perflooplog inget early access →

Connect Axiom.

Exact datasets or saved views. A query-only token. Schema metadata and time-bounded aggregate results, never raw event rows.

connector status: live

The grant surface

  • advanced api token · query readCreate a Custom advanced API token. Give it Query read access only for the datasets or views you will submit. Do not use a personal access token. Axiom documents this in its token guide.
  • exact resource namesEnter each dataset or saved-view name exactly. Perfloop validates each name. It does not list every dataset the token can access.
  • one https originUse the base URL for your Axiom deployment. The default is https://api.axiom.co. Paths, query strings, credentials in the URL, and IP addresses are rejected.

What can cross

  • Schema metadata. The exact getschema operation returns field names and types.
  • Aggregate results. Every data query has a bounded time window and one registered source. Agent-visible results contain at most 1,000 rows. Fixed verification queries can read a complete grouped aggregate without this row cap, so proof data is not silently truncated. The final data stage must summarize or count.
  • Grouping values. An aggregate can group by fields in the authorized dataset or view. Those values can be high-cardinality or sensitive. Use a saved view or sanitized dataset that excludes values you do not want Perfloop to receive.

The connector rejects raw-row projection, row limits, raw-value collection, and cross-dataset queries before provider egress. It can store query definitions, aggregate results, and evidence derived from them.

Setup

1 · create the token

In Axiom, open Settings → API tokens → New API token. Select Advanced, then Custom. Grant Query read only for the exact resources you plan to connect. Add an expiration date if your policy requires one.

2 · choose the data boundary

Prefer a saved view or sanitized dataset that omits payloads, personal data, secrets, and any field value that must not appear in an aggregate grouping.

3 · connect in perfloop

On your Perfloop Setup page, enter the Axiom deployment URL, the token, and one row per dataset or view. Connect validates each name with a bounded count. If one validation fails, no new connection scope or token envelope is committed.

Credential handling

The token reaches the Perfloop API only during the connect request. The proxy validates the resources and seals the token with a per-credential data key. Perfloop stores the token only as an encrypted envelope. The controller, model, and sandbox do not receive the plaintext token. For each later query, the proxy rechecks the tenant, endpoint, registered resource, query body, and live credential before it opens and injects the token.

Replacement and revocation

Use Replace Axiom token on Setup to rotate the token or change the resource list. The current connection remains active unless the replacement validates and commits. Revoke or delete the token in Axiom to stop new reads. Revocation does not delete product records or stored connection metadata; request tenant deletion for that data.

questions from your security team: security@perfloop.ai