Personal access tokens for the RECON API
Create a personal access token to call the RECON API from your scripts, choose its scopes and expiry, then rotate or revoke it when needed.
- Updated October 12, 2026
- Verified on RECON v3.3.0
- 3 min read
- Watch 1:50
A personal access token lets your scripts, CI pipelines and the integrations you build call the RECON API on your behalf. This guide shows how to create one, use it, and rotate or revoke it.
Goal
Get a token with only the permissions your script needs, for example a SIEM integration that reads the Meccanica Adda scans.
Prerequisites
- You can sign in to RECON with your Orizon account. The tab is available to every user; no special role is required.
- You have a safe place to keep the token, such as a password manager or your pipeline's secret store.
Steps
Open API & Integrations
In RECON, open Settings and choose API & Integrations. In the Personal access tokens section, click Generate token.
Name the token
Under Name, enter something you will recognise, for example "SIEM integration". The name can be 1 to 100 characters long.
Choose the scopes
Under Scopes, Scans (read) is already checked. Select only what you really need (see the table below). If you leave every scope unchecked, the token gets read-only access to all areas.
Choose the expiry
Under Expiry, pick 30 days, 90 days (the default), 1 year or Never. Prefer a token that expires.
Create and copy the token
Click Generate. In the Token created window, copy the value right away: RECON only stores a hash of the token and will not show it again. Then click I've stored it safely.
Available scopes
| Scope | What it allows |
|---|---|
Profile (read) (me:read) | Read your profile, your Cyber Token balance and your API usage |
Scans (read) (scans:read) | List and read scans: vulnerabilities, assets, technologies, topology, exports and the other details |
Scans (write) (scans:write) | Create and delete scans |
Probes (read) (probes:read) | List and read your probes |
Probes (write) (probes:write) | Create probes and start internal scans |
| Tokens (read) and Tokens (write) | Selectable, but no API endpoint requires them in this version |
Result
The token appears in the table with its Name, Prefix, Scopes and Last used date; only the prefix of the value stays visible. To try it, put it in the Authorization header after the word Bearer:
curl -H "Authorization: Bearer <YOUR_TOKEN>" \
https://recon.orizon.one/api/v1/scansRECON answers in JSON with the list of your scans. The Documentation section of the same page shows the same example call and links to the OpenAPI specification, which lists every endpoint.
Rotate or revoke a token
- Rotate: click Rotate (issue new value) next to the token and confirm with Rotate. The current value stops working at once; name, scopes and expiry stay the same. Copy the new value and update every script that uses the token.
- Revoke: click Revoke, type the token name to confirm and click Revoke again. API calls using that token start failing immediately. A revoked token stays in the table with the Revoked label and can no longer be rotated.
Troubleshooting
- You lost the token value: it cannot be recovered. Rotate the token or create a new one.
- API calls are refused: the token is revoked or expired, or it lacks the scope the endpoint requires. Check the table and, if needed, create a token with the right scopes.
- "The name must be between 1 and 100 characters.": shorten the name, or enter one.