[{"data":1,"prerenderedAt":2173},["ShallowReactive",2],{"navigation":3,"page:\u002Fguides\u002Fsecurity-and-data":1019,"surround:\u002Fguides\u002Fsecurity-and-data":2164},[4,21,82,133,154,1010],[5,6,7,8],"Getting started","\u002Fgetting-started","i-lucide-rocket",[9,12,15,18],[10,6,11,11],"What Kaabist is",0,[13,14,11,11],"API keys and modes","keys-and-modes",[16,17,11,11],"Your first job","first-job",[19,20,11,11],"Understanding the envelope","envelope",[22,23,24,25],"Concepts","\u002Fconcepts","i-lucide-book-open",[26,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79],[27,23,11,11],"Overview",[29,30,11,11],"Programs and versions","programs-and-versions",[32,33,11,11],"Tiers and escalation","tiers-and-escalation",[35,36,11,11],"The http tier","http-tier",[38,39,11,11],"The browser tier","browser-tier",[41,42,11,11],"Sessions","sessions",[44,45,11,11],"Human in the loop","human-in-the-loop",[47,48,11,11],"How healing works","self-healing",[50,51,11,11],"Obstacles and captchas","obstacles",[53,54,11,11],"Validation and warnings","validation-and-warnings",[56,57,11,11],"Credits and billing","credits-and-billing",[59,60,11,11],"Limits","limits",[62,63,11,11],"Locators","locators",[65,66,11,11],"Snapshots","snapshots",[68,69,11,11],"Egress and proxies","egress-and-proxies",[71,72,11,11],"Queueing and fairness","queueing",[74,75,11,11],"Accounts, organisations and roles","accounts-and-roles",[77,78,11,11],"Data retention","data-retention",[80,81,11,11],"Documents and PDFs","documents-and-pdfs",[83,84,85,86],"Guides","\u002Fguides","i-lucide-map",[87,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130],[27,84,11,11],[89,90,11,11],"Authenticated flows","authenticated-flows",[92,93,11,11],"Hosted resolve pages","hosted-resolve",[95,96,11,11],"Lists and pagination","lists-and-pagination",[98,99,11,11],"JSON and network locators","json-and-network-locators",[101,102,11,11],"Schedules and change detection","schedules-and-change-detection",[104,105,11,11],"Webhooks","webhooks",[107,108,11,11],"Bring your own providers","byo-providers",[110,111,11,11],"Testing: replay, dry-run and test mode","testing",[113,114,11,11],"Side-effect safety","side-effect-safety",[116,117,11,11],"Security & data handling","security-and-data",[119,120,11,11],"Migrating from other tools","migrating",[122,123,11,11],"Drift detection and canaries","drift-and-canaries",[125,126,11,11],"SDKs","sdks",[128,129,11,11],"The kaab CLI","cli",[131,132,11,11],"Coding agents (MCP)","mcp",[134,135,136,137],"Panel","\u002Fpanel","i-lucide-layout-dashboard",[138,139,142,145,148,151],[27,135,11,11],[140,141,11,11],"The program builder","builder",[143,144,11,11],"Picking and recording","picking-and-recording",[146,147,11,11],"Taking over a job","takeover",[149,150,11,11],"Getting help","support",[152,153,11,11],"Referrals","referrals",[155,156,157,158],"Reference","\u002Freference","i-lucide-library",[159,160,520,834,837,840,1006,1007],[27,156,11,11],[161,162,11,163],"API","api",[164,166,169,212,222,274,297,316,347,376,389,396,403,410,426,447,454],[27,165,11,11],"\u002Freference\u002Fapi",[167,168,11,11],"Interactive reference","explorer",[170,171,11,172],"Jobs","jobs",[173,176,179,182,185,188,191,194,197,200,203,206,209],[174,175,11,11],"Create job","create-job",[177,178,11,11],"List jobs","list-jobs",[180,181,11,11],"Create job batch","create-job-batch",[183,184,11,11],"Estimate job","estimate-job",[186,187,11,11],"Get job","get-job",[189,190,11,11],"List job steps","list-job-steps",[192,193,11,11],"Get job snapshot","get-job-snapshot",[195,196,11,11],"Get job screenshot","get-job-screenshot",[198,199,11,11],"Get job artifact","get-job-artifact",[201,202,11,11],"Submit job input","submit-job-input",[204,205,11,11],"Resume job","resume-job",[207,208,11,11],"Takeover job","takeover-job",[210,211,11,11],"Cancel job","cancel-job",[213,214,11,215],"Batches","batches",[216,219],[217,218,11,11],"Get batch","get-batch",[220,221,11,11],"List batch jobs","list-batch-jobs",[223,224,11,225],"Programs","programs",[226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271],[227,228,11,11],"Create program","create-program",[230,231,11,11],"List programs","list-programs",[233,234,11,11],"Lint program","lint-program",[236,237,11,11],"Get program","get-program",[239,240,11,11],"Update program","update-program",[242,243,11,11],"Delete program","delete-program",[245,246,11,11],"List program versions","list-program-versions",[248,249,11,11],"Create program version","create-program-version",[251,252,11,11],"Update program version","update-program-version",[254,255,11,11],"Delete program version","delete-program-version",[257,258,11,11],"Get program version","get-program-version",[260,261,11,11],"Publish program version","publish-program-version",[263,264,11,11],"Diff program version","diff-program-version",[266,267,11,11],"Replay program version","replay-program-version",[269,270,11,11],"Set program alias","set-program-alias",[272,273,11,11],"Delete program alias","delete-program-alias",[41,42,11,275],[276,279,282,285,288,291,294],[277,278,11,11],"Create session","create-session",[280,281,11,11],"List sessions","list-sessions",[283,284,11,11],"Get session","get-session",[286,287,11,11],"Update session","update-session",[289,290,11,11],"Delete session","delete-session",[292,293,11,11],"Verify session","verify-session",[295,296,11,11],"Refresh session","refresh-session",[298,299,11,300],"Proposals","proposals",[301,304,307,310,313],[302,303,11,11],"List proposals","list-proposals",[305,306,11,11],"Get proposal","get-proposal",[308,309,11,11],"Approve proposal","approve-proposal",[311,312,11,11],"Reject proposal","reject-proposal",[314,315,11,11],"Edit proposal","edit-proposal",[317,318,11,319],"Schedules","schedules",[320,323,326,329,332,335,338,341,344],[321,322,11,11],"Create schedule","create-schedule",[324,325,11,11],"List schedules","list-schedules",[327,328,11,11],"Get schedule","get-schedule",[330,331,11,11],"Update schedule","update-schedule",[333,334,11,11],"Delete schedule","delete-schedule",[336,337,11,11],"Pause schedule","pause-schedule",[339,340,11,11],"Resume schedule","resume-schedule",[342,343,11,11],"List schedule runs","list-schedule-runs",[345,346,11,11],"Get schedule run diff","get-schedule-run-diff",[104,105,11,348],[349,352,355,358,361,364,367,370,373],[350,351,11,11],"Create webhook","create-webhook",[353,354,11,11],"List webhooks","list-webhooks",[356,357,11,11],"Get webhook","get-webhook",[359,360,11,11],"Update webhook","update-webhook",[362,363,11,11],"Delete webhook","delete-webhook",[365,366,11,11],"Rotate webhook secret","rotate-webhook-secret",[368,369,11,11],"List webhook deliveries","list-webhook-deliveries",[371,372,11,11],"Resend webhook delivery","resend-webhook-delivery",[374,375,11,11],"Test webhook","test-webhook",[377,378,11,379],"Organisation","org",[380,383,386],[381,382,11,11],"Rotate org webhook secret","rotate-org-webhook-secret",[384,385,11,11],"Get org","get-org",[387,388,11,11],"Request data deletion","request-data-deletion",[390,391,11,392],"Credits","credits",[393],[394,395,11,11],"Get credits","get-credits",[397,398,11,399],"Ledger","ledger",[400],[401,402,11,11],"List ledger entries","list-ledger-entries",[404,405,11,406],"Usage","usage",[407],[408,409,11,11],"Get usage","get-usage",[411,412,11,413],"API keys","api-keys",[414,417,420,423],[415,416,11,11],"List API keys","list-api-keys",[418,419,11,11],"Create API key","create-api-key",[421,422,11,11],"Rotate API key","rotate-api-key",[424,425,11,11],"Revoke API key","revoke-api-key",[427,108,11,428],"BYO providers",[429,432,435,438,441,444],[430,431,11,11],"List BYO providers","list-byo-providers",[433,434,11,11],"Create BYO provider","create-byo-provider",[436,437,11,11],"Get BYO provider","get-byo-provider",[439,440,11,11],"Update BYO provider","update-byo-provider",[442,443,11,11],"Delete BYO provider","delete-byo-provider",[445,446,11,11],"Test BYO provider","test-byo-provider",[448,449,11,450],"Sites","sites",[451],[452,453,11,11],"Get site profile","get-site-profile",[455,456,11,457],"Objects","schemas",[458,460,463,466,469,470,473,476,479,482,485,487,490,493,496,499,502,505,508,511,514,517],[27,459,11,11],"\u002Freference\u002Fapi\u002Fschemas",[461,462,11,11],"ApiKey","api-key",[464,465,11,11],"Batch","batch",[467,468,11,11],"ByoProvider","byo-provider",[390,391,11,11],[471,472,11,11],"ErrorResponse","error-response",[474,475,11,11],"ExtractSchema","extract-schema",[477,478,11,11],"Job","job",[480,481,11,11],"LedgerEntry","ledger-entry",[483,484,11,11],"LintResult","lint-result",[486,378,11,11],"Org",[488,489,11,11],"Program","program",[491,492,11,11],"ProgramDefinition","program-definition",[494,495,11,11],"ProgramVersion","program-version",[497,498,11,11],"Proposal","proposal",[500,501,11,11],"Schedule","schedule",[503,504,11,11],"Session","session",[506,507,11,11],"SiteProfile","site-profile",[509,510,11,11],"StepRecord","step-record",[512,513,11,11],"Webhook","webhook",[515,516,11,11],"WebhookDelivery","webhook-delivery",[518,519,11,11],"WebhookEvent","webhook-event",[521,522,11,523],"DSL","dsl",[524,526,529,532,535,538,603,637,640,751,754,756],[27,525,11,11],"\u002Freference\u002Fdsl",[527,528,11,11],"Inputs","inputs",[530,531,11,11],"Options","options",[533,534,11,11],"Policies","policies",[536,537,11,11],"Steps","steps",[539,540,11,541],"Actions","actions",[542,544,546,548,550,552,554,556,558,560,562,565,568,570,573,575,577,579,582,585,587,589,591,594,596,598,600],[27,543,11,11],"\u002Freference\u002Fdsl\u002Factions",[545,545,11,11],"fill",[547,547,11,11],"click",[549,549,11,11],"press",[551,551,11,11],"hover",[553,553,11,11],"select",[555,555,11,11],"check",[557,557,11,11],"uncheck",[559,559,11,11],"upload",[561,561,11,11],"scroll",[563,564,11,11],"wait_for","wait-for",[566,567,11,11],"set_session","set-session",[569,569,11,11],"extract",[571,572,11,11],"capture_response","capture-response",[574,574,11,11],"evaluate",[576,576,11,11],"paginate",[578,578,11,11],"download",[580,581,11,11],"read_pdf","read-pdf",[583,584,11,11],"set_vars","set-vars",[586,586,11,11],"sleep",[588,588,11,11],"reload",[590,590,11,11],"goto",[592,593,11,11],"await_input","await-input",[595,595,11,11],"checkpoint",[597,597,11,11],"screenshot",[599,599,11,11],"when",[601,602,11,11],"loop_until","loop-until",[604,605,11,606],"Conditions","conditions",[607,609,611,613,615,617,619,621,623,625,627,629,631,633,635],[27,608,11,11],"\u002Freference\u002Fdsl\u002Fconditions",[610,610,11,11],"url",[612,612,11,11],"title",[614,614,11,11],"visible",[616,616,11,11],"hidden",[618,618,11,11],"exists",[620,620,11,11],"absent",[622,622,11,11],"text",[624,624,11,11],"count",[626,626,11,11],"network",[628,628,11,11],"var",[630,630,11,11],"landmark",[632,632,11,11],"all",[634,634,11,11],"any",[636,636,11,11],"not",[638,639,11,11],"Targets","targets",[641,642,11,643],"Fields","fields",[644,646,649,651,654,656,659,661,663,666,668,671,672,674,677,679,681,683,685,687,690,693,695,698,701,703,704,707,709,712,714,716,718,720,722,724,726,728,731,733,734,736,738,740,743,745,747,749],[27,645,11,11],"\u002Freference\u002Fdsl\u002Ffields",[647,648,11,11],"allow_suffix","allow-suffix",[650,650,11,11],"attr",[652,653,11,11],"base_url","base-url",[655,655,11,11],"candidates",[657,658,11,11],"case_insensitive","case-insensitive",[660,660,11,11],"country",[662,662,11,11],"currency",[664,665,11,11],"date_format","date-format",[667,667,11,11],"decimal",[669,670,11,11],"false_values","false-values",[642,642,11,11],[673,673,11,11],"flags",[675,676,11,11],"follow_redirects","follow-redirects",[678,678,11,11],"frame",[680,680,11,11],"json",[682,682,11,11],"locale",[684,684,11,11],"many",[686,686,11,11],"max",[688,689,11,11],"max_items","max-items",[691,692,11,11],"max_length","max-length",[694,694,11,11],"min",[696,697,11,11],"min_items","min-items",[699,700,11,11],"min_length","min-length",[702,702,11,11],"name",[626,626,11,11],[705,706,11,11],"null_markers","null-markers",[708,708,11,11],"nullable",[710,711,11,11],"on_invalid","on-invalid",[713,713,11,11],"pattern",[715,715,11,11],"presence",[717,717,11,11],"regex",[719,719,11,11],"required",[721,721,11,11],"role",[723,723,11,11],"sample",[725,725,11,11],"selector",[727,727,11,11],"source",[729,730,11,11],"strip_fragment","strip-fragment",[732,732,11,11],"testid",[622,622,11,11],[735,735,11,11],"thousands",[737,737,11,11],"timezone",[739,739,11,11],"transforms",[741,742,11,11],"true_values","true-values",[744,744,11,11],"type",[746,746,11,11],"unique",[748,748,11,11],"values",[750,750,11,11],"xpath",[752,753,11,11],"Assertions","assertions",[755,739,11,11],"Transforms",[757,758,11,759],"Lint codes","lint",[760,762,765,768,771,774,777,780,783,786,789,792,795,798,801,804,807,810,813,816,819,822,825,828,831],[27,761,11,11],"\u002Freference\u002Fdsl\u002Flint",[763,764,11,11],"E001","e001",[766,767,11,11],"E002","e002",[769,770,11,11],"E003","e003",[772,773,11,11],"E004","e004",[775,776,11,11],"E005","e005",[778,779,11,11],"E006","e006",[781,782,11,11],"E007","e007",[784,785,11,11],"E008","e008",[787,788,11,11],"E009","e009",[790,791,11,11],"E010","e010",[793,794,11,11],"E011","e011",[796,797,11,11],"E012","e012",[799,800,11,11],"E013","e013",[802,803,11,11],"E014","e014",[805,806,11,11],"W001","w001",[808,809,11,11],"W002","w002",[811,812,11,11],"W003","w003",[814,815,11,11],"W004","w004",[817,818,11,11],"W005","w005",[820,821,11,11],"W006","w006",[823,824,11,11],"W007","w007",[826,827,11,11],"W008","w008",[829,830,11,11],"W009","w009",[832,833,11,11],"W010","w010",[835,836,11,11],"Codes","codes",[838,839,11,11],"Events","events",[841,129,11,842],"CLI",[843,845,847,850,853,856,859,862,865,868,871,874,877,880,883,886,889,892,895,898,901,904,907,910,913,916,919,922,925,928,931,934,937,940,943,946,949,952,955,958,961,964,967,970,973,976,979,982,985,988,991,994,997,1000,1003],[27,844,11,11],"\u002Freference\u002Fcli",[846,846,11,11],"kaab",[848,849,11,11],"kaab auth","kaab-auth",[851,852,11,11],"kaab auth login","kaab-auth-login",[854,855,11,11],"kaab auth logout","kaab-auth-logout",[857,858,11,11],"kaab auth status","kaab-auth-status",[860,861,11,11],"kaab completion","kaab-completion",[863,864,11,11],"kaab completion bash","kaab-completion-bash",[866,867,11,11],"kaab completion fish","kaab-completion-fish",[869,870,11,11],"kaab completion powershell","kaab-completion-powershell",[872,873,11,11],"kaab completion zsh","kaab-completion-zsh",[875,876,11,11],"kaab credits","kaab-credits",[878,879,11,11],"kaab jobs","kaab-jobs",[881,882,11,11],"kaab jobs cancel","kaab-jobs-cancel",[884,885,11,11],"kaab jobs get","kaab-jobs-get",[887,888,11,11],"kaab jobs input","kaab-jobs-input",[890,891,11,11],"kaab jobs list","kaab-jobs-list",[893,894,11,11],"kaab jobs resume","kaab-jobs-resume",[896,897,11,11],"kaab jobs run","kaab-jobs-run",[899,900,11,11],"kaab jobs snapshot","kaab-jobs-snapshot",[902,903,11,11],"kaab jobs steps","kaab-jobs-steps",[905,906,11,11],"kaab jobs takeover","kaab-jobs-takeover",[908,909,11,11],"kaab open","kaab-open",[911,912,11,11],"kaab open job","kaab-open-job",[914,915,11,11],"kaab programs","kaab-programs",[917,918,11,11],"kaab programs alias","kaab-programs-alias",[920,921,11,11],"kaab programs alias set","kaab-programs-alias-set",[923,924,11,11],"kaab programs diff","kaab-programs-diff",[926,927,11,11],"kaab programs lint","kaab-programs-lint",[929,930,11,11],"kaab programs list","kaab-programs-list",[932,933,11,11],"kaab programs pull","kaab-programs-pull",[935,936,11,11],"kaab programs push","kaab-programs-push",[938,939,11,11],"kaab proposals","kaab-proposals",[941,942,11,11],"kaab proposals approve","kaab-proposals-approve",[944,945,11,11],"kaab proposals list","kaab-proposals-list",[947,948,11,11],"kaab proposals reject","kaab-proposals-reject",[950,951,11,11],"kaab proposals show","kaab-proposals-show",[953,954,11,11],"kaab schedules","kaab-schedules",[956,957,11,11],"kaab schedules create","kaab-schedules-create",[959,960,11,11],"kaab schedules list","kaab-schedules-list",[962,963,11,11],"kaab schedules pause","kaab-schedules-pause",[965,966,11,11],"kaab schedules resume","kaab-schedules-resume",[968,969,11,11],"kaab schedules runs","kaab-schedules-runs",[971,972,11,11],"kaab sessions","kaab-sessions",[974,975,11,11],"kaab sessions create","kaab-sessions-create",[977,978,11,11],"kaab sessions delete","kaab-sessions-delete",[980,981,11,11],"kaab sessions list","kaab-sessions-list",[983,984,11,11],"kaab sessions verify","kaab-sessions-verify",[986,987,11,11],"kaab usage","kaab-usage",[989,990,11,11],"kaab version","kaab-version",[992,993,11,11],"kaab webhooks","kaab-webhooks",[995,996,11,11],"kaab webhooks create","kaab-webhooks-create",[998,999,11,11],"kaab webhooks deliveries","kaab-webhooks-deliveries",[1001,1002,11,11],"kaab webhooks list","kaab-webhooks-list",[1004,1005,11,11],"kaab webhooks test","kaab-webhooks-test",[125,126,11,11],[1008,1009,11,11],"Plans and pricing","plans",[1011,1012,1013,1014],"Changelog","\u002Fchangelog","i-lucide-history",[1015,1016],[27,1012,11,11],[1017,1018,11,11],"Deprecations","deprecations",{"id":1020,"title":116,"body":1021,"breaking":2155,"date":2156,"description":2157,"extension":2158,"generated":2155,"meta":2159,"navigation":1350,"path":2160,"seo":2161,"stem":2162,"version":2156,"__hash__":2163},"docs\u002F3.guides\u002F10.security-and-data.md",{"type":1022,"value":1023,"toc":2138},"minimark",[1024,1028,1033,1047,1051,1144,1147,1172,1176,1179,1182,1189,1196,1224,1247,1250,1254,1264,1268,1274,1280,1284,1287,1291,1298,1370,1384,1388,1411,1417,1421,1485,1489,1512,1517,1521,1531,2023,2038,2042,2087,2090,2134],[1025,1026,1027],"p",{},"This page describes what Kaabist keeps when it runs your programs, how it protects credentials and\nsigned-in sessions, and what you can do to keep exposure small. Read it before you automate a flow\nthat signs in, handles personal data or runs on behalf of your own customers.",[1029,1030,1032],"h2",{"id":1031},"when-to-use-it","When to use it",[1025,1034,1035,1036,1041,1042,1046],{},"Use this page when you design a program that handles credentials, when you answer a security\nreview about Kaabist, or when you need to delete what Kaabist holds for your organisation. For the\nexact lifetimes of each record, see ",[1037,1038,1040],"a",{"href":1039},"\u002Fconcepts\u002Fdata-retention","data retention","; for how traffic\nleaves Kaabist, see ",[1037,1043,1045],{"href":1044},"\u002Fconcepts\u002Fegress-and-proxies","egress and proxies",".",[1029,1048,1050],{"id":1049},"what-is-stored-and-where","What is stored, and where",[1052,1053,1054,1070],"table",{},[1055,1056,1057],"thead",{},[1058,1059,1060,1064,1067],"tr",{},[1061,1062,1063],"th",{},"What",[1061,1065,1066],{},"Where",[1061,1068,1069],{},"How long",[1071,1072,1073,1094,1111,1122,1133],"tbody",{},[1058,1074,1075,1088,1091],{},[1076,1077,1078,1079,1083,1084,1087],"td",{},"A job's inputs, result (",[1080,1081,1082],"code",{},"data",", ",[1080,1085,1086],{},"raw","), warnings and timeline",[1076,1089,1090],{},"Kaabist's database, scoped to your organisation; secret inputs encrypted",[1076,1092,1093],{},"results readable for 90 days; test-mode results 24 hours",[1058,1095,1096,1105,1108],{},[1076,1097,1098,1099,1101,1102,1104],{},"Page snapshots, failure screenshots, attention bundles, files from ",[1080,1100,578],{}," and ",[1080,1103,597],{}," steps",[1076,1106,1107],{},"object storage, under a key that starts with your organisation",[1076,1109,1110],{},"your plan's retention: 7, 30 or 90 days",[1058,1112,1113,1116,1119],{},[1076,1114,1115],{},"Ground-truth snapshots of the fields you confirmed",[1076,1117,1118],{},"object storage",[1076,1120,1121],{},"as long as the program version is active: healing works from them",[1058,1123,1124,1127,1130],{},[1076,1125,1126],{},"Sessions (signed-in browser state)",[1076,1128,1129],{},"database, encrypted",[1076,1131,1132],{},"until you delete the session",[1058,1134,1135,1138,1141],{},[1076,1136,1137],{},"Credit ledger and audit log",[1076,1139,1140],{},"database, append-only",[1076,1142,1143],{},"never rewritten",[1025,1145,1146],{},"Data is processed in the EU region by default. Kaabist runs on Hetzner infrastructure, and payments\ngo through Paddle as merchant of record; the full sub-processor list accompanies the data processing\nagreement.",[1025,1148,1149,1150,1153,1154,1157,1158,1101,1161,1164,1165,1101,1168,1171],{},"Retention per plan comes from ",[1037,1151,1009],{"href":1152},"\u002Freference\u002Fplans",": ",[1080,1155,1156],{},"free"," keeps 7 days, ",[1080,1159,1160],{},"developer",[1080,1162,1163],{},"team","\n30, ",[1080,1166,1167],{},"scale",[1080,1169,1170],{},"enterprise"," 90.",[1029,1173,1175],{"id":1174},"encryption-of-secrets","Encryption of secrets",[1025,1177,1178],{},"Every organisation has its own data key. Secrets (session storage state, stored passwords, secret\njob inputs, bring-your-own provider credentials) are encrypted with that key before they are\nwritten, and the data key is itself encrypted by a master key held in a separate key-management\nservice. Plaintext exists only in the memory of the worker running your job: it is never written to\na log, a snapshot, a screenshot or a webhook.",[1025,1180,1181],{},"API keys are stored only as a keyed hash. The key is shown once, when you create it, and cannot be\nshown again.",[1029,1183,1185,1186],{"id":1184},"secret-inputs-and-store","Secret inputs and ",[1080,1187,1188],{},"store",[1025,1190,1191,1192,1195],{},"Declare every password, token or one-time code as an input of type ",[1080,1193,1194],{},"secret",". A secret input is:",[1197,1198,1199,1207,1214],"ul",{},[1200,1201,1202,1203,1206],"li",{},"masked in logs and in the job's ",[1080,1204,1205],{},"meta",", and never returned by any API call;",[1200,1208,1209,1210,1213],{},"redacted in screenshots and snapshots: the field it was typed into (and every ",[1080,1211,1212],{},"type=password","\nfield) is blanked before the capture;",[1200,1215,1216,1217,1220,1221,1223],{},"refused where it would leak: lint error ",[1037,1218,799],{"href":1219},"\u002Freference\u002Fdsl\u002Flint\u002Fe013"," rejects a secret used in\nan ",[1080,1222,569],{}," or rendered into a URL.",[1025,1225,1226,1227,1230,1231,1233,1234,1237,1238,1101,1242,1246],{},"By default a secret is supplied with each job and kept only for that job. ",[1080,1228,1229],{},"store: true"," on a\n",[1080,1232,1194],{}," input lets Kaabist save the value on a session so the session's refresh program can sign in\nagain without you. It works only when your organisation has enabled secret storage; otherwise the\nrequest fails with ",[1080,1235,1236],{},"secret_storage_disabled",". Storing passwords is optional and not recommended: the\nsafer default is a session plus a hosted page that asks a person to sign in again when it expires\n(see ",[1037,1239,1241],{"href":1240},"\u002Fguides\u002Fauthenticated-flows","authenticated flows",[1037,1243,1245],{"href":1244},"\u002Fguides\u002Fhosted-resolve","hosted resolve",").",[1025,1248,1249],{},"Programs that fill a password field are rate limited per organisation (60 runs an hour by default)\nand need a verified payment method.",[1029,1251,1253],{"id":1252},"storage-states-and-sessions","Storage states and sessions",[1025,1255,1256,1257,1260,1261,1046],{},"A session holds a browser's cookies and local storage in Playwright's ",[1080,1258,1259],{},"storageState"," format. It is\nencrypted like any other secret, never included in a snapshot, and never shown back: the panel lets\nyou replace or delete a session, not read it. Jobs that use a session or a secret input run in a\nbrowser process of their own organisation, never one shared with other customers. See\n",[1037,1262,42],{"href":1263},"\u002Fconcepts\u002Fsessions",[1029,1265,1267],{"id":1266},"snapshots-and-redaction","Snapshots and redaction",[1025,1269,1270,1271,1273],{},"A snapshot keeps the page's HTML after it settled, its URL and headers, a summary of the network\nlog, and JSON response bodies up to 512 KB each (for JSON and network locators). Other response\nbodies are dropped, and storage state is never part of a snapshot. Screenshots are kept for failed\nsteps and attention bundles, and when a program takes one with a ",[1080,1272,597],{}," step. Password\nfields and the targets of secret inputs are redacted before any capture.",[1025,1275,1276,1277,1046],{},"When you pick on a stored page in the panel, scripts are removed from the copy and it is shown in a\nsandbox. See ",[1037,1278,66],{"href":1279},"\u002Fconcepts\u002Fsnapshots",[1029,1281,1283],{"id":1282},"live-views-and-hosted-pages","Live views and hosted pages",[1025,1285,1286],{},"A live view (a takeover, a recording session) and a hosted resolve page use short-lived tokens\nscoped to one job: 15 minutes, refreshed while the page is open. The frames of a live view are\nstreamed and never stored.",[1029,1288,1290],{"id":1289},"deleting-your-data","Deleting your data",[1025,1292,1293,1294,1297],{},"An ",[1080,1295,1296],{},"admin"," key (or an owner or admin in the panel) can ask for everything to be deleted:",[1299,1300,1305],"pre",{"className":1301,"code":1302,"language":1303,"meta":1304,"style":1304},"language-http shiki shiki-themes kaab-code kaab-code kaab-code","POST \u002Fv1\u002Forg\u002Fdata-deletion\nAuthorization: Bearer sk_live_…\nContent-Type: application\u002Fjson\n\n{ \"confirm\": \"\u003Cyour organisation's slug>\" }\n","http","",[1080,1306,1307,1320,1334,1345,1352],{"__ignoreMap":1304},[1308,1309,1312,1316],"span",{"class":1310,"line":1311},"line",1,[1308,1313,1315],{"class":1314},"sqn18","POST",[1308,1317,1319],{"class":1318},"sTzsn"," \u002Fv1\u002Forg\u002Fdata-deletion\n",[1308,1321,1323,1327,1330],{"class":1310,"line":1322},2,[1308,1324,1326],{"class":1325},"suOy4","Authorization",[1308,1328,1329],{"class":1314},":",[1308,1331,1333],{"class":1332},"sx8Bj"," Bearer sk_live_…\n",[1308,1335,1337,1340,1342],{"class":1310,"line":1336},3,[1308,1338,1339],{"class":1325},"Content-Type",[1308,1341,1329],{"class":1314},[1308,1343,1344],{"class":1332}," application\u002Fjson\n",[1308,1346,1348],{"class":1310,"line":1347},4,[1308,1349,1351],{"emptyLinePlaceholder":1350},true,"\n",[1308,1353,1355,1358,1361,1364,1367],{"class":1310,"line":1354},5,[1308,1356,1357],{"class":1318},"{ ",[1308,1359,1360],{"class":1314},"\"confirm\"",[1308,1362,1329],{"class":1363},"sQm2-",[1308,1365,1366],{"class":1325}," \"\u003Cyour organisation's slug>\"",[1308,1368,1369],{"class":1318}," }\n",[1025,1371,1372,1373,1376,1377,1101,1380,1383],{},"The answer is ",[1080,1374,1375],{},"202"," with the request's ",[1080,1378,1379],{},"id",[1080,1381,1382],{},"scheduled_for",". Snapshots, results and sessions are\npurged within 24 hours; copies already in backups expire within 35 days. One request can be outstanding per organisation: asking again returns the\nfirst. The credit ledger and the audit log are kept, because they are the record of what was billed\nand who approved what.",[1029,1385,1387],{"id":1386},"webhook-signing","Webhook signing",[1025,1389,1390,1391,1394,1395,1398,1399,1402,1403,1406,1407,1410],{},"Every webhook delivery carries ",[1080,1392,1393],{},"Kaab-Signature: t=\u003Cunix seconds>,v1=\u003Chex>",", an HMAC-SHA256 of\n",[1080,1396,1397],{},"\u003Ct>.\u003Craw body>"," with your endpoint's ",[1080,1400,1401],{},"whsec_…"," secret. Verify it on the raw body, and reject a\ndelivery whose ",[1080,1404,1405],{},"t"," is more than 300 seconds from your clock. After a rotation the previous secret\nkeeps signing alongside the new one for 24 hours, so accept a delivery when any ",[1080,1408,1409],{},"v1"," matches.",[1025,1412,1413,1414,1046],{},"Payloads are minimal: the event, the job, the reason and a link. Extracted data is never in a\nwebhook; fetch the job with your key. See ",[1037,1415,105],{"href":1416},"\u002Fguides\u002Fwebhooks",[1029,1418,1420],{"id":1419},"key-hygiene","Key hygiene",[1197,1422,1423,1451,1457,1470,1479],{},[1200,1424,1425,1429,1430,1433,1434,1437,1438,1083,1441,1444,1445,1447,1448,1450],{},[1426,1427,1428],"strong",{},"Separate keys per use."," ",[1080,1431,1432],{},"sk_test_"," keys run in test mode; ",[1080,1435,1436],{},"sk_live_"," keys do real work. Give a\nservice the narrowest scope it needs: ",[1080,1439,1440],{},"read",[1080,1442,1443],{},"run"," or ",[1080,1446,1296],{},". Only ",[1080,1449,1296],{}," manages keys,\nwebhooks, BYO providers and the organisation.",[1200,1452,1453,1456],{},[1426,1454,1455],{},"Keep keys server-side."," Never ship a key in a browser bundle or a mobile app.",[1200,1458,1459,1429,1462,1465,1466,1469],{},[1426,1460,1461],{},"Rotate with a grace period.",[1080,1463,1464],{},"POST \u002Fv1\u002Fapi-keys\u002F{id}\u002Frotate"," with ",[1080,1467,1468],{},"grace_seconds"," (at most one\nday) issues a new key and keeps the old one working until the grace ends, so you can deploy\nwithout downtime. Revoking is immediate.",[1200,1471,1472,1475,1476,1046],{},[1426,1473,1474],{},"Set an expiry."," Responses to a key with less than 7 days left carry ",[1080,1477,1478],{},"X-Kaab-Key-Expires",[1200,1480,1481,1484],{},[1426,1482,1483],{},"Use two-factor authentication."," Owners and admins need an authenticator app to manage keys,\nmembers and billing in the panel.",[1029,1486,1488],{"id":1487},"ssrf-protection-and-egress","SSRF protection and egress",[1025,1490,1491,1492,1495,1496,1499,1500,1503,1504,1507,1508,1511],{},"Every request a job makes leaves through Kaabist's egress gateway; workers have no other route to\nthe internet. The gateway resolves the hostname itself, checks the address, and connects to that\nchecked address, again on every redirect. Private networks (RFC 1918), loopback, link-local\naddresses, the cloud metadata address ",[1080,1493,1494],{},"169.254.169.254",", their IPv6 equivalents and ",[1080,1497,1498],{},".internal"," and\n",[1080,1501,1502],{},".local"," names are refused, as are targets on Kaabist's blocklist. A refused request fails the job\nwith ",[1080,1505,1506],{},"ssrf_blocked"," (or ",[1080,1509,1510],{},"target_disallowed"," for a blocked target).",[1025,1513,1514,1515,1046],{},"The gateway also paces requests per hostname across all customers, so a burst of your jobs does not\nhammer a site. See ",[1037,1516,1045],{"href":1044},[1029,1518,1520],{"id":1519},"worked-example","Worked example",[1025,1522,1523,1524,1527,1528,1530],{},"Take a customer portal at ",[1080,1525,1526],{},"https:\u002F\u002Fportal.example.com"," that signs in with an e-mail, a password and\na one-time code. The program\ndeclares the password as a ",[1080,1529,1194],{}," input, so it is typed into the form but never logged, captured\nor returned:",[1532,1533,1534,1673,1784],"code-group",{},[1299,1535,1540],{"className":1536,"code":1537,"filename":1538,"language":1539,"meta":1304,"style":1304},"language-ts shiki shiki-themes kaab-code kaab-code kaab-code","\u002F\u002F `password` is declared `{ \"type\": \"secret\" }` in the program: it is encrypted at rest, never\n\u002F\u002F returned, and redacted from logs, step records and snapshots.\nconst job = await kaab.jobs.create({\n  program: name,\n  inputs: {\n    base_url: `${site}`,\n    password: process.env.LOGIN_PASSWORD ?? \"secret\",\n  },\n});\n","TypeScript","ts",[1080,1541,1542,1548,1553,1582,1595,1605,1630,1659,1667],{"__ignoreMap":1304},[1308,1543,1544],{"class":1310,"line":1311},[1308,1545,1547],{"class":1546},"sKog0","\u002F\u002F `password` is declared `{ \"type\": \"secret\" }` in the program: it is encrypted at rest, never\n",[1308,1549,1550],{"class":1310,"line":1322},[1308,1551,1552],{"class":1546},"\u002F\u002F returned, and redacted from logs, step records and snapshots.\n",[1308,1554,1555,1558,1562,1565,1568,1571,1574,1576,1579],{"class":1310,"line":1336},[1308,1556,1557],{"class":1314},"const",[1308,1559,1561],{"class":1560},"sHJIl"," job",[1308,1563,1564],{"class":1314}," =",[1308,1566,1567],{"class":1314}," await",[1308,1569,1570],{"class":1560}," kaab",[1308,1572,1046],{"class":1573},"sJugJ",[1308,1575,171],{"class":1560},[1308,1577,1578],{"class":1573},".create",[1308,1580,1581],{"class":1318},"({\n",[1308,1583,1584,1587,1589,1592],{"class":1310,"line":1347},[1308,1585,1586],{"class":1318},"  program",[1308,1588,1329],{"class":1314},[1308,1590,1591],{"class":1318}," name",[1308,1593,1594],{"class":1363},",\n",[1308,1596,1597,1600,1602],{"class":1310,"line":1354},[1308,1598,1599],{"class":1318},"  inputs",[1308,1601,1329],{"class":1314},[1308,1603,1604],{"class":1318}," {\n",[1308,1606,1608,1611,1613,1616,1619,1622,1625,1628],{"class":1310,"line":1607},6,[1308,1609,1610],{"class":1318},"    base_url",[1308,1612,1329],{"class":1314},[1308,1614,1615],{"class":1325}," `",[1308,1617,1618],{"class":1314},"${",[1308,1620,1621],{"class":1318},"site",[1308,1623,1624],{"class":1314},"}",[1308,1626,1627],{"class":1325},"`",[1308,1629,1594],{"class":1363},[1308,1631,1633,1636,1638,1641,1643,1646,1648,1651,1654,1657],{"class":1310,"line":1632},7,[1308,1634,1635],{"class":1318},"    password",[1308,1637,1329],{"class":1314},[1308,1639,1640],{"class":1560}," process",[1308,1642,1046],{"class":1318},[1308,1644,1645],{"class":1560},"env",[1308,1647,1046],{"class":1318},[1308,1649,1650],{"class":1560},"LOGIN_PASSWORD",[1308,1652,1653],{"class":1314}," ??",[1308,1655,1656],{"class":1325}," \"secret\"",[1308,1658,1594],{"class":1363},[1308,1660,1662,1665],{"class":1310,"line":1661},8,[1308,1663,1664],{"class":1318},"  }",[1308,1666,1594],{"class":1363},[1308,1668,1670],{"class":1310,"line":1669},9,[1308,1671,1672],{"class":1318},"});\n",[1299,1674,1679],{"className":1675,"code":1676,"filename":1677,"language":1678,"meta":1304,"style":1304},"language-python shiki shiki-themes kaab-code kaab-code kaab-code","# password is declared {\"type\": \"secret\"} in the program: encrypted at rest, never returned,\n# and redacted from logs, step records and snapshots.\npassword = os.environ.get(\"LOGIN_PASSWORD\", \"secret\")\njob = kaab.jobs.create(program=name, inputs={\"base_url\": f\"{site}\", \"password\": password})\n","Python","python",[1080,1680,1681,1686,1691,1726],{"__ignoreMap":1304},[1308,1682,1683],{"class":1310,"line":1311},[1308,1684,1685],{"class":1546},"# password is declared {\"type\": \"secret\"} in the program: encrypted at rest, never returned,\n",[1308,1687,1688],{"class":1310,"line":1322},[1308,1689,1690],{"class":1546},"# and redacted from logs, step records and snapshots.\n",[1308,1692,1693,1696,1699,1702,1704,1707,1709,1712,1715,1718,1720,1723],{"class":1310,"line":1336},[1308,1694,1695],{"class":1318},"password ",[1308,1697,1698],{"class":1314},"=",[1308,1700,1701],{"class":1318}," os",[1308,1703,1046],{"class":1363},[1308,1705,1706],{"class":1318},"environ",[1308,1708,1046],{"class":1363},[1308,1710,1711],{"class":1573},"get",[1308,1713,1714],{"class":1363},"(",[1308,1716,1717],{"class":1325},"\"LOGIN_PASSWORD\"",[1308,1719,1083],{"class":1363},[1308,1721,1722],{"class":1325},"\"secret\"",[1308,1724,1725],{"class":1363},")\n",[1308,1727,1728,1731,1733,1735,1737,1739,1741,1744,1747,1749,1752,1754,1757,1760,1762,1765,1768,1770,1772,1774,1776,1778,1781],{"class":1310,"line":1347},[1308,1729,1730],{"class":1318},"job ",[1308,1732,1698],{"class":1314},[1308,1734,1570],{"class":1318},[1308,1736,1046],{"class":1363},[1308,1738,171],{"class":1318},[1308,1740,1046],{"class":1363},[1308,1742,1743],{"class":1573},"create",[1308,1745,1746],{"class":1363},"(program",[1308,1748,1698],{"class":1314},[1308,1750,1751],{"class":1363},"name, inputs",[1308,1753,1698],{"class":1314},[1308,1755,1756],{"class":1363},"{",[1308,1758,1759],{"class":1325},"\"base_url\"",[1308,1761,1153],{"class":1363},[1308,1763,1764],{"class":1314},"f",[1308,1766,1767],{"class":1325},"\"",[1308,1769,1756],{"class":1560},[1308,1771,1621],{"class":1363},[1308,1773,1624],{"class":1560},[1308,1775,1767],{"class":1325},[1308,1777,1083],{"class":1363},[1308,1779,1780],{"class":1325},"\"password\"",[1308,1782,1783],{"class":1363},": password})\n",[1299,1785,1790],{"className":1786,"code":1787,"filename":1788,"language":1789,"meta":1304,"style":1304},"language-go shiki shiki-themes kaab-code kaab-code kaab-code","\u002F\u002F password is declared {\"type\": \"secret\"} in the program: encrypted at rest, never returned,\n\u002F\u002F and redacted from logs, step records and snapshots.\npassword := os.Getenv(\"LOGIN_PASSWORD\")\nif password == \"\" {\n    password = \"secret\"\n}\nbody, err := kaab.Body[client.CreateJobJSONBody](map[string]any{\n    \"program\": name,\n    \"inputs\":  map[string]any{\"base_url\": site + \"\", \"password\": password},\n})\nif err != nil {\n    log.Fatal(err)\n}\njob, err := c.Jobs.Create(ctx, body)\nif err != nil {\n    log.Fatal(err)\n}\n","Go","go",[1080,1791,1792,1797,1802,1821,1837,1847,1852,1895,1903,1940,1946,1962,1974,1979,1996,2009,2018],{"__ignoreMap":1304},[1308,1793,1794],{"class":1310,"line":1311},[1308,1795,1796],{"class":1546},"\u002F\u002F password is declared {\"type\": \"secret\"} in the program: encrypted at rest, never returned,\n",[1308,1798,1799],{"class":1310,"line":1322},[1308,1800,1801],{"class":1546},"\u002F\u002F and redacted from logs, step records and snapshots.\n",[1308,1803,1804,1806,1809,1812,1815,1817,1819],{"class":1310,"line":1336},[1308,1805,1695],{"class":1318},[1308,1807,1808],{"class":1314},":=",[1308,1810,1811],{"class":1318}," os.",[1308,1813,1814],{"class":1573},"Getenv",[1308,1816,1714],{"class":1318},[1308,1818,1717],{"class":1325},[1308,1820,1725],{"class":1318},[1308,1822,1823,1826,1829,1832,1835],{"class":1310,"line":1347},[1308,1824,1825],{"class":1314},"if",[1308,1827,1828],{"class":1318}," password ",[1308,1830,1831],{"class":1314},"==",[1308,1833,1834],{"class":1325}," \"\"",[1308,1836,1604],{"class":1318},[1308,1838,1839,1842,1844],{"class":1310,"line":1354},[1308,1840,1841],{"class":1318},"    password ",[1308,1843,1698],{"class":1314},[1308,1845,1846],{"class":1325}," \"secret\"\n",[1308,1848,1849],{"class":1310,"line":1607},[1308,1850,1851],{"class":1318},"}\n",[1308,1853,1854,1857,1859,1862,1865,1868,1871,1873,1876,1879,1882,1884,1887,1890,1892],{"class":1310,"line":1632},[1308,1855,1856],{"class":1318},"body, err ",[1308,1858,1808],{"class":1314},[1308,1860,1861],{"class":1318}," kaab.",[1308,1863,1864],{"class":1573},"Body",[1308,1866,1867],{"class":1318},"[",[1308,1869,1870],{"class":1573},"client",[1308,1872,1046],{"class":1318},[1308,1874,1875],{"class":1573},"CreateJobJSONBody",[1308,1877,1878],{"class":1318},"](",[1308,1880,1881],{"class":1314},"map",[1308,1883,1867],{"class":1318},[1308,1885,1886],{"class":1314},"string",[1308,1888,1889],{"class":1318},"]",[1308,1891,634],{"class":1573},[1308,1893,1894],{"class":1318},"{\n",[1308,1896,1897,1900],{"class":1310,"line":1661},[1308,1898,1899],{"class":1325},"    \"program\"",[1308,1901,1902],{"class":1318},": name,\n",[1308,1904,1905,1908,1911,1913,1915,1917,1919,1921,1923,1925,1928,1931,1933,1935,1937],{"class":1310,"line":1669},[1308,1906,1907],{"class":1325},"    \"inputs\"",[1308,1909,1910],{"class":1318},":  ",[1308,1912,1881],{"class":1314},[1308,1914,1867],{"class":1318},[1308,1916,1886],{"class":1314},[1308,1918,1889],{"class":1318},[1308,1920,634],{"class":1573},[1308,1922,1756],{"class":1318},[1308,1924,1759],{"class":1325},[1308,1926,1927],{"class":1318},": site ",[1308,1929,1930],{"class":1314},"+",[1308,1932,1834],{"class":1325},[1308,1934,1083],{"class":1318},[1308,1936,1780],{"class":1325},[1308,1938,1939],{"class":1318},": password},\n",[1308,1941,1943],{"class":1310,"line":1942},10,[1308,1944,1945],{"class":1318},"})\n",[1308,1947,1949,1951,1954,1957,1960],{"class":1310,"line":1948},11,[1308,1950,1825],{"class":1314},[1308,1952,1953],{"class":1318}," err ",[1308,1955,1956],{"class":1314},"!=",[1308,1958,1959],{"class":1560}," nil",[1308,1961,1604],{"class":1318},[1308,1963,1965,1968,1971],{"class":1310,"line":1964},12,[1308,1966,1967],{"class":1318},"    log.",[1308,1969,1970],{"class":1573},"Fatal",[1308,1972,1973],{"class":1318},"(err)\n",[1308,1975,1977],{"class":1310,"line":1976},13,[1308,1978,1851],{"class":1318},[1308,1980,1982,1985,1987,1990,1993],{"class":1310,"line":1981},14,[1308,1983,1984],{"class":1318},"job, err ",[1308,1986,1808],{"class":1314},[1308,1988,1989],{"class":1318}," c.Jobs.",[1308,1991,1992],{"class":1573},"Create",[1308,1994,1995],{"class":1318},"(ctx, body)\n",[1308,1997,1999,2001,2003,2005,2007],{"class":1310,"line":1998},15,[1308,2000,1825],{"class":1314},[1308,2002,1953],{"class":1318},[1308,2004,1956],{"class":1314},[1308,2006,1959],{"class":1560},[1308,2008,1604],{"class":1318},[1308,2010,2012,2014,2016],{"class":1310,"line":2011},16,[1308,2013,1967],{"class":1318},[1308,2015,1970],{"class":1573},[1308,2017,1973],{"class":1318},[1308,2019,2021],{"class":1310,"line":2020},17,[1308,2022,1851],{"class":1318},[1025,2024,2025,2026,1083,2029,2031,2032,2034,2035,2037],{},"Read the finished job back: the envelope identifies the inputs only by ",[1080,2027,2028],{},"inputs_hash",[1080,2030,1205],{}," holds\nno password, and the password field is blank in the step's stored page. The other half is the\nnetwork guard: a job pointed at a page that redirects to ",[1080,2033,1494],{}," fails with\n",[1080,2036,1506],{}," instead of following it.",[1029,2039,2041],{"id":2040},"pitfalls","Pitfalls",[1197,2043,2044,2055,2061,2069,2075],{},[1200,2045,2046,2052,2053,1046],{},[1426,2047,2048,2049,2051],{},"A secret as a plain ",[1080,2050,1886],{}," input."," It is then logged and returned like any other input.\nDeclare it ",[1080,2054,1194],{},[1200,2056,2057,2060],{},[1426,2058,2059],{},"Extracting a value that contains personal data you do not need."," Kaabist stores what your\nprogram extracts for the retention period. Extract only what you use.",[1200,2062,2063,2068],{},[1426,2064,2065,2067],{},[1080,2066,1229],{}," by habit."," It keeps a password at rest. Prefer a session and a hosted re-login.",[1200,2070,2071,2074],{},[1426,2072,2073],{},"Trusting a webhook without checking the signature",", or verifying a re-serialized body instead\nof the raw one.",[1200,2076,2077,2083,2084,2086],{},[1426,2078,2079,2080,2082],{},"One ",[1080,2081,1296],{}," key everywhere."," A leaked ",[1080,2085,1443],{}," key cannot create keys or change webhooks.",[1029,2088,155],{"id":2089},"reference",[1197,2091,2092,2097,2111,2119,2129],{},[1200,2093,2094],{},[1037,2095,387],{"href":2096},"\u002Freference\u002Fapi\u002Forg\u002Frequest-data-deletion",[1200,2098,2099,1083,2103,1594,2107],{},[1037,2100,2102],{"href":2101},"\u002Freference\u002Fapi\u002Fapi-keys\u002Fcreate-api-key","Create an API key",[1037,2104,2106],{"href":2105},"\u002Freference\u002Fapi\u002Fapi-keys\u002Frotate-api-key","rotate",[1037,2108,2110],{"href":2109},"\u002Freference\u002Fapi\u002Fapi-keys\u002Frevoke-api-key","revoke",[1200,2112,2113,2116,2117],{},[1037,2114,527],{"href":2115},"\u002Freference\u002Fdsl\u002Finputs"," and lint ",[1037,2118,799],{"href":1219},[1200,2120,2121,1101,2125],{},[1037,2122,2124],{"href":2123},"\u002Freference\u002Fcodes#errors","Error codes",[1037,2126,2128],{"href":2127},"\u002Freference\u002Fcodes#key-scopes","key scopes",[1200,2130,2131],{},[1037,2132,2133],{"href":1152},"Plans",[2135,2136,2137],"style",{},"html pre.shiki code .sqn18, html code.shiki .sqn18{--shiki-light:var(--kaab-code-token-keyword);--shiki-default:var(--kaab-code-token-keyword);--shiki-dark:var(--kaab-code-token-keyword)}html pre.shiki code .sTzsn, html code.shiki .sTzsn{--shiki-light:var(--kaab-code-foreground);--shiki-default:var(--kaab-code-foreground);--shiki-dark:var(--kaab-code-foreground)}html pre.shiki code .suOy4, html code.shiki .suOy4{--shiki-light:var(--kaab-code-token-string-expression);--shiki-default:var(--kaab-code-token-string-expression);--shiki-dark:var(--kaab-code-token-string-expression)}html pre.shiki code .sx8Bj, html code.shiki .sx8Bj{--shiki-light:var(--kaab-code-token-string);--shiki-default:var(--kaab-code-token-string);--shiki-dark:var(--kaab-code-token-string)}html pre.shiki code .sQm2-, html code.shiki .sQm2-{--shiki-light:var(--kaab-code-token-punctuation);--shiki-default:var(--kaab-code-token-punctuation);--shiki-dark:var(--kaab-code-token-punctuation)}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sKog0, html code.shiki .sKog0{--shiki-light:var(--kaab-code-token-comment);--shiki-default:var(--kaab-code-token-comment);--shiki-dark:var(--kaab-code-token-comment)}html pre.shiki code .sHJIl, html code.shiki .sHJIl{--shiki-light:var(--kaab-code-token-constant);--shiki-default:var(--kaab-code-token-constant);--shiki-dark:var(--kaab-code-token-constant)}html pre.shiki code .sJugJ, html code.shiki .sJugJ{--shiki-light:var(--kaab-code-token-function);--shiki-default:var(--kaab-code-token-function);--shiki-dark:var(--kaab-code-token-function)}",{"title":1304,"searchDepth":1336,"depth":1336,"links":2139},[2140,2141,2142,2143,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154],{"id":1031,"depth":1322,"text":1032},{"id":1049,"depth":1322,"text":1050},{"id":1174,"depth":1322,"text":1175},{"id":1184,"depth":1322,"text":2144},"Secret inputs and store",{"id":1252,"depth":1322,"text":1253},{"id":1266,"depth":1322,"text":1267},{"id":1282,"depth":1322,"text":1283},{"id":1289,"depth":1322,"text":1290},{"id":1386,"depth":1322,"text":1387},{"id":1419,"depth":1322,"text":1420},{"id":1487,"depth":1322,"text":1488},{"id":1519,"depth":1322,"text":1520},{"id":2040,"depth":1322,"text":2041},{"id":2089,"depth":1322,"text":155},false,null,"What Kaabist stores about your jobs, how secrets and sessions are protected, how long data is kept, and how to delete it.","md",{},"\u002Fguides\u002Fsecurity-and-data",{"title":116,"description":2157},"3.guides\u002F10.security-and-data","HiaKlXza9zIfB_zG6RURLw4C-xgmAFK58jkvgi_3884",[2165,2169],{"title":113,"path":2166,"stem":2167,"description":2168,"children":-1},"\u002Fguides\u002Fside-effect-safety","3.guides\u002F09.side-effect-safety","Mark the steps that change something, checkpoint after them, and send an idempotency key, so an order is never placed twice.",{"title":119,"path":2170,"stem":2171,"description":2172,"children":-1},"\u002Fguides\u002Fmigrating","3.guides\u002F11.migrating","Move Playwright or Puppeteer scripts, scraping-API calls and no-code scrapers to Kaabist programs, with a concept map and a worked conversion.",1793593417476]