How do I keep the credentials for JSON API endpoints safe when an AI SRE looks into a disk filling up?

Tares keeps JSON API credentials on the source as a secret, so an AI SRE investigating a disk filling up reads events and never the connection details. The http_poll connector sends one credential in one header with each request. A Postgres source keeps its connection string the same way. Whatever the agent investigates, it works from the stored events.

How it works

The connection details live on the source. The agent reads the events that source stores, not the connection.

• JSON API endpoints. The http_poll connector calls the endpoint on the source’s schedule and stores one event per item. The credential field holds the whole credential value. Tares stores it as a secret, never returns it through the API and never exports it. credential_header names the header that carries it, Authorization by default.
• Postgres. If the numbers you care about sit in a table, the postgres connector takes a connection string in dsn. Tares stores it as a secret, redacted in the API and omitted from catalog exports.
• Other headers. Headers the API wants on every request but that are not sensitive go in headers. That field is not secret, so keep keys and tokens out of it.

When you ask an AI SRE about a disk filling up, it works from the events these sources already stored. A reading from a JSON endpoint becomes an event with the fields you labeled, and a Postgres row becomes an event the same way. The credential stays on the source. For the wider picture of how an agent investigates, see AI SRE.

Set it up

1. Decide where the disk reading lives. If a JSON endpoint reports it, use the HTTP API (poll) connector. If the figures sit in a database table, use the Postgres connector.
2. For a JSON endpoint, open Sources → Add source → HTTP API (poll). Fill in the method and URL. Put the credential in the credentials field, as one header name and one value. Tares stores it as a secret. You can also ask a connected agent to set up the source, or POST /api/sources with the same object.
3. Choose the header. For an API key, set credential_header to the header the API expects. For a bearer token, keep Authorization and put the whole value, including the word Bearer, in credential.
4. Press Discover. Tares calls the API once, shows the reply and fills in what becomes an event. Pick the entity key from the fields it saw, then create the source.
5. For Postgres, open Sources → Add source → Postgres, enter the Connection URL (dsn) and press Discover. Pick the table, check the proposed cursor and labels, then save.
6. Open the source and check Recent events and Fields. You see the events and the field coverage, not the credential.

An API key sent in a custom header looks like this:

config:
  url: https://api.example.com/v1/readings
  credential: abc123                   # an API key
  credential_header: X-API-Key

A Postgres source keeps its connection string in dsn:

- name: orders
  connector: postgres
  poll: 10s
  config:
    dsn: postgresql://user:pass@host:5432/appdb
    table: orders
    cursor_column: updated_at
    columns: id,tenant_id,status,amount,updated_at   # empty = every column
    labels:
      - { name: tenant_id, field: tenant_id, primary: true }
      - { name: status, field: status }

These examples show the shape of the config. Replace the URL, table and columns with your own. After you save, the API shows the secret fields redacted.

What you get

• Credentials stay on the source. The agent reads events and does not handle the key or the connection string.
• The http_poll credential is never returned by the API and never exported. The Postgres dsn is redacted in the API and left out of catalog exports.
• Tares polls the endpoint itself, so no script of yours has to hold the credential and push data in.
• The connector protects the API you poll. It refuses a poll under 10 seconds, backs off on a 429 or any 5xx, and shows a rate limit in the source’s health. A 4xx other than 429 shows up as a config error with the status, so a wrong or expired credential is visible on the source.
• The payload is stored as received, so labels you declare later can still reach every field.

When something else fits

• If the system calls Tares instead of Tares calling it, use the webhook connector.
• If the API needs more than one secret header per request, http_poll carries a single credential in a single header. Put non-secret headers in headers, and keep the one secret in credential.
• If the data sits in a database you can reach, the Postgres connector reads it with a connection string stored as a secret.

Related