Skip to content

Smartsheet API Secret

Service Name: Smartsheet

Service Description: Smartsheet is a cloud-based work execution platform that enables teams to plan, capture, manage, automate, and report on work at scale. It provides a spreadsheet-like interface with project management, task automation, and collaboration features.

Service Address: https://www.smartsheet.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level for Enterprise plans through Smartsheet's security controls.

Secret Access Scope: Grants programmatic access to Smartsheet resources including sheets, reports, workspaces, and automation workflows. Can be used to read, create, update, and delete Smartsheet data based on the permissions of the associated user account.

Secret Revokement URL: https://app.smartsheet.com/account/user#apiTokens

Secret Example: ll352u9jujauoqz4gstvsae05

Suspicious Activity Investigation Instructions:

  • Review the API access logs in your Smartsheet account for unusual activity.
  • Check for unexpected changes to sheets, reports, or workspaces.
  • Monitor for unauthorized data exports or sharing settings changes.
  • Examine the IP addresses and locations that have accessed your Smartsheet account.
  • Review automation workflows for any unauthorized modifications.

Mitigation Instructions:

  • Log in to your Smartsheet account and navigate to Account > Personal Settings.
  • Select the API Access tab.
  • Find the compromised API token and click Revoke to immediately invalidate it.
  • Generate a new API token if needed for legitimate applications.
  • Review all applications and integrations that use Smartsheet API tokens.
  • Consider implementing IP restrictions for API access if on an Enterprise plan.
  • Review user permissions and sharing settings for sensitive sheets and workspaces.
  • Enable two-factor authentication for all users with API access.