Skip to main content

​
Overview

When making requests to the Opal API, you must pass an authentication bearer token in the header to identify yourself as an authorized user. To do this, pass a header with key Authorization and value Bearer <API_TOKEN>, where <API_TOKEN> is the value of the API token you generate in Opal.

​
Using the API With Opal Automations

Automations have their own identity in Opal and can be assigned Opal roles to scope their permissions. Opal Admins can create an automation on the Configuration -> Automations page. Automations can be assigned to Opal roles and scoped roles under the Resources tab. Automations can be added to Opal groups under the Groups tab. These can be combined to provide granular permissions to Automations. API keys for automations can be created under the API Keys tab and can be set to expire. A maximum of 2 API Keys can be created for an automation.

​
Using the API with Personal Access Tokens

Personal access tokens are tied to your identity and have your permissions. By default, only Opal Admins can generate personal access tokens. However, admins can enable all users to create PATs by toggling the Allow all users to create PATs setting in Configuration -> Settings -> Advanced. Users can generate personal access tokens on the User -> Settings page: Personal access tokens can either be Read-only or Full-access:
  • Read-only tokens can only perform GET requests, limited to resources you have permission to view.
  • Full-access tokens can perform all API operations (GET, POST, PUT, DELETE), but are still scoped to your user permissions - you cannot access or modify resources beyond what your Opal role allows.
Once the token is generated, copy it and use it to make authenticated requests to the Opal API. If a token is compromised, you can revoke it from the same page. Any other Opal Admin can revoke your token from the Configuration -> API Access Tokens page.
Last modified on November 7, 2026