API Reference

Base URL: http://localhost:8080. Every endpoint below is generated directly from the backend's own OpenAPI 3.0 spec — 62 operations across 13 categories, not a curated subset. Raw spec: openapi.yaml.

Authentication

Browser sessions authenticate via an httpOnly token cookie set by POST /api/auth/login — no Authorization header needed for dashboard use. Protected endpoints read this cookie automatically. Agent endpoints authenticate with a per-agent key in the X-Agent-Key header instead. Endpoints marked (no auth) below are intentionally public (login, registration, password reset).

Auth

User authentication and session management

Method	Path	Description
POST	/api/auth/login	Log in with username + password (no auth)
POST	/api/auth/login/2fa	Complete TOTP two-factor login (no auth)
POST	/api/auth/logout	Log out (clears auth cookies)
POST	/api/auth/register	Register a new user (first user gets admin) (no auth)
POST	/api/auth/forgot-password	Request a password reset link via email (no auth)
POST	/api/auth/reset-password	Reset password with a token from email link (no auth)
GET	/api/auth/profile	Get the current user's profile
PATCH	/api/auth/profile	Update profile (email)
POST	/api/auth/change-password	Change password (requires current password)

Signup

Self-serve tenant provisioning

Method	Path	Description
POST	/api/signup	Self-serve tenant provisioning (no SMTP required) (no auth)

Agents

Endpoint agent registration and telemetry

Method	Path	Description
GET	/api/agents	List agents (optionally filtered by platform)
POST	/api/agents/register	Register a new endpoint agent (no auth)
GET	/api/agents/{id}	Get a single agent by ID
GET	/api/agents/{id}/summary	Get a rich summary (health, risk, recent events) for an agent
POST	/api/agents/heartbeat	Agent heartbeat (agent-authenticated)
POST	/api/agents/logs	Submit log batch from an agent

Alerts

Security alert lifecycle

Method	Path	Description
GET	/api/alerts	List recent alerts
GET	/api/alerts/paginated	Paginated alert list
GET	/api/alerts/{id}	Get alert detail with AI triage result
POST	/api/alerts/{id}/acknowledge	Acknowledge an alert
POST	/api/alerts/{id}/resolve	Resolve an alert

Incidents

Incident management and IR lifecycle

Method	Path	Description
GET	/api/incidents	List incidents
PUT	/api/incidents/{id}/status	Update incident status
POST	/api/incidents/{id}/notes	Add analyst note to incident

Sigma

Sigma detection rules

Method	Path	Description
GET	/api/sigma/rules	List all Sigma detection rules for the tenant
POST	/api/sigma/rules	Create a new Sigma rule
GET	/api/sigma/rules/{id}	Get a Sigma rule by ID
PUT	/api/sigma/rules/{id}	Update a Sigma rule
DELETE	/api/sigma/rules/{id}	Delete a Sigma rule
PATCH	/api/sigma/rules/{id}/enable	Enable a Sigma rule
PATCH	/api/sigma/rules/{id}/disable	Disable a Sigma rule
POST	/api/sigma/rules/test	Test Sigma rules against a sample log message
GET	/api/sigma/stats	Get Sigma rule statistics (total, enabled, by severity)

IOC

Indicators of Compromise

Method	Path	Description
GET	/api/iocs	List IOCs
POST	/api/iocs	Create an IOC
PATCH	/api/iocs/{id}/enable	Enable an IOC
PATCH	/api/iocs/{id}/disable	Disable an IOC
POST	/api/iocs/import	Bulk import IOCs from a text list

YARA

YARA rules and scan matches

Method	Path	Description
GET	/api/yara/rules	List YARA rules
POST	/api/yara/rules	Create a YARA rule
GET	/api/yara/matches	List YARA match events

Firewall

Firewall rule management and sync

Method	Path	Description
GET	/api/firewall/rules	List firewall rules
POST	/api/firewall/rules	Create a firewall rule
GET	/api/firewall/rules/{id}	Get a firewall rule by ID
PUT	/api/firewall/rules/{id}	Update a firewall rule
DELETE	/api/firewall/rules/{id}	Delete a firewall rule
POST	/api/firewall/sync	Push firewall rules to all online agents
GET	/api/firewall/stats	Firewall hit statistics and tag distribution
GET	/api/firewall/policy	Get per-tenant default action + enforcement mode
PUT	/api/firewall/policy	Set default action and mode
POST	/api/firewall/rules/bulk	Bulk enable / disable / delete rules by ID list
POST	/api/firewall/rules/import	Import rules from JSON (replace or merge)
GET	/api/firewall/templates	List 12 built-in rule templates
GET	/api/firewall/expired	List expired rules
DELETE	/api/firewall/expired	Prune all expired rules
GET	/api/firewall/conflicts	Detect CIDR / port-range / direction conflicts between rules

Deep Packet Inspection

L7 DPI findings: DGA domains, TLS anomalies, HTTP threats, protocol tunneling

Method	Path	Description
GET	/api/dpi/findings	List DPI findings — filterable by agent_id, finding_type, severity, alert_only, limit, offset
GET	/api/dpi/summary	24-hour finding counts broken down by type and severity

Users

User and role management

Method	Path	Description
GET	/api/users	List users in the tenant
POST	/api/users/invite	Invite a user (sends email with set-password link)
PUT	/api/users/{id}/role	Update a user's role
PATCH	/api/users/{id}/toggle	Enable or disable a user account

Platform

Platform-admin tenant provisioning

Method	Path	Description
GET	/api/platform/tenants	List all tenants (platform admin only)
POST	/api/platform/tenants	Create a tenant and invite its first admin via email
PATCH	/api/platform/tenants/{id}/toggle	Suspend or reactivate a tenant
GET	/api/platform/capabilities	Is this deployment the license authority? (drives which admin tabs the UI shows)
GET	/api/platform/saas/mode	Get current SaaS/self-hosted deployment mode
POST	/api/platform/saas/mode	Toggle SaaS mode on/off (authority instances only)
GET	/api/platform/saas/stats	Aggregate SaaS subscription stats across tenants
GET	/api/platform/saas/subscriptions	List all tenant subscriptions
PATCH	/api/platform/saas/subscriptions/{tenantID}	Update a tenant's plan/status/notes

Logs

Log search and retention

Method	Path	Description
GET	/api/logs/search	Full-text search across ingested logs
GET	/api/logs/stats	Log volume and severity distribution stats
GET	/api/logs/retention	Get current retention policy
PUT	/api/logs/retention	Set retention policy (admin only)

Dashboard

Dashboard overview metrics

Method	Path	Description
GET	/api/dashboard/overview	Dashboard overview metrics
GET	/api/health	Liveness check (no auth)
GET	/api/health/deep	Deep health check (DB, Kafka, circuit state) (no auth)