Security

Authentication and authorization

Use HTTPS and send the supported credential in Authorization: Bearer .... Browser and CLI sessions are user credentials; API keys are bound to a workspace and carry scopes. See authentication for issuance, expiration, revocation, and the complete role/permission matrix.

For automation, request explicit scopes for the necessary routes and set an expiry. Never use an empty scopes list as a way to deny access: it currently grants broad owner-equivalent access. Some API key routes also apply legacy prefix scopes, so follow the tested combinations in the authentication guide.

With a session credential, read /me after selecting X-Org-Id and confirm the returned workspace before making changes. An invalid workspace selection can fall back to another membership. API keys remain bound to their own workspace.

Store and rotate credentials

Store keys in your application's secret manager. Keep them out of source files, browser bundles, workflow parameters, logs, notebooks, and screenshots. Rotate an API key by creating a replacement, updating callers, verifying the new credential, and revoking the old key. Revocation does not undo operations already accepted.

Dagy's secrets API supports storing and updating secrets. Metadata listing does not expose the value, but secrets.read also permits reading plaintext through the value endpoint; the Developer role has this permission. Treat it as credential access when assigning roles.

Secrets are separate from environment variables and saved connectors. An environment name alone does not guarantee a secret is injected into a task. Use the configuration mechanism supported by your node or custom client, and test it in the target runtime.

Notification channel configuration can be returned to permitted readers and can contain webhook URLs or routing keys. Limit notifications.read accordingly. Do not assume these values receive the same handling as the secrets API.

Data sent through Dagy

Parameters, task outputs, logs, quality reports, catalog metadata, and AI Studio attachments can contain application data. Submit only what is needed. Redact credentials and sensitive fields before logging, and prefer passing a controlled storage reference for large or restricted datasets.

Local runs write history and artifacts to the configured local directory. Protect that directory and its backups. Do not open untrusted serialized artifacts or execute an unreviewed workflow: workflows and custom nodes are application code, not a sandbox for hostile code.

AI-generated Python, shell, and container steps require particular care. Review source, dependencies, network destinations, and side effects before confirming and deploying. Validation checks do not establish that the generated behavior is safe or correct.

Webhooks and cloud accounts

An inbound sensor URL contains a secret capability token. The current receiver does not validate a caller signature or deduplicate requests. Keep that URL server-side; use your own authenticated gateway if your integration requires signed inbound delivery. See events.

Outbound webhook signatures use the exact raw body. Verify them before processing and implement replay/duplicate handling in your receiver. Delivery is best effort, so use run polling when you need to reconcile missed notifications. See notifications.

Cloud-account registration can validate provider trust and resource access. It does not currently issue runtime credentials or enforce saved bindings for running flows. Follow cloud connections, grant only needed provider access, and remove customer-side permissions separately when retiring a connection.

Account administration and audit

Workspace owners and administrators can manage the actions described in workspace APIs. A workspace admin is not a platform super-administrator. Protection of an environment currently prevents deletion; it does not enforce approval before promotion or deployment.

Use the organization-scoped audit list for investigation, alongside application run history. Audit capture is best effort and is not a complete compliance ledger. This implementation does not establish a certification, contractual data-retention promise, or general SSO/SCIM integration; obtain any required assurance or retention terms from your service agreement before relying on them.