REST API reference
All endpoints are mounted under /api/v1/. This page is generated directly from the API route files, so it reflects the current code.
- Auth —
JWT cookiemeans the request needs the httpOnlytokencookie (set by login).Basic Authis used for inbound webhooks.Noneis public. - Permission — the granular permission enforced by
requirePermission(...), if any. See the permission matrix. - Mutating requests (POST/PUT/PATCH/DELETE) also require the
X-CSRF-Tokenheader matching thecsrf_tokencookie.
171 endpoints across 21 domains.
audit
Base path: /api/v1/audit
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/audit | JWT cookie | audit:read | tenant context, password changed |
GET | /api/v1/audit/:id | JWT cookie | audit:read | tenant context, password changed |
GET | /api/v1/audit/actions | JWT cookie | audit:read | tenant context, password changed |
auth
Base path: /api/v1/auth
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
POST | /api/v1/auth/access-denied | JWT cookie | — | — |
POST | /api/v1/auth/login | None | — | — |
POST | /api/v1/auth/logout | JWT cookie | — | — |
GET | /api/v1/auth/users | JWT cookie | users:create | tenant context, password changed |
POST | /api/v1/auth/users | JWT cookie | users:create | tenant context, password changed |
DELETE | /api/v1/auth/users/:id | JWT cookie | users:disable | tenant context, password changed |
PATCH | /api/v1/auth/users/:id | JWT cookie | users:create | tenant context, password changed |
PUT | /api/v1/auth/users/:id/disable | JWT cookie | users:disable | tenant context, password changed |
PUT | /api/v1/auth/users/:id/enable | JWT cookie | users:disable | tenant context, password changed |
POST | /api/v1/auth/users/:id/reassign | JWT cookie | users:disable | tenant context, password changed |
POST | /api/v1/auth/users/:id/reset-password | JWT cookie | users:reset_password | tenant context, password changed |
GET | /api/v1/auth/users/:userId/avatar | JWT cookie | — | password changed |
GET | /api/v1/auth/users/assignable | JWT cookie | cases:create | tenant context, password changed |
GET | /api/v1/auth/users/me | JWT cookie | — | password changed |
GET | /api/v1/auth/users/me/avatar | JWT cookie | — | password changed |
POST | /api/v1/auth/users/me/avatar | JWT cookie | — | password changed |
POST | /api/v1/auth/users/me/change-password | JWT cookie | — | — |
PATCH | /api/v1/auth/users/me/theme | JWT cookie | — | password changed |
backups
Base path: /api/v1/admin/backups
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/admin/backups | JWT cookie | backup:read | system-user only, password changed |
POST | /api/v1/admin/backups | JWT cookie | backup:create | system-user only, password changed |
DELETE | /api/v1/admin/backups/:id | JWT cookie | backup:delete | system-user only, password changed |
GET | /api/v1/admin/backups/:id | JWT cookie | backup:read | system-user only, password changed |
GET | /api/v1/admin/backups/:id/download | JWT cookie | backup:download | system-user only, password changed |
POST | /api/v1/admin/backups/:id/restore | JWT cookie | backup:restore | system-user only, password changed |
POST | /api/v1/admin/backups/:id/verify | JWT cookie | backup:read | system-user only, password changed |
GET | /api/v1/admin/backups/schedule | JWT cookie | backup:read | system-user only, password changed |
PUT | /api/v1/admin/backups/schedule | JWT cookie | backup:create | system-user only, password changed |
GET | /api/v1/admin/backups/status | JWT cookie | backup:read | system-user only, password changed |
cases
Base path: /api/v1/cases
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/cases | JWT cookie | cases:read | tenant context, password changed |
POST | /api/v1/cases | JWT cookie | cases:create | tenant context, password changed |
DELETE | /api/v1/cases/:id | JWT cookie | cases:delete | tenant context, password changed |
GET | /api/v1/cases/:id | JWT cookie | cases:read | tenant context, password changed |
PATCH | /api/v1/cases/:id | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/assign | JWT cookie | cases:assign | tenant context, password changed |
GET | /api/v1/cases/:id/attachments | JWT cookie | cases:read | tenant context, password changed |
POST | /api/v1/cases/:id/attachments | JWT cookie | cases:update | tenant context, password changed, file upload |
DELETE | /api/v1/cases/:id/attachments/:attachmentId | JWT cookie | cases:update | tenant context, password changed |
GET | /api/v1/cases/:id/attachments/:attachmentId/download | JWT cookie | cases:read | tenant context, password changed |
GET | /api/v1/cases/:id/attachments/:attachmentId/preview | JWT cookie | cases:read | tenant context, password changed |
POST | /api/v1/cases/:id/comments | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/events | JWT cookie | cases:link_event | tenant context, password changed |
GET | /api/v1/cases/:id/steps | JWT cookie | cases:read | tenant context, password changed |
POST | /api/v1/cases/:id/steps | JWT cookie | cases:update | tenant context, password changed |
DELETE | /api/v1/cases/:id/steps/:stepId | JWT cookie | cases:update | tenant context, password changed |
PATCH | /api/v1/cases/:id/steps/:stepId | JWT cookie | cases:update | tenant context, password changed |
PATCH | /api/v1/cases/:id/steps/:stepId/complete | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/tags | JWT cookie | cases:update | tenant context, password changed |
DELETE | /api/v1/cases/:id/tags/:tag | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/tasks | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/tasks/:taskId/complete | JWT cookie | cases:update | tenant context, password changed |
POST | /api/v1/cases/:id/transition | JWT cookie | — | tenant context, password changed |
GET | /api/v1/cases/tags/all | JWT cookie | cases:read | tenant context, password changed |
config
Base path: /api/v1/config
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/config | JWT cookie | config:read | tenant context, password changed |
PUT | /api/v1/config/:key | JWT cookie | config:modify | tenant context, password changed |
GET | /api/v1/config/password-policy | JWT cookie | — | — |
dashboard
Base path: /api/v1/dashboard
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/dashboard/alert-trend | JWT cookie | — | tenant context, password changed |
GET | /api/v1/dashboard/metrics | JWT cookie | — | tenant context, password changed |
GET | /api/v1/dashboard/recent-activity | JWT cookie | — | tenant context, password changed |
GET | /api/v1/dashboard/severity-distribution | JWT cookie | — | tenant context, password changed |
GET | /api/v1/dashboard/status-breakdown | JWT cookie | — | tenant context, password changed |
ingestion
Base path: /api/v1/logs (also mounted at /api/v1/ingestion)
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/logs/batches | JWT cookie | logs:search | tenant context, password changed |
POST | /api/v1/logs/submit | JWT cookie | logs:submit | tenant context, password changed |
POST | /api/v1/logs/upload | JWT cookie | logs:submit | tenant context, password changed |
integrations
Base path: /api/v1/integrations
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/integrations | JWT cookie | integration:read | tenant context, password changed |
PUT | /api/v1/integrations/:provider | JWT cookie | integration:modify | tenant context, password changed |
GET | /api/v1/integrations/enrich/:observableId | JWT cookie | observables:read | tenant context, password changed |
ldap
Base path: /api/v1/config/ldap
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/config/ldap | JWT cookie | ldap:manage | password changed |
PUT | /api/v1/config/ldap | JWT cookie | ldap:manage | password changed |
GET | /api/v1/config/ldap/presets/:type | JWT cookie | ldap:manage | password changed |
POST | /api/v1/config/ldap/sync | JWT cookie | ldap:manage | password changed |
GET | /api/v1/config/ldap/sync-status | JWT cookie | ldap:manage | password changed |
POST | /api/v1/config/ldap/test | JWT cookie | ldap:manage | password changed |
milestones
Base path: /api/v1/milestones
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/milestones/assignments | JWT cookie | milestones:manage | tenant context, password changed |
POST | /api/v1/milestones/assignments | JWT cookie | milestones:manage | tenant context, password changed |
DELETE | /api/v1/milestones/assignments/:id | JWT cookie | milestones:manage | tenant context, password changed |
PATCH | /api/v1/milestones/assignments/:id | JWT cookie | milestones:manage | tenant context, password changed |
POST | /api/v1/milestones/assignments/bulk | JWT cookie | milestones:manage | tenant context, password changed |
GET | /api/v1/milestones/definitions | JWT cookie | milestones:manage | tenant context, password changed |
POST | /api/v1/milestones/definitions | JWT cookie | milestones:manage | tenant context, password changed |
DELETE | /api/v1/milestones/definitions/:id | JWT cookie | milestones:manage | tenant context, password changed |
PATCH | /api/v1/milestones/definitions/:id | JWT cookie | milestones:manage | tenant context, password changed |
GET | /api/v1/milestones/me | JWT cookie | milestones:read | tenant context, password changed |
GET | /api/v1/milestones/users | JWT cookie | milestones:manage | tenant context, password changed |
notifications
Base path: /api/v1/notifications
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/notifications/channels | None | — | — |
POST | /api/v1/notifications/channels | None | — | — |
DELETE | /api/v1/notifications/channels/:id | None | — | — |
GET | /api/v1/notifications/channels/:id | None | — | — |
PUT | /api/v1/notifications/channels/:id | None | — | — |
POST | /api/v1/notifications/channels/:id/test | None | — | — |
GET | /api/v1/notifications/history | None | — | — |
GET | /api/v1/notifications/smtp | None | — | — |
PUT | /api/v1/notifications/smtp | None | — | — |
POST | /api/v1/notifications/smtp/test | None | — | — |
observables
Base path: /api/v1/observables
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/observables | JWT cookie | observables:read | tenant context, password changed |
GET | /api/v1/observables/:id | JWT cookie | observables:read | tenant context, password changed |
POST | /api/v1/observables/:id/comments | JWT cookie | observables:tag | tenant context, password changed |
POST | /api/v1/observables/:id/tags | JWT cookie | observables:tag | tenant context, password changed |
DELETE | /api/v1/observables/:id/tags/:tag | JWT cookie | observables:tag | tenant context, password changed |
playbooks
Base path: /api/v1/playbooks
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/playbooks | JWT cookie | playbooks:read | tenant context, password changed |
POST | /api/v1/playbooks | JWT cookie | playbooks:manage | tenant context, password changed |
DELETE | /api/v1/playbooks/:id | JWT cookie | playbooks:manage | tenant context, password changed |
GET | /api/v1/playbooks/:id | JWT cookie | playbooks:read | tenant context, password changed |
PATCH | /api/v1/playbooks/:id | JWT cookie | playbooks:manage | tenant context, password changed |
PUT | /api/v1/playbooks/:id/steps | JWT cookie | playbooks:manage | tenant context, password changed |
POST | /api/v1/playbooks/apply | JWT cookie | playbooks:apply | tenant context, password changed |
GET | /api/v1/playbooks/case/:caseId/active | JWT cookie | playbooks:read | tenant context, password changed |
GET | /api/v1/playbooks/case/:caseId/history | JWT cookie | playbooks:read | tenant context, password changed |
GET | /api/v1/playbooks/executions/:executionId | JWT cookie | playbooks:read | tenant context, password changed |
POST | /api/v1/playbooks/executions/:executionId/abandon | JWT cookie | playbooks:apply | tenant context, password changed |
DELETE | /api/v1/playbooks/executions/:executionId/steps/:stepId | JWT cookie | playbooks:apply | tenant context, password changed |
PATCH | /api/v1/playbooks/executions/:executionId/steps/:stepId | JWT cookie | playbooks:apply | tenant context, password changed |
POST | /api/v1/playbooks/executions/:executionId/steps/:stepId/complete | JWT cookie | playbooks:apply | tenant context, password changed |
POST | /api/v1/playbooks/executions/:executionId/steps/:stepId/decide | JWT cookie | playbooks:apply | tenant context, password changed |
POST | /api/v1/playbooks/executions/:executionId/steps/:stepId/undo | JWT cookie | playbooks:apply | tenant context, password changed |
reports
Base path: /api/v1
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/config/branding | JWT cookie | — | password changed |
PUT | /api/v1/config/branding | JWT cookie | config:modify | password changed |
GET | /api/v1/config/branding/logo | JWT cookie | — | password changed |
GET | /api/v1/reports | JWT cookie | reports:read | tenant context, password changed |
DELETE | /api/v1/reports/:reportId | JWT cookie | reports:delete | tenant context, password changed |
GET | /api/v1/reports/:reportId/download | JWT cookie | reports:read | tenant context, password changed |
POST | /api/v1/reports/generate | JWT cookie | reports:generate | tenant context, password changed |
roles
Base path: /api/v1/roles
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/roles | JWT cookie | roles:manage | tenant context, password changed |
POST | /api/v1/roles | JWT cookie | roles:manage | tenant context, password changed |
DELETE | /api/v1/roles/:id | JWT cookie | roles:manage | tenant context, password changed |
GET | /api/v1/roles/:id | JWT cookie | roles:manage | tenant context, password changed |
PUT | /api/v1/roles/:id | JWT cookie | roles:manage | tenant context, password changed |
GET | /api/v1/roles/permissions | JWT cookie | roles:manage | tenant context, password changed |
GET | /api/v1/roles/presets | JWT cookie | roles:manage | tenant context, password changed |
schemas
Base path: /api/v1/schemas
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/schemas | JWT cookie | schemas:read | tenant context, password changed |
POST | /api/v1/schemas | JWT cookie | schemas:create | tenant context, password changed |
DELETE | /api/v1/schemas/:id | JWT cookie | schemas:create | tenant context, password changed |
GET | /api/v1/schemas/:id | JWT cookie | schemas:read | tenant context, password changed |
PATCH | /api/v1/schemas/:id | JWT cookie | schemas:edit_draft | tenant context, password changed |
PUT | /api/v1/schemas/:id/deprecate | JWT cookie | schemas:deprecate | tenant context, password changed |
GET | /api/v1/schemas/:id/detail | JWT cookie | schemas:read | tenant context, password changed |
POST | /api/v1/schemas/:id/versions | JWT cookie | schemas:edit_draft | tenant context, password changed |
POST | /api/v1/schemas/:schemaId/versions/:versionId/publish | JWT cookie | schemas:publish | tenant context, password changed |
search
Base path: /api/v1/search
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/search | JWT cookie | logs:search | tenant context, password changed |
sse
Base path: /api/v1/sse
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/sse/cases/:caseId/presence | JWT cookie | — | tenant context, password changed |
GET | /api/v1/sse/cases/:caseId/stream | JWT cookie | — | tenant context, password changed |
system-dashboard
Base path: /api/v1/system/dashboard
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/system/dashboard/tenant-summaries | JWT cookie | — | system-user only, password changed |
tenants
Base path: /api/v1/tenants
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/tenants | JWT cookie | — | system-user only, password changed |
POST | /api/v1/tenants | JWT cookie | users:create | system-user only, password changed |
DELETE | /api/v1/tenants/:id | JWT cookie | users:create | system-user only, password changed |
GET | /api/v1/tenants/:id | JWT cookie | — | system-user only, password changed |
PUT | /api/v1/tenants/:id | JWT cookie | users:create | system-user only, password changed |
POST | /api/v1/tenants/:id/activate | JWT cookie | users:create | system-user only, password changed |
POST | /api/v1/tenants/:id/admin | JWT cookie | users:create | system-user only, password changed |
webhooks
Base path: /api/v1/webhooks
| Method | Path | Auth | Permission | Notes |
|---|---|---|---|---|
GET | /api/v1/webhooks/alerts | None | — | — |
GET | /api/v1/webhooks/alerts/:alertId | None | — | — |
POST | /api/v1/webhooks/alerts/:alertId/acknowledge | None | — | — |
POST | /api/v1/webhooks/alerts/:alertId/dismiss | None | — | — |
POST | /api/v1/webhooks/alerts/:alertId/link | None | — | — |
POST | /api/v1/webhooks/alerts/:alertId/unlink | None | — | — |
POST | /api/v1/webhooks/alerts/batch | None | — | — |
POST | /api/v1/webhooks/alerts/bulk/acknowledge | None | — | — |
POST | /api/v1/webhooks/alerts/bulk/dismiss | None | — | — |
POST | /api/v1/webhooks/alerts/bulk/link | None | — | — |
POST | /api/v1/webhooks/alerts/bulk/unlink | None | — | — |
GET | /api/v1/webhooks/alerts/by-case/:caseId | None | — | — |
GET | /api/v1/webhooks/alerts/sources | None | — | — |
GET | /api/v1/webhooks/alerts/stats | None | — | — |
POST | /api/v1/webhooks/receive/:tenantSlug | Basic Auth | — | — |
GET | /api/v1/webhooks/sources | None | — | — |
POST | /api/v1/webhooks/sources | None | — | — |
DELETE | /api/v1/webhooks/sources/:sourceId | None | — | — |
GET | /api/v1/webhooks/sources/:sourceId | None | — | — |
PUT | /api/v1/webhooks/sources/:sourceId | None | — | — |
Was this page helpful?