Dashboard and keys

The dashboard reads tenant-scoped control-plane projections. It also manages sites and their keys.

Recent sessions

The overview and session list each load at most the 120 newest projected rows in the workspace. They are bounded views, not lifetime totals. The dashboard can show verdict counts, non-weak signal frequencies, request IDs, edge names, projected identity, and family labels derived from findings. A session detail route first verifies that the request ID belongs to the current workspace. It then tries to load the full edge record, which can include raw IP, submitted measurements and declarations, parsed transport evidence, geometry, sensor admissions, concealment, and identity. The current dashboard sends every live-record request to one configured edge instead of routing by the row’s recorded POP. A live session collected at another POP can therefore fall back to the stored projection. The same fallback occurs after live state is gone. The projection cannot restore the full session, raw IP, detailed transports, geometry, the complete concealment and sensor reports, contradicting_families, or per-finding sensor admissions.

Sites and keys

A site groups public keys, secret keys, and attributed control-plane rows. Its name is required. Its domain is optional display metadata and is not enforced against collector requests. Creating a site issues its first public site key.

Key	Format	Location	Authority
Public site key	`hrtc_live_<24 lowercase hex>`	Browser	Attributes a settled projection to one site
Secret verdict key	`hrtc_sk_<32 lowercase hex>`	Server	Reads projected verdicts for one site

A public key does not sign a collection, prove an origin, or authorize a read. A secret key must not appear in browser code, URLs, client-visible environment variables, or a public repository. A site can have several active keys of either type.

Issue a secret key

Open Keys and collector, select a site, and issue a secret key. The dashboard shows the complete value once. Heretic stores a SHA-256 hash and a short display prefix, not the complete secret. If the value is lost, revoke it and issue another. Use it only on the server:

const requestId = collectorRequestId;

const response = await fetch(
  `https://heretic.quest/v1/verdict/${encodeURIComponent(requestId)}`,
  {
    headers: {
      authorization: `Bearer ${process.env.HERETIC_VERDICT_KEY}`,
    },
  },
);

Use the raw request ID unchanged. See Tenant verdict endpoint.

Rotate a public key

Issue a new site key.
Deploy it in browser configuration.
Confirm that new collections use it.
Revoke the old key.

Revoking a public key prevents future projections under that value from receiving tenant attribution. It does not make the edge reject collection. Identity version 2 uses an accepted public key’s trimmed value as part of the ID scope. Empty values and values longer than 128 bytes do not establish a key scope. Rotation changes subsequent machine and instance IDs even when normalized components stay the same.

Rotate a secret key

Issue and copy a new secret.
Update your server secret store and deployment.
Make a server-side read with the new value.
Revoke the old secret.

Revocation stops later reads with the old value.

Delete projected verdicts

The dashboard’s delete action removes control-plane verdict rows attributed to the selected site and workspace. It then records erasure metadata with the workspace, site, deleted row count, requester when available, and timestamp. The action does not:

remove a live edge session
rewrite append-only edge NDJSON
revoke keys
archive the site
delete unattributed control-plane rows
remove the erasure record

Retire a site

Retiring a site sets its archive time and revokes its active public and secret keys. It does not delete existing projected rows, live edge state, or edge files. Delete the site’s projection separately when that is the intended operation. Read Privacy and retention for the storage layers and deletion boundaries.

Get started

Understand Heretic

Integrate

Reference

Manage and troubleshoot

Dashboard and keys

Recent sessions

Sites and keys

Issue a secret key

Rotate a public key

Rotate a secret key

Delete projected verdicts

Retire a site

​Recent sessions

​Sites and keys

​Issue a secret key

​Rotate a public key

​Rotate a secret key

​Delete projected verdicts

​Retire a site

Recent sessions

Sites and keys

Issue a secret key

Rotate a public key

Rotate a secret key

Delete projected verdicts

Retire a site