# Questions? We have answers.

## Summary
Learn about the technical use of the MindBridge API.

## Configuration details
You must be an **App Admin** to access the API page.

## What is MindBridge responsible for?
- Maintaining API infrastructure
- Documentation and education materials
- Maintaining security protocols
- Outputs to users (results exports)
- Providing customer support

Review our [Terms of Use](/content/terms-of-use/index.html) for more details.

## As a user of the API, what do I manage?
- Interactions with the MindBridge API
- Generating and managing API tokens, including permissions and lifecycle
- Using the desired API endpoints and actions
- Maintaining user-side technical capabilities required to interact with the API

Review the MindBridge API documentation and tutorial materials for more details.

## How is MindBridge securing my data?
- Access through API tokens (bearer tokens)
- Encryption
- Rate Limiting & Preventing distributed denial-of-service (DDoS) attacks
- MindBridge leverages existing security measures to maintain ISO 27001 and SOC 2 Type 2.

## What kind of permissions can be applied to each token?
Each token has scope of access options for areas of MindBridge and abilities within that area. Some examples are:
- api.organizations.read: Grants read access to organizations
- api.organizations.write: Grants write access to organizations
- api.tasks.write:  Grants write access to tasks
- api.engagements.delete: Grants delete access to engagements

## Can tokens be revoked or re-issued?
Tokens can be deleted at any time.
While tokens can be renewed, this action does not re-use the existing token, but rather copies the existing settings into a new token.

## Can users be deactivated after they have been granted access to the API?
**App Admins** can delete tokens within the application.

## Does MindBridge offer a public or private API?
MindBridge offers a **partnered API** that is available to customers and partners where applicable. The API is not publicly accessible.

## Will access control allow for certain aspects of the API to be accessible by certain users, and restricted for others?
Yes, **App Admins** can set specific permissions for each token based on user roles.

**Note:** Tokens must be stored in a secure location, and much like your personal passwords, should **never** be shared. The security of your token is paramount. If a token is compromised, the **App Admin** should disable and re-issue the token immediately.

## Does MindBridge provide log files?
MindBridge logging for the API is managed and handled just as it is today in the web application.

## As a user of the API, where can I start?
- Read the MindBridge API documentation
- Generate or get access to an API token
- Try out desired API endpoints and actions