Skip to content

Contentful API Key

Service Name: Contentful

Service Description: Contentful is a headless content management system (CMS) that allows businesses to create, manage, and distribute content to any platform or device. It provides a flexible and scalable solution for managing digital content across multiple channels.

Service Address: https://www.contentful.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the organization level for API access.

Secret Access Scope: Grants access to manage content, spaces, environments, and assets within Contentful. Depending on the token type (Personal Access Token, Content Management API token, or Content Delivery API token), it may provide read-only or read-write access to specific spaces and environments.

Secret Revokement URL: https://app.contentful.com/account/tokens

Secret Example: CFPAT- 1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghij

Suspicious Activity Investigation Instructions:

  • Review the Contentful audit logs for unusual content modifications or API calls.
  • Check for unexpected content changes, deletions, or creations.
  • Monitor for unauthorized space or environment access.
  • Review API usage metrics for unusual patterns or spikes in activity.
  • Check for new API keys or tokens that may have been created without authorization.

Mitigation Instructions:

  • Log in to your Contentful account at https://app.contentful.com/.

  • Navigate to the Settings menu and select API keys or go to your account settings.

  • Locate the compromised API key and click Revoke or Delete.

  • Create a new API key with appropriate permissions if needed.
  • Review and update access permissions for all remaining API keys.
  • Consider implementing IP restrictions for API access if not already in place.
  • Audit content for any unauthorized changes and restore from backups if necessary.