---
title: "Mint a log-drain token"
method: POST
path: "/brands/{brandId}/ingest-token"
tags: ["connections"]
---

# Mint a log-drain token

`POST /brands/{brandId}/ingest-token`

## Request

- Base URL: `https://shruwd.io/api/v1`
- URL: `https://shruwd.io/api/v1/brands/{brandId}/ingest-token`
- Auth: HTTP bearer

Returns the token **once**, with the endpoint to send server logs to
(`POST <endpoint>` with `Authorization: Bearer <token>`, one log line
per row). Previous tokens for the brand are revoked. Log ingest is what
powers the crawler view and the highest-confidence findings.

## Request body

- object
  - `label` string

## Response `201`

The token.

- IngestToken
  - `token` string, required: Shown once. Stored hashed; a lost token is replaced, not recovered.
  - `tokenPrefix` string, required: Enough to recognise the token in settings, never enough to use it.
  - `label` string, required
  - `endpoint` string, uri, required: Where to POST log lines, with `Authorization: Bearer <token>`.
  - `revokedPrevious` integer, required: How many earlier tokens this one replaced.
  - `setup` object, required: The three ways to get logs to the endpoint. Show the one that fits the site.
    - `httpDrain` object, required
      - `endpoint` string, uri, required
      - `header` 'X-Shruwd-Ingest-Token', required
      - `contentType` 'application/x-ndjson', required
      - `note` string, required
    - `cloudflareLogpush` object, required: A Logpush job with an HTTP destination (Cloudflare Enterprise zones).
      - `destinationUrl` string, uri, required: The endpoint with the token as a `header_Authorization` URL parameter, which Logpush turns into a request header. Contains the token.
      - `dataset` 'http_requests', required
      - `fields` string[], required
      - `filter` string, required: The job's filter as the Logpush API takes it, a JSON string, keeping the job to the brand's domain and its www host.
      - `note` string, required
    - `cloudflareWorker` object, required: The reference forwarder Worker for any other Cloudflare plan or CDN-served site.
      - `note` string, required
      - `ingestUrl` string, uri, required
      - `secretName` 'SHRUWD_INGEST_TOKEN', required

## Other responses

- `403`: `not_entitled`.
- `404`: `not_found`: no such resource in this workspace.
- `default`: Every failure has this body.

---

[API](https://skmtc.dev/shruwd/apis/shruwd-api.md) · [All operations](https://skmtc.dev/shruwd/apis/shruwd-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shruwd/apis/shruwd-api/revisions/64a5da079928?raw)