How do I keep the credentials for JSON API endpoints safe when an AI SRE looks into high latency?

Tares keeps the credentials for your JSON API endpoints on the source, stored as a secret, so an AI SRE looking into high latency reads events and never the connection. The http_poll source sends the credential in one request header when Tares polls the endpoint. Postgres sources keep their connection string the same way.

How it works

Tares calls the API itself on the source’s schedule, so no script on your side holds a key. The agent works from the events that come back, not from the connection used to fetch them. This applies to any investigation, including one about high latency. For the broader picture of how an investigation runs, see AI SRE.

For the HTTP API (poll) connector:

• credential holds the whole credential value, for example an API key or a bearer token.
• The credential is stored as a secret. The API never returns it and it is never exported.
• credential_header names the header that carries it. The default is Authorization.
• Other headers the API wants on every request go in headers. That map is not secret, so keep keys and tokens out of it.
• One credential travels in one header.

For the Postgres connector:

• dsn is the connection URL, in the form postgresql://user:pass@host:port/dbname.
• The dsn is stored as a secret. It is redacted in the API and omitted from catalog exports.
• Tares reads new and changed rows on a cursor column, one event per row. The agent sees those rows as events, not the connection URL.

The polled payload is stored as received, so you can add labels later and still reach every field.

Set it up

1. Pick the JSON endpoint that reports what you want to watch, such as a status or readings endpoint of your own service. For high latency, choose an endpoint that returns a latency figure you can turn into a number label.
2. Add the source. Go to Sources → Add source → HTTP API (poll), or ask a connected agent to create it. Fill in the method and URL. Enter the credential as one header name and value, which Tares stores as a secret.
3. Press Discover. Tares calls the API once, shows the reply and fills in what becomes an event. Pick the entity key from the fields it saw, then create the source.
4. Keep the credential in credential, not in headers. The credential block looks like this for an API key:

config:
  url: https://api.example.com/v1/readings
  credential: abc123                   # an API key
  credential_header: X-API-Key

5. For application data behind Postgres, add a Postgres source and enter the connection URL as dsn. Discover lists the tables it can see. Pick one, and Tares proposes the cursor, the entity key and the labels:

- name: orders
  connector: postgres
  poll: 10s
  config:
    dsn: postgresql://user:pass@host:5432/appdb
    table: orders
    cursor_column: updated_at
    columns: id,tenant_id,status,amount,updated_at   # empty = every column
    labels:
      - { name: tenant_id, field: tenant_id, primary: true }
      - { name: status, field: status }

6. Use columns on the Postgres source to pull only the columns you need. Leave out anything you do not want in the timeline.
7. Open the source and check Recent events. Each poll shows its events with a summary line, and Fields lists every field seen with its coverage. You should see data, and you should not see the credential.

What you get

• The credential for a JSON API lives in one place, the source, as a secret that the API never returns and exports never include.
• The Postgres connection URL lives on its source with the same protection, redacted in the API and left out of catalog exports.
• The agent investigating high latency reads events and fields from the timeline. It does not need the header value or the connection string to do so.
• Tares polls on its own, so you run no collector script that would need its own copy of the key.
• The connector protects the API you poll. It refuses a poll interval under 10 seconds and backs off on a 429 or any 5xx, with the wait doubling up to an hour. Other 4xx replies show as a config error on the source’s health, so a wrong key is visible quickly.

When something else fits

• If the system calls Tares rather than the other way round, the webhook connector fits better than polling.
• If an API needs more than one credential header, http_poll carries one secret credential only. Other headers go in headers, which is not secret, so that API needs a different route.

Related