access
• On-call staff responding to security incidents

Prerequisites

Before you begin, ensure you have:

• Platform administrator credentials with security permissions
• Your incident response and escalation procedures
• A record of which integrations legitimately use API keys

Step 1: Review API Keys

Navigate to Admin → Security → API Keys.

This screen lists the API keys issued across the platform along with their status. Review it regularly to confirm that every active key maps to a known, legitimate integration.

Tip: Treat any key you can’t attribute to a known integration as suspect — investigate before assuming it’s safe.

Step 2: Revoke a Compromised Key

From Admin → Security → API Keys, locate the key and choose Revoke.

Revocation takes effect immediately and any client using that key will start receiving authentication failures.

Tip: Coordinate with the integration owner before revoking a production key, unless you’re responding to an active compromise — in which case revoke first and notify after.

Step 3: Audit Access Logs

Navigate to Admin → Security → Access.

The access logs screen records authentication and access events. You can:

• Browse and search access events
• Open an event for full detail
• Flag a suspicious event for follow-up

Tip: Flag events as you investigate so the next reviewer can see what has already been triaged.

Step 4: Triage Security Incidents

Navigate to Admin → Security → Incidents.

This screen lists security incidents. For each incident you can:

• Open it to review full detail
• Update its status as it moves through investigation and resolution

Work incidents to closure and keep the status current so the team has an accurate view.

Step 5: Correlate with Access Logs and the Cockpit

When investigating an incident, cross-reference the access logs (Step 3) and the cockpit signal feed to build a complete timeline of what happened and when.

Common Mistakes to Avoid

1. Leaving unattributed keys active: Every active key should map to a known integration
2. Revoking production keys without coordination: Outside of active compromise, notify the owner first
3. Not flagging investigated events: Unflagged events get re-investigated, wasting effort
4. Leaving incidents in limbo: Keep incident status current and drive each to closure

Verification Checklist

During a security review, verify:

• Every active API key is attributable to a known integration
• Compromised or stale keys are revoked
• Suspicious access events are flagged and investigated
• All open incidents have an accurate status
• Incident timelines are corroborated with access logs

Next Steps

• User Management & RBAC — Tighten roles and revoke sessions
• Ops & Monitoring — Watch security signals in the cockpit
• Support Console — Use audited impersonation for investigations