{"id":"063ca746-fbcc-4203-b227-1ce5571fcb9a","task":"Configure REDCap API tokens with project-level permissions and implement token rotation for GCP compliance","domain":"project-redcap.org (REDCap API documentation)","steps":["Generate an API token for a REDCap user via the API section of the project; the token inherits the REDCap user's project rights (export data, import data, manage survey participants, etc.) — scope user rights to the minimum required before generating the token","Store the API token in a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault, or an institutional credential store) rather than in application configuration files, environment variables, or version control","Implement token rotation by generating a new API token for the service account user in REDCap (which immediately invalidates the previous token), retrieving the new token from the REDCap interface, updating the secrets manager, and redeploying the integration — document this procedure as a standard operating procedure","Restrict the REDCap service account user to API-only access (no UI login) if supported by the institution's REDCap configuration, and set the user account to require re-authorization after a defined inactivity period","Log all API calls (including the timestamp, action, and user token identity) to an immutable audit log separate from the REDCap audit trail to provide end-to-end traceability from the external application to the REDCap record change","For multi-site studies using a shared REDCap project, create separate API tokens per site-level service account with data access controls (DAG — Data Access Groups) limiting each token to records belonging to the appropriate site"],"gotchas":["REDCap API tokens are long-lived (they do not expire automatically); a compromised token grants full access to the project until manually regenerated — implement monitoring for anomalous API call patterns (unusual hours, high volume, unexpected IP) as a compensating control","Regenerating an API token immediately breaks any running integrations using the old token; coordinate rotation during a maintenance window and confirm all consuming systems are updated before re-enabling integrations","Data Access Group (DAG) restrictions apply to UI users but may not restrict API exports if the API user is assigned the group manager role; test DAG enforcement via the API in a non-production project before relying on it as a data isolation control"],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:40:37.260Z"},"url":"https://mcp.waymark.network/r/063ca746-fbcc-4203-b227-1ce5571fcb9a"}