Reference overview

This section is the lookup-oriented part of the docs. The detailed pages are auto-generated from the product source so they stay accurate:

• REST API reference — every endpoint, its authentication, and required permission (generated from the route files).
• Configuration reference — environment variables and Docker secrets (generated from config.ts).
• RBAC permission matrix — the permission catalog and which built-in role holds each (catalog from source, role columns from the live database).

Regenerating

These pages are produced by npm run gen:reference in the docs repo, which reads the Ticketra api/ source. Re-run it whenever the API, config, or roles change. The quick facts below are a hand-maintained cheat sheet.

Roles

Role	Description
SUPER_ADMIN	Full access; sole user manager; no self-registration.
ADMIN	Operational admin: cases, schemas, config, integrations, milestones.
USER	Investigation workflows: cases, observables, ingestion.

Custom roles with granular permissions are also supported.

Observable types

IP · USERNAME · HOSTNAME · HASH_MD5 · HASH_SHA1 · HASH_SHA256 · DOMAIN · URL · EMAIL · FILE_PATH · MAC_ADDRESS · PORT

Enrichable types (sent to CTI providers): IP, DOMAIN, HASH_MD5, HASH_SHA1, HASH_SHA256.

Source types

WINDOWS · LINUX · NETWORK

Case status machine

States: OPEN → IN_PROGRESS → RESOLVED → CLOSED, with a REOPENED path back.

Transitions: open, start, resolve, close, reopen.

CTI providers

VirusTotal · AbuseIPDB · MISP · Shodan · GreyNoise · OTX AlienVault

API basics

• Base path: /api/v1/
• Auth: login at POST /api/v1/auth/login returns httpOnly token and csrf_token cookies.
• CSRF: mutating requests (POST/PUT/PATCH/DELETE) must send X-CSRF-Token matching the csrf_token cookie.
• Tenant context: system users send X-Tenant-Id (REST) or ?tenantId= (SSE).
• Health: GET /api/v1/health.

Key configuration

Variable / secret	Purpose	Notes
JWT_SECRET (secret)	Signs session tokens	≥ 32 chars, required
admin_password (secret)	Initial SUPER_ADMIN password	≥ 12 chars
db_password (secret)	PostgreSQL password	required
integration_encryption_key (secret)	Encrypts CTI keys at rest	required
DATABASE_URL	PostgreSQL connection	required
OPENSEARCH_URL	OpenSearch connection	required
ALLOWED_ORIGINS	CORS allowlist	comma-separated
SESSION_TTL_HOURS	Session lifetime	default 8
PORT	API port	default 8080