Authentication

Argus separates reading from writing on purpose. An API key can read everything in your workspace but write nothing. A source can write telemetry but read nothing. If a source secret ever leaks from an app server, the blast radius is "someone could send you fake events" — never "someone could read your spend".

API keys — reading

Create one in Settings → API keys. The key is shown once, then stored only as a hash. Send it on every request:

Authorization: Bearer argus_mcp_...

A key belongs to one workspace and sees only that workspace's data. Revoke it any time from the same Settings table — revocation is immediate. The same key also authenticates the MCP server.

Sources — writing

A source represents one app that sends telemetry — your API server, a worker, a batch job. Create one in Settings → Telemetry sources and you get two values, shown once:

source_idstring

A public identifier. It names where events came from and goes in a request header, unencrypted.

source_secretstring

Signs every batch you send (HMAC-SHA256). Keep it in your app's secret store — Argus stores it encrypted and can't show it again.

To rotate a source, create a new one and revoke the old — events keep flowing under the new name, and revoked sources are refused immediately.

Responses

Every field in requests and responses is snake_case. Every response is an envelope, so you can always check one field before touching the rest:

{ "success": true,  "data": … }
{ "success": false, "error": "what went wrong, in plain words" }

Errors you'll actually see

401 unauthorized

The bearer key is missing, revoked, or wrong — or an ingest signature didn't verify.

403 use the Argus app, or a bearer API key

You called the API without any credential. Browser sessions only work through the Argus app itself; scripts and servers use bearer keys.

400 …required

Validation, with the specific field named in the message.

← Overview Query API →