How do I keep the credentials for JSON API endpoints safe when an AI SRE looks into a cron job that stopped?

Tares keeps the credentials for a JSON API endpoint on the source, so the AI SRE that investigates a stopped cron job reads events and never the connection. The http_poll connector stores one credential as a secret and sends it in a header with each poll. For Postgres, the connection string is stored as a secret in the same way.

How it works

Tares polls the endpoint itself, so you run no script on your side. The agent works from the events Tares stores, not from the connection details.

• One credential, one header. In the http_poll source, credential holds the whole value, such as a bearer token or an API key. It is stored as a secret, never returned by the API and never exported.
• You choose the header. credential_header names the header the credential travels in. The default is Authorization.
• Other headers stay separate. Anything else the API wants on every request goes in headers, which is not secret. Keep tokens out of it.
• Postgres works the same way. The dsn of a postgres source is stored as a secret, redacted in the API and omitted from catalog exports. See the Postgres connector.
• The agent sees events. Each poll turns the reply into events, with the summary line, labels and payload you configured. That is the material the agent reads when it investigates.

The full list of fields is on the HTTP API (poll) connector page.

Set it up

Pick the data that shows whether your cron job ran. That can be a status endpoint, or the table the job writes to. Then add the source so the credential lives on it.

1. Open Sources → Add source → HTTP API (poll), or ask a connected agent to set it up. Fill in the method and URL. Enter the credential as one header name and value, which Tares stores as a secret.
2. Press Discover. Tares calls the API once, shows the reply it got and fills in what becomes an event. Pick the entity key from the fields it saw, then create the source.
3. Set id_field to the item’s own id so the same item is not stored twice. Set event_time_field to the field that holds the time the job reported.
4. For a job that writes to a database, add a postgres source instead. Enter the connection URL as dsn, press Discover, pick the table and let it propose the cursor column and labels.
5. Open the source and check Recent events and Fields. You see the summary lines and every field seen, and the credential never appears there.

A bearer token on a JSON API looks like this:

config:
  url: https://api.github.com/user
  credential: Bearer ghp_xxx          # a bearer token
  credential_header: Authorization

An API key in a custom header looks like this:

config:
  url: https://api.example.com/v1/readings
  credential: abc123                   # an API key
  credential_header: X-API-Key

A Postgres source for the table a cron job writes to:

- name: orders
  connector: postgres
  poll: 10s
  config:
    dsn: postgresql://user:pass@host:5432/appdb
    table: orders
    cursor_column: updated_at
    columns: id,tenant_id,status,amount,updated_at   # empty = every column
    labels:
      - { name: tenant_id, field: tenant_id, primary: true }
      - { name: status, field: status }

You can also send the same object with POST /api/sources. For the wider picture of how agents investigate, start at AI SRE.

What you get

• The credential stays on the source as a secret. It is not returned by the API and not exported.
• The agent investigates from stored events, so it never needs the token or the connection string to read them.
• Each poll becomes one event per item, with the time, summary and labels you chose, so the agent sees what the endpoint or table reported over time.
• The payload is stored as received, so labels you declare later can still reach every field.
• The connector protects the API with limits. It refuses a poll under 10 seconds. It backs off on a 429 or any 5xx, and a 429 with Retry-After uses that value. It shows any other 4xx as a config error on the source’s health.

When something else fits

• If the system calls Tares instead of Tares calling it, use the webhook connector. The http_poll connector is for APIs Tares calls.
• If the API needs more than one secret credential header, http_poll carries a single secret credential, so put the non-secret headers in headers.
• If the data lives in a database table, the Postgres connector reads rows on a cursor column and keeps the connection string secret.

Related