API tokens
A personal API token lets something outside the app act as you: the Slack and Teams bots, a script, a notebook. Everything a token does runs with your permissions, and the token carries only the scopes you tick when you create it.
Create a token
- Open Settings → API tokens.
- Give it a name that says where it will be used, such as Slack.
- Tick the scopes it needs:
| Scope | What it allows | Tick it for |
|---|---|---|
| Ask questions | Run the governed answer pipeline as you | Every use |
| Read connections | List the workspace's data sources | The bots' list connections |
| Read the semantic layer | List certified metrics | The bots' list metrics |
| Confirm low-risk actions | Confirm low-risk governed actions, such as adding a note | Writes from Slack |
| Confirm medium-risk actions | Create, update and resolve records — the ServiceNow and Atlassian actions | Writes from Slack |
| Confirm high-risk actions | Irreversible actions | Rarely; typed confirmations still happen in the web app |
The page offers only the scopes your role allows, and Nexatron checks again when you create the token, so a token can never do more than you can.
- Click Create token and copy it. It is shown once; if you lose it, revoke it and create another.
Use it
curl https://api.nexatron.io/api/v1/query \
-H "Authorization: Bearer nxa_..." \
-H "Content-Type: application/json" \
-d '{"question": "Net revenue by region last quarter"}'
For Slack and Teams, give the token to whoever runs the bot together with your Slack member id or your Entra object id; see Ask from Slack and Ask from Microsoft Teams.
Revoke a token
Open Settings → API tokens and click Revoke next to it. Workspace admins can see and revoke every token in the workspace under Admin → API access, for off-boarding and incident response.
What a token is not
A token is you, in a narrower form. It cannot see anything you cannot see, and it cannot run an action you could not confirm yourself. Per-user sources such as ServiceNow and Atlassian still require that you connected them once under Settings → Connected accounts.