Skip to content

Smartsheet API Key

Service Name: Smartsheet

Service Description: Smartsheet is a work execution platform that enables teams to manage projects, automate workflows, and collaborate in real-time. It provides spreadsheet-like interfaces with enhanced project management capabilities.

Service Address: https://www.smartsheet.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through Smartsheet's security settings.

Secret Access Scope: Grants programmatic access to Smartsheet resources including sheets, reports, workspaces, and automation workflows.

Secret Revokement URL: https://help.smartsheet.com/articles/2478565-manage-personal-access-tokens

Secret Example: 77te2dvpj9xzgxgj8a8m9pm3f2

Suspicious Activity Investigation Instructions:

  • Review the Smartsheet activity log for unusual API calls or resource access.
  • Check for unauthorized sheet access, data exports, or modifications.
  • Monitor for unexpected automation or workflow changes.
  • Examine access patterns for unusual times or locations.
  • Review any new integrations or connected apps that may have been added.

Mitigation Instructions:

  • Log in to your Smartsheet account and navigate to Account > Personal Settings > API Access.
  • Locate the compromised API key and click Revoke to immediately invalidate it.
  • Generate a new API key if needed for legitimate applications.
  • Review and update permissions for any sheets or workspaces that may have been accessed.
  • Consider implementing IP restrictions for API access if not already in place.
  • Update any applications or integrations to use the new API key.
  • Enable two-factor authentication for your Smartsheet account if not already enabled.