Authentication
Bearer tokens for management, ping URLs for reporting.
API tokens
Management endpoints take your personal API token as a bearer token:
curl -H "Authorization: Bearer rp_…" https://api.rippler.io/v1/monitors/Find it under Account → API in the app.
The token belongs to a person, not a team. It carries whatever team you are in and whatever role you have there, which means removing someone from a team revokes their token along with their access — there is no separate list of keys to remember to clean up.
Treat it like a password. Anyone holding it can read and create monitors in your team. Prefer an environment variable over committing it.
A missing, malformed or unknown token gets a 401 with a WWW-Authenticate: Bearer
header.
Ping URLs
Ping endpoints take no token. Each monitor has a ping URL containing a secret id:
https://api.rippler.io/ping/tKwyPF8mHDimhv-s/Holding that URL is the authorisation to report runs for that monitor — and nothing else. It cannot read your monitors, create anything, or reach the rest of your team, which is what makes it safe to paste into a crontab on a machine you do not fully trust.
It is still a secret: anyone with it can report false successes, which would stop you being alerted about a job that is genuinely broken.
Scoping
Every management endpoint is scoped to the team behind the token. A short id
belonging to another team returns 404, not 403 — the API will not confirm that
an id it will not show you exists.