How Auvik sends API requests, protects API keys, and uses Shared Collectors

How API requests are sent

For integrations that use collector-based API polling, Auvik sends API requests through the collector assigned to the integration.

The external service sees the source IP used by the collector. If the collector’s traffic passes through NAT, the external service sees the translated public IP address rather than the collector’s private address.

This is important when the external API uses IP allowlisting.

Some legacy or cloud-based integrations may send requests from Auvik cloud infrastructure instead of a customer collector. Review the integration’s configuration and current product documentation to confirm which request path applies.

Source IP and allowlisting

If the API provider restricts access by source IP:

• Identify the collector assigned to the integration.
• Determine the public IP address used for outbound traffic.
• Add that public or NAT address to the API provider’s allowlist.
• Confirm that proxy or firewall policies do not change the source path unexpectedly.
• Re-test the integration after any collector, NAT, proxy, or routing change.

For Meraki integrations using a collector, the collector’s public IP may need to be added to Meraki Login IP ranges.

API key security

Auvik stores API credentials securely and does not expose the full API key in the Auvik interface after it has been generated.

All API requests should use HTTPS/TLS when supported by the integration.

Follow these practices:

• Use dedicated API credentials for integrations.
• Apply least-privilege permissions.
• Store keys and tokens in a secure password or secrets manager.
• Do not include full credentials in tickets, screenshots, scripts, or logs.
• Rotate keys according to your security policy.
• Update the integration immediately after rotating a key.
• Remove or disable unused credentials.

Regenerating a key may immediately invalidate the previous key. Update all integrations, scripts, and scheduled jobs that use the old key.

Using a Shared Collector for API-only integrations

A Shared Collector can be used to originate API requests for integrations that support collector-based polling. It does not have to perform full network discovery for the integration to use it as an API request source.

Before using a Shared Collector for this purpose, confirm that:

• The collector is approved and assigned at the appropriate level.
• The collector has outbound HTTPS access to the required API endpoints.
• DNS resolution works from the collector.
• Any required proxy settings are configured.
• The external API allowlist includes the collector’s public or NAT address.
• The integration is assigned to the intended collector.
• The credentials stored in Auvik are valid and current.
• The collector has sufficient resources for the integration workload.

Using a Shared Collector for API requests does not automatically provide network visibility into every site. The collector must also have the required routing and access if the integration needs to reach devices or networks directly.

Troubleshooting failed API requests

If API requests fail after adding or changing credentials, verify the following:

1. Confirm the integration is assigned to the intended collector.
2. Confirm the collector is online.
3. Test DNS resolution from the collector.
4. Confirm outbound HTTPS access to the API provider.
5. Check proxy, firewall, and SSL inspection settings.
6. Confirm that the external service allowlist contains the correct public or NAT address.
7. Verify that the API key or token is current.
8. Confirm that the credential has the required permissions.
9. Review the integration status and logs for authentication, authorization, or rate-limit errors.

Common errors include:

• 401 Unauthorized: The credential may be invalid, expired, revoked, or entered incorrectly.
• 403 Forbidden: The credential may be valid but lack the required permissions, tenant access, or source-IP authorization.
• 429 Too Many Requests: The integration or source IP may have exceeded the provider’s rate limit.
• Connection or timeout errors: DNS, routing, firewall, proxy, or TLS inspection may be interfering with the request.

When to contact Support

Provide the following information when requesting assistance:

• Integration name and vendor.
• Auvik site or multi-site.
• Assigned collector.
• Collector private IP and outbound public/NAT IP, if known.
• Approximate failure time, including timezone.
• HTTP status code or error message.
• Whether the API key was recently changed.
• Relevant integration or collector log entries, excluding secrets.

Related articles

• How do I manage my shared collector?
• Managing multiple collectors
• How to troubleshoot an API credential from the Auvik collector shell
• What protocols and ports does the Auvik collector use?
• How do I add a Meraki cloud controller?