Access tokens

An API token lets a monitoring system, script, or dashboard read the fleet state without a password or browser session. All tokens have the same set of operations and cover the whole fleet.

Token permissions

A token reads servers, current readings, and active incidents. It cannot send commands, change prices or marketplace settings, or read the balance, earnings, or invoices.

Available operations

Base address: https://api.flotera.com/api/v1. Authorization header: Authorization: Bearer erm_pat_….

Operation	Response
GET /me	token name, expiry, access scope, list of operations, and limits
GET /servers	the fleet’s servers and their latest readings
GET /servers/{id}	the selected server and its hardware details
GET /alerts	open and acknowledged incidents

Paths outside this list return 404. A listed path called with another method returns 405 with an Allow header.

API referenceParameters, response fields, and request examples in English.

Access scope

A token covers all servers in the account, including servers added after it was issued. Restricting a token to individual servers is not supported.

Create a separate token for each integration. This lets you revoke one system’s access while the others keep working; the read scope remains the same for all tokens.

Creating a token

On the account’s tokens card, select Create token and specify:

1. Name, which identifies the integration, for example “Grafana”.
2. Expires: 30 days, 90 days, or 1 year. The default is 90 days.

The value is shown once and cannot be recovered. Save it in the integration’s secret store. If it is lost, revoke the token and create a new one.

Request errors

The API returns 429 with Retry-After when requests need to slow down. GET /me reports the request limit currently applied to your account. If an integration gets 401, check or replace its token instead of retrying.

Freshness of readings

The API returns the latest reading, not the history. Check:

• observed_at: the time of the reading on the server;
• stale: true if the reading is older than 5 minutes or missing.

Each GPU has its own timestamp and staleness flag. A server can keep sending data even if the readings of an individual GPU have stopped updating. For combined GPU metrics in readings, check gpu_observed_at and gpu_stale separately from the host timestamp and stale flag.

Do not display a stale temperature as current. Use the panel for charts and history: this API does not return time series, the event feed, or closed incidents. A state=resolved request is rejected.

Frozen account

The server list and server cards remain available, but readings is null and gpus is an empty list. The online status, the last-seen time, and the GPU count stay current. GET /alerts returns 403 account_frozen, and GET /me does not list it among the available operations. While the account is frozen, recording of readings and incidents is paused; access is restored after a top-up.

Token list in the panel

The list shows each token’s name, expiry, and last use. Review it regularly and revoke tokens you no longer need. Inactive tokens appear separately, with the reason and time their access ended.

The owner and administrators see and revoke every token of the account. Other roles see and revoke only the tokens they created.

Storage and revocation

Store the token in a secret store or an environment variable. Do not add it to a repository or send it in support messages. If the token may have been exposed to third parties, revoke it and replace it in the integration. Revocation is also available when the account is frozen.

MCP: AI assistantsSeparate access with tool and server selection.