Parseable API keys inherit role permissions across telemetry streams

Parseable API keys inherit the role permissions of their associated user accounts and apply to telemetry streams. These keys can be used for authentication with native authentication, OIDC, or API keys. The API keys are resolved to their roles and authorized like any other user. The role-based access control (RBAC) model includes roles such as Admin, Editor, Writer, Reader, and Ingestor, each with varying access permissions across different endpoints.

Since Parseable keys inherit role permissions, they can be used as meaningful security boundaries and integration credentials. However, a Parseable key should not automatically grant access to all streams, nor should an OIDC group mapping provide more authority than intended. Therefore, it is essential to review the union of roles for each key, just as one would review a user account.

To measure candidate hosts, the app, title, and body counts can be used as initial indicators. However, these counts do not constitute proof of a running service. The name may appear in various documentation, SDK pages, dashboards, or configuration files. The app query did not return any matches within the selected scope, suggesting that further investigation is necessary.

Logs and traces often contain sensitive information, such as URLs, user identifiers, request parameters, internal hostnames, and error messages. An API key with Reader privileges could potentially search across streams containing customer data. An Ingestor key might allow data creation or routing into a stream owned by another team. An Admin key could modify users, roles, and retention settings. It is crucial to review and test the query path alongside ingestion permissions.

A public dashboard or API documentation page could expose stream names even when authentication is required. Therefore, testing with a user who belongs to multiple OIDC groups is necessary to ensure that effective permissions are the union of all applicable groups, not just the most specific group name. The review checklist includes listing every API key, owner, role, last-used time, and stream scope, removing keys with no owner or integration, and testing read and object access with appropriate key privileges.

To further secure Parseable, the management API and OIDC callback routes should be protected using the intended network and identity policy. Token lifetime, rotation, and log redaction should also be reviewed. Client-side JavaScript should not contain ingestion tokens. For dashboards, verify that public visualizations do not proxy privileged keys from the browser.

Ultimately, Parseable keys should be scoped, owned, rotated, and tested against the exact endpoints they require. Measured counts of app, title, and body queries can help identify potential candidates, but these counts alone are not sufficient to claim a vulnerability. The control that matters is the permission union, which should be thoroughly reviewed and enforced.