Everything here is checked against the running code. If a route is not documented, a token cannot reach it.
Machine-readable: the token API is described as OpenAPI 3.1 at /api/v1/openapi.json, generated from the routes themselves. Import it into Postman or Insomnia, or generate a client from it.
Quick start
- On a Network plan, open Settings, Integrations, API tokens, create a token and tick Also allow the read-only REST API. Copy the
ssk_token; it is shown once. - List your servers. The panel that shows the new token also shows the URL form
https://serverstats.cc/api/v1/orgs/ORG_ID/...; ORG_ID is your organisation id.
bash
export TOKEN=ssk_...
curl -H "Authorization: Bearer $TOKEN" https://serverstats.cc/api/v1/orgs/ORG_ID/serversThen read a metric by the hour:
bash
curl -G -H "Authorization: Bearer $TOKEN" \
"https://serverstats.cc/api/v1/orgs/ORG_ID/servers/SERVER_ID/timeseries" \
--data-urlencode "metric=tick_rate" --data-urlencode "bucket=1h" --data-urlencode "agg=avg"What exists
| Surface | Auth | Plan |
|---|---|---|
REST API, read-only GET routes under /api/v1 | Authorization: Bearer ssk_... | Network |
MCP at /api/v1/mcp | the same kind of token | Network |
| Signed webhooks for alerts and the weekly report | HMAC signature header | Operator (one), Network |
| Public status JSON and the server status checker | none | every plan |
Agent ingest at /ingest/v1 | Ed25519 signed requests | every plan |
The dashboard itself uses the same API with a session cookie; those write routes are not available to tokens.