APIZDocs

APIZ guide

Investigate And Revoke Suspicious Agent Access

Use this flow when an agent request is unexpected, denied for an unclear reason, or may have used a leaked APIZ credential. Start from evidence, then stop the narrowest unsafe boundary.

Web Console

  1. Open Logs / Audit → Access Logs and search the request id from the APIZ response, or filter by time, Client, API Instance, decision, status, or reason.
  2. Open the timeline and identify the Client, Binding, Credential Group, normalized action/resource, Policy Revision, decision, and upstream result.
  3. Confirm whether upstream was reached and whether the event is a credential, Policy, Secret Broker, adapter, or provider failure.
  4. Open the Client's Temporary Credentials history.
  5. Revoke one credential when only that value is affected, or revoke the group to stop every credential issued in the same setup operation.
  6. Use Audit Logs to confirm the revocation and preceding configuration changes.

CLI

apiz access-log request <request-id>
apiz access-log list --client <client-id> --since 1h --limit 100
apiz audit list --client <client-id> --since 24h
apiz client credentials list <client-id>
apiz client credentials show <credential-or-group-id>
apiz client credentials revoke <credential-or-group-id>

Escalate only when needed:

apiz client binding disable <client-binding-id>  # stop one API route
apiz client disable <client-id>                   # stop the Client
apiz api disable <api-instance-id>                # stop every Client using it

Verify Containment

Retry only with a synthetic safe request. The revoked credential should fail authentication and must not reach Policy, Secret Broker, or upstream. Other unaffected Clients should continue normally unless a broader resource was disabled.

Preserve request ids, decision ids, timestamps, safe fingerprints, and redacted exports. Never copy credential values or private payloads into an incident ticket. Rotate the upstream provider key only when evidence indicates that key, not merely an APIZ credential, may be compromised.