Authentication and Headers

Every request to a BigPanda API must include an Authorization header with a Bearer token. Depending on the endpoint, you also set headers that declare the content type of the data you send and the format you want back.

Authorization

BigPanda uses Bearer authentication. The token is either a User API Key or an Org Token:

User API Key — scoped to a user and limited by that user's role. Required for all current APIs.

Org Token — organization-wide, available only on the inbound Alerts API and a few legacy endpoints.

See Access Management for details on creating and managing authentication tokens.

Required headers

Include these headers on most requests:

Authorization: Bearer <your_api_key>
Accept: application/json
Content-Type: application/json; charset=utf8

Authorization: Your Bearer token. Required on every request.

Accept: The response format you want. Most endpoints return JSON.

Content-Type: The format of the payload you send. Required on POST and PUT requests with a body.

Content types

Most BigPanda APIs accept and return JSON. Send application/json unless an endpoint's reference states otherwise. See Making requests for content type details and exceptions.

Keep authentication secure
Add authentication headers only in the secure tool you use to make API calls. Store tokens in environment variables or a secret manager, never in shared code.

Next steps

Making requests: HTTP methods, content types, and timestamps.

Responses: What BigPanda returns, including auth errors.

Best practices: Secure your credentials and integration.

Authorization#

Required headers#

Content types#

Next steps#

Authorization

Required headers

Content types

Next steps