Authentication
Use personal bearer tokens to manage monitors and secret ping URLs to report runs.
API tokens
Management endpoints take your personal API token as a bearer token:
curl -H "Authorization: Bearer rp_…" https://api.rippler.io/v1/monitors/Find it under Account → API in the app.
The token belongs to a person, not a team. It carries whatever team you are in and whatever role you have there, so removing someone from a team revokes their token along with their access.
Treat it like a password. Anyone holding it can read and create monitors in your team. Prefer an environment variable over committing it.
A missing, malformed or unknown token gets a 401 with a WWW-Authenticate: Bearer
header.
Ping URLs
Ping endpoints take no token. Each monitor has a ping URL containing a secret id:
https://api.rippler.io/ping/tKwyPF8mHDimhv-s/Holding that URL is the authorisation to report runs for that monitor, and nothing else. It cannot read your monitors, create anything, or reach the rest of your team, so it is safe to put in a crontab on a machine you do not fully trust.
It is still a secret. Anyone with it can report false successes, which would stop you being alerted about a broken job.
Scoping
Every management endpoint is scoped to the team behind the token. A short id
belonging to another team returns 404, not 403, so the API does not confirm
that the id exists.