API Reference

This page is generated from openapi/pavri.v1.yaml. Do not edit the generated content by hand; update the OpenAPI source instead.

Auth

Authentication, SSO, password reset, and session state

`POST /api/auth/login`

Operation ID: login
Tags: auth

Request Body

Content type: application/json
Schema: LoginRequest

Responses

Status	Description	Schema
`200`	Session established successfully	AuthSuccessResponse
`400`	Validation error	AuthErrorResponse
`401`	Invalid credentials	AuthErrorResponse

`POST /api/auth/register`

Create a workspace and first user

Operation ID: registerWorkspace
Tags: auth

Request Body

Content type: application/json
Schema: RegisterRequest

Responses

Status	Description	Schema
`200`	Workspace created and authenticated	AuthSuccessResponse
`400`	Validation error	AuthErrorResponse
`409`	Username already exists	AuthErrorResponse

`GET /api/auth/session`

Resolve the current dashboard session

Operation ID: getCurrentSession
Tags: auth

Responses

Status	Description	Schema
`200`	Authenticated session identity	AuthSessionEnvelope
`401`	No authenticated session	ErrorResponse

`GET /api/auth/logout`

Clear the current dashboard session

Operation ID: logout
Tags: auth

Responses

Status	Description	Schema
`307`	Redirects to `/login` with a signed-out status	Not documented

`POST /api/auth/setup`

Complete onboarding by creating an organization

Operation ID: setupOrganization
Tags: auth

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`201`	Organization created	OkResponse
`400`	Already onboarded or invalid session	ErrorResponse
`401`	No authenticated session	ErrorResponse

`POST /api/auth/forgot-password`

Request a password reset email

Operation ID: forgotPassword
Tags: auth

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Reset email sent (always succeeds to avoid leaking registered emails)	object

`POST /api/auth/reset-password`

Reset password using a token

Operation ID: resetPassword
Tags: auth

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Password reset successfully	object
`400`	Invalid or expired token	ErrorResponse

`POST /api/auth/accept-invite`

Accept a team invitation

Operation ID: acceptInvite
Tags: auth

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Invitation accepted	object
`400`	Invalid or expired token	ErrorResponse

`GET /api/auth/workos/authorize`

Redirect to WorkOS-hosted SSO login page

Operation ID: workosAuthorize
Tags: auth

Parameters

Name	In	Required	Schema	Description
`redirect_uri`	query	no	string
`state`	query	no	string

Responses

Status	Description	Schema
`302`	Redirect to WorkOS login	Not documented
`400`	WorkOS not configured	ErrorResponse

`GET /api/auth/workos/callback`

Handle WorkOS OAuth callback

Operation ID: workosCallback
Tags: auth

Parameters

Name	In	Required	Schema	Description
`code`	query	yes	string

Responses

Status	Description	Schema
`302`	Redirect to `/overview` or `/setup` with session cookie set	Not documented
`302`	Redirect to `/login?state=error` on failure	Not documented

Agents

Agent inventory and agent-level evidence drill-down

`GET /api/agents`

List agents for the current tenant

Operation ID: listAgents
Tags: agents

Parameters

Name	In	Required	Schema	Description
`q`	query	no	string	Free-text search across inventory fields
`status`	query	no	string	Filter by agent status

Responses

Status	Description	Schema
`200`	Agent inventory rows	AgentListResponse
`401`	No authenticated session	ErrorResponse

`GET /api/agents/{agentId}`

Fetch a single agent detail record

Operation ID: getAgent
Tags: agents

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Full agent detail	AgentResponse
`401`	No authenticated session	ErrorResponse
`404`	Agent not found	ErrorResponse

`GET /api/agents/{agentId}/sessions`

List sessions for a single agent

Operation ID: listAgentSessions
Tags: agents, sessions

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Agent session summaries	SessionListResponse
`401`	No authenticated session	ErrorResponse

Sessions

Session evidence drill-down

`GET /api/agents/{agentId}/sessions`

List sessions for a single agent

Operation ID: listAgentSessions
Tags: agents, sessions

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Agent session summaries	SessionListResponse
`401`	No authenticated session	ErrorResponse

`GET /api/sessions/{sessionId}`

Fetch full session evidence detail

Operation ID: getSession
Tags: sessions

Parameters

Name	In	Required	Schema	Description
`sessionId`	path	yes	string

Responses

Status	Description	Schema
`200`	Session detail with ordered timeline evidence	SessionResponse
`401`	No authenticated session	ErrorResponse
`404`	Session not found	ErrorResponse

Policies

Policy library, CRUD, DSL compilation, and templates

`GET /api/policies`

List policies for the current tenant

Operation ID: listPolicies
Tags: policies

Parameters

Name	In	Required	Schema	Description
`q`	query	no	string
`mode`	query	no	string

Responses

Status	Description	Schema
`200`	Policy library rows	PolicyListResponse
`401`	No authenticated session	ErrorResponse

`POST /api/policies`

Create a new policy

Operation ID: createPolicy
Tags: policies

Request Body

Content type: application/json
Schema: CreatePolicyRequest

Responses

Status	Description	Schema
`201`	Policy created	PolicyResponse
`400`	Validation error	ErrorResponse
`401`	No authenticated session	ErrorResponse

`GET /api/policies/{policyId}`

Fetch a single policy detail record

Operation ID: getPolicy
Tags: policies

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Responses

Status	Description	Schema
`200`	Policy detail	PolicyResponse
`401`	No authenticated session	ErrorResponse
`404`	Policy not found	ErrorResponse

`POST /api/policies/{policyId}/assign`

Assign a policy to an agent

Operation ID: assignPolicy
Tags: policies

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Policy assigned	OkResponse
`404`	Policy or agent not found	ErrorResponse

`POST /api/policies/{policyId}/unassign`

Unassign a policy from an agent

Operation ID: unassignPolicy
Tags: policies

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Policy unassigned	OkResponse
`404`	Assignment not found	ErrorResponse

`POST /api/policies/{policyId}/toggle`

Toggle a policy enabled/disabled

Operation ID: togglePolicy
Tags: policies

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Responses

Status	Description	Schema
`200`	Policy toggled	PolicyResponse
`404`	Policy not found	ErrorResponse

`GET /api/policies/templates`

List available policy templates

Operation ID: listPolicyTemplates
Tags: policies

Responses

Status	Description	Schema
`200`	Policy templates	object

`POST /api/policies/dsl/validate`

Validate a policy DSL YAML document

Operation ID: validatePolicyDsl
Tags: policies

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Validation result	PolicyDslValidationResponse

`POST /api/policies/dsl/compile`

Compile a policy DSL YAML document into a runtime snapshot

Operation ID: compilePolicyDsl
Tags: policies

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Compilation result with optional snapshot	PolicyDslCompileResponse

Governance

Attestation claims, execution decisions, and rollout stages

`GET /api/governance/attestation`

List attestation claims

Operation ID: listAttestations
Tags: governance

Parameters

Name	In	Required	Schema
`agentId`	query	no	string
`status`	query	no	string
`q`	query	no	string

Responses

Status	Description	Schema
`200`	Attestation claims	object
`401`	No authenticated session	ErrorResponse

`GET /api/governance/execution`

List policy execution decisions

Operation ID: listExecutionDecisions
Tags: governance

Parameters

Name	In	Required	Schema
`agentId`	query	no	string
`sessionId`	query	no	string
`outcome`	query	no	string
`routingMode`	query	no	string
`q`	query	no	string

Responses

Status	Description	Schema
`200`	Execution decisions	object
`401`	No authenticated session	ErrorResponse

`GET /api/governance/rollout`

List policy rollout stages

Operation ID: listRollouts
Tags: governance

Parameters

Name	In	Required	Schema	Description
`stage`	query	no	string

Responses

Status	Description	Schema
`200`	Rollout stages	object
`401`	No authenticated session	ErrorResponse

`POST /api/governance/rollout`

Queue a rollout transition

Operation ID: queueRolloutTransition
Tags: governance

Responses

Status	Description	Schema
`200`	Transition queued	object

`GET /api/governance/rollout/{policyId}`

Get rollout detail for a specific policy

Operation ID: getRolloutDetail
Tags: governance

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Responses

Status	Description	Schema
`200`	Rollout detail with replays	object
`401`	No authenticated session	ErrorResponse

`POST /api/governance/rollout/{policyId}`

Queue a rollout action for a specific policy

Operation ID: queueRolloutAction
Tags: governance

Parameters

Name	In	Required	Schema	Description
`policyId`	path	yes	string

Responses

Status	Description	Schema
`200`	Action queued	object

Discovery

Discovered asset inventory, review, and saved views

`GET /api/discovery`

List discovered assets

Operation ID: listDiscoveredAssets
Tags: discovery

Parameters

Name	In	Required	Schema	Description
`source`	query	no	string	Filter by discovery platform
`reviewState`	query	no	string	Filter by review status
`lifecycleState`	query	no	string
`minConfidence`	query	no	number
`q`	query	no	string

Responses

Status	Description	Schema
`200`	Discovered assets	object
`401`	No authenticated session	ErrorResponse

`GET /api/discovery/{assetId}`

Get a single discovered asset

Operation ID: getDiscoveredAsset
Tags: discovery

Parameters

Name	In	Required	Schema	Description
`assetId`	path	yes	string

Responses

Status	Description	Schema
`200`	Asset detail	object
`404`	Asset not found	ErrorResponse

`GET /api/discovery/{assetId}/diff`

Get diff for a discovered asset

Operation ID: getDiscoveredAssetDiff
Tags: discovery

Parameters

Name	In	Required	Schema	Description
`assetId`	path	yes	string

Responses

Status	Description	Schema
`200`	Asset diff	object
`404`	Asset not found	ErrorResponse

`GET /api/discovery/{assetId}/history`

Get posture history for a discovered asset

Operation ID: getDiscoveredAssetHistory
Tags: discovery

Parameters

Name	In	Required	Schema	Description
`assetId`	path	yes	string

Responses

Status	Description	Schema
`200`	Asset posture history	object
`404`	Asset not found	ErrorResponse

`POST /api/discovery/review`

Submit a review decision for a discovered asset

Operation ID: reviewDiscoveredAsset
Tags: discovery

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Review recorded	object
`404`	Asset not found	ErrorResponse

`GET /api/discovery/saved-views`

List saved discovery views

Operation ID: listSavedViews
Tags: discovery

Responses

Status	Description	Schema
`200`	Saved views	object

`POST /api/discovery/saved-views`

Create a saved discovery view

Operation ID: createSavedView
Tags: discovery

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`201`	View created	object

Mcp

MCP server inventory, baseline management, and review

`GET /api/mcp`

List MCP servers

Operation ID: listMcpServers
Tags: mcp

Parameters

Name	In	Required	Schema
`source`	query	no	string
`reviewState`	query	no	string
`q`	query	no	string

Responses

Status	Description	Schema
`200`	MCP servers	object
`401`	No authenticated session	ErrorResponse

`GET /api/mcp/{serverId}`

Get a single MCP server with assets

Operation ID: getMcpServer
Tags: mcp

Parameters

Name	In	Required	Schema	Description
`serverId`	path	yes	string

Responses

Status	Description	Schema
`200`	Server detail with assets	object
`404`	Server not found	ErrorResponse

`GET /api/mcp/{serverId}/findings`

List findings for an MCP server

Operation ID: getMcpServerFindings
Tags: mcp

Parameters

Name	In	Required	Schema	Description
`serverId`	path	yes	string

Responses

Status	Description	Schema
`200`	Server findings	object
`404`	Server not found	ErrorResponse

`GET /api/mcp/baseline`

Get the current MCP baseline

Operation ID: getMcpBaseline
Tags: mcp

Responses

Status	Description	Schema
`200`	Current baseline	object

`POST /api/mcp/baseline`

Approve the current MCP baseline

Operation ID: approveMcpBaseline
Tags: mcp

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Baseline approved	object

`GET /api/mcp/baseline/diff`

Get the diff between current and approved baseline

Operation ID: getMcpBaselineDiff
Tags: mcp

Responses

Status	Description	Schema
`200`	Baseline diff	object

`GET /api/mcp/reports`

List MCP scan reports

Operation ID: listMcpReports
Tags: mcp

Responses

Status	Description	Schema
`200`	Scan reports	object

`POST /api/mcp/review`

Submit a review decision for an MCP server

Operation ID: reviewMcpServer
Tags: mcp

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Review recorded	object
`404`	Server not found	ErrorResponse

Detection

Detection tier configuration, model inventory, and statistics

`GET /api/detection/config`

Get detection tier configuration

Operation ID: getDetectionConfig
Tags: detection

Responses

Status	Description	Schema
`200`	Detection config	object
`401`	No authenticated session	ErrorResponse

`PUT /api/detection/config`

Update detection tier configuration

Operation ID: updateDetectionConfig
Tags: detection

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Config updated	object
`401`	No authenticated session	ErrorResponse

`GET /api/detection/models`

List detection models

Operation ID: listDetectionModels
Tags: detection

Responses

Status	Description	Schema
`200`	Model inventory	object
`401`	No authenticated session	ErrorResponse

`GET /api/detection/stats`

Get detection cascade statistics

Operation ID: getDetectionStats
Tags: detection

Responses

Status	Description	Schema
`200`	Detection statistics	object
`401`	No authenticated session	ErrorResponse

Overview

Operator-facing dashboard health and dependency summaries

`GET /api/overview`

Fetch operator-facing query and dependency health panels

Operation ID: getOperationalOverview
Tags: overview

Responses

Status	Description	Schema
`200`	Query and dependency health overview	OperationalOverviewResponse
`401`	No authenticated session	ErrorResponse

Search

Global object-jump search resources

`GET /api/search/resources`

List global object-jump resources

Operation ID: searchResources
Tags: search

Parameters

Name	In	Required	Schema	Description
`q`	query	no	string

Responses

Status	Description	Schema
`200`	Searchable agent, session, and policy resources	SearchResourceResponse
`401`	No authenticated session	ErrorResponse

Alerts

Threat alert records and alert history

`GET /api/alerts`

List alerts for the current tenant

Operation ID: listAlerts
Tags: alerts

Parameters

Name	In	Required	Schema	Description
`severity`	query	no	string	Filter by alert severity
`threat_type`	query	no	string	Filter by threat type
`status`	query	no	string	Filter by delivery status
`page_size`	query	no	integer
`page_token`	query	no	string

Responses

Status	Description	Schema
`200`	Paginated alert records	AlertListResponse
`401`	No authenticated session	ErrorResponse

`GET /api/alerts/{alertId}`

Fetch a single alert record with full verdict and delivery details

Operation ID: getAlert
Tags: alerts

Parameters

Name	In	Required	Schema	Description
`alertId`	path	yes	string

Responses

Status	Description	Schema
`200`	Full alert detail	AlertResponse
`401`	No authenticated session	ErrorResponse
`404`	Alert not found	ErrorResponse

Alert Rules

Alert rule configuration for notification routing

`GET /api/alerts/rules`

List alert rules for the current tenant

Operation ID: listAlertRules
Tags: alert-rules

Responses

Status	Description	Schema
`200`	Alert rules	AlertRuleListResponse
`401`	No authenticated session	ErrorResponse

`POST /api/alerts/rules`

Create a new alert rule

Operation ID: createAlertRule
Tags: alert-rules

Request Body

Content type: application/json
Schema: CreateAlertRuleRequest

Responses

Status	Description	Schema
`200`	Alert rule created	AlertRuleResponse
`400`	Validation error	ErrorResponse
`401`	No authenticated session	ErrorResponse

`PUT /api/alerts/rules/{ruleId}`

Update an alert rule

Operation ID: updateAlertRule
Tags: alert-rules

Parameters

Name	In	Required	Schema	Description
`ruleId`	path	yes	string

Request Body

Content type: application/json
Schema: UpdateAlertRuleRequest

Responses

Status	Description	Schema
`200`	Alert rule updated	AlertRuleResponse
`400`	Validation error	ErrorResponse
`401`	No authenticated session	ErrorResponse
`404`	Alert rule not found	ErrorResponse

`DELETE /api/alerts/rules/{ruleId}`

Delete an alert rule

Operation ID: deleteAlertRule
Tags: alert-rules

Parameters

Name	In	Required	Schema	Description
`ruleId`	path	yes	string

Responses

Status	Description	Schema
`200`	Alert rule deleted	AlertRuleDeleteResponse
`401`	No authenticated session	ErrorResponse
`404`	Alert rule not found	ErrorResponse

Incidents

`GET /api/incidents`

List incident war rooms for the current tenant

Operation ID: listIncidents
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`status`	query	no	string
`severity`	query	no	string

Responses

Status	Description	Schema
`200`	Incident records	IncidentListResponse
`401`	No authenticated session	ErrorResponse

`POST /api/incidents`

Create an incident from alert, session, or operator context

Operation ID: createIncident
Tags: incidents

Request Body

Content type: application/json
Schema: CreateIncidentRequest

Responses

Status	Description	Schema
`201`	Incident created	IncidentResponse
`400`	Validation error	ErrorResponse

`GET /api/incidents/{incidentId}`

Fetch a single incident war room

Operation ID: getIncident
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Incident detail	IncidentResponse
`404`	Incident not found	ErrorResponse

`PUT /api/incidents/{incidentId}`

Update incident state or evidence links

Operation ID: updateIncident
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Request Body

Content type: application/json
Schema: UpdateIncidentRequest

Responses

Status	Description	Schema
`200`	Incident updated	IncidentResponse

`POST /api/incidents/{incidentId}/notes`

Append an operator note to an incident timeline

Operation ID: addIncidentNote
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`201`	Note appended	IncidentResponse

`GET /api/incidents/{incidentId}/review`

Fetch the generated post-incident review

Operation ID: getIncidentReview
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Review if available	IncidentReviewResponse

`POST /api/incidents/{incidentId}/review`

Generate a post-incident review after resolution

Operation ID: generateIncidentReview
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Responses

Status	Description	Schema
`201`	Review generated	IncidentReviewResponse

`POST /api/incidents/{incidentId}/communications/draft`

Draft a Slack or email incident communication

Operation ID: draftIncidentCommunication
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Communication draft	IncidentCommunicationResponse

`POST /api/incidents/{incidentId}/communications/send`

Send an incident communication through configured integrations

Operation ID: sendIncidentCommunication
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Delivery attempt recorded	IncidentCommunicationResponse

`POST /api/incidents/{incidentId}/contain`

Execute admin-only bulk containment for incident-scoped agents

Operation ID: containIncident
Tags: incidents

Parameters

Name	In	Required	Schema	Description
`incidentId`	path	yes	string

Request Body

Content type: application/json
Schema: IncidentContainmentRequest

Responses

Status	Description	Schema
`200`	Containment queued and audited	IncidentContainmentResponse
`403`	Admin role required for destructive containment	ErrorResponse

Lifecycle

`GET /api/lifecycle/overview`

Get lifecycle funnel, promotion queue, degraded agents, and stale candidates

Operation ID: getLifecycleOverview
Tags: lifecycle

Responses

Status	Description	Schema
`200`	Lifecycle overview	LifecycleOverviewResponse

`GET /api/lifecycle/config`

Get tenant lifecycle gate configuration

Operation ID: getLifecycleGateConfig
Tags: lifecycle

Responses

Status	Description	Schema
`200`	Lifecycle gate configuration	LifecycleGateConfigResponse

`PUT /api/lifecycle/config`

Update tenant lifecycle gate configuration

Operation ID: updateLifecycleGateConfig
Tags: lifecycle

Request Body

Content type: application/json
Schema: LifecycleGateConfig

Responses

Status	Description	Schema
`200`	Lifecycle gate configuration updated	LifecycleGateConfigResponse

`GET /api/lifecycle/agents/{agentId}/checklist`

Get an agent lifecycle promotion checklist

Operation ID: getLifecycleChecklist
Tags: lifecycle

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Responses

Status	Description	Schema
`200`	Checklist state	LifecycleChecklistResponse

`PUT /api/lifecycle/agents/{agentId}/checklist`

Update an agent lifecycle promotion checklist

Operation ID: updateLifecycleChecklist
Tags: lifecycle

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Request Body

Content type: application/json
Schema: LifecycleChecklist

Responses

Status	Description	Schema
`200`	Checklist updated	LifecycleChecklistResponse

`POST /api/lifecycle/agents/{agentId}/transition`

Manually transition an agent lifecycle state

Operation ID: transitionAgentLifecycle
Tags: lifecycle

Parameters

Name	In	Required	Schema	Description
`agentId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Transition recorded	LifecycleTransitionResponse

Reports

Compliance and audit report generation and export

`GET /api/reports`

List reports

Operation ID: listReports
Tags: reports

Responses

Status	Description	Schema
`200`	Report list	object
`401`	No authenticated session	ErrorResponse

`POST /api/reports`

Generate a new report

Operation ID: createReport
Tags: reports

Request Body

Content type: application/json
Schema: CreateReportRequest

Responses

Status	Description	Schema
`201`	Report created	object
`401`	No authenticated session	ErrorResponse

`GET /api/reports/{reportId}`

Get a single report

Operation ID: getReport
Tags: reports

Parameters

Name	In	Required	Schema	Description
`reportId`	path	yes	string

Responses

Status	Description	Schema
`200`	Report detail	object
`404`	Report not found	ErrorResponse

`GET /api/reports/{reportId}/export`

Export a report as CSV or JSON

Operation ID: exportReport
Tags: reports

Parameters

Name	In	Required	Schema	Description
`reportId`	path	yes	string
`format`	query	no	string	Export format

Responses

Status	Description	Schema
`200`	File download	object
`400`	Unsupported format	ErrorResponse
`404`	Report not found	ErrorResponse

Admin

API key management, team members, invitations, audit log, and tenant settings

`GET /api/admin/api-keys`

List API keys for the current tenant

Operation ID: listApiKeys
Tags: admin

Responses

Status	Description	Schema
`200`	API keys	object
`401`	No authenticated session	ErrorResponse

`POST /api/admin/api-keys`

Create a new API key

Operation ID: createApiKey
Tags: admin

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`201`	API key created (full key returned once)	object
`401`	No authenticated session	ErrorResponse

`DELETE /api/admin/api-keys/{keyId}`

Revoke an API key

Operation ID: deleteApiKey
Tags: admin

Parameters

Name	In	Required	Schema	Description
`keyId`	path	yes	string

Responses

Status	Description	Schema
`200`	Key revoked	object
`404`	Key not found	ErrorResponse

`POST /api/admin/api-keys/{keyId}/rotate`

Rotate an API key

Operation ID: rotateApiKey
Tags: admin

Parameters

Name	In	Required	Schema	Description
`keyId`	path	yes	string

Responses

Status	Description	Schema
`201`	New key generated (full key returned once)	object
`404`	Key not found	ErrorResponse

`GET /api/admin/audit-log`

Query the audit log

Operation ID: getAuditLog
Tags: admin

Parameters

Name	In	Required	Schema	Description
`category`	query	no	string
`limit`	query	no	integer
`offset`	query	no	integer
`format`	query	no	string	Output format

Responses

Status	Description	Schema
`200`	Audit log entries (JSON or CSV depending on format param)	object
`401`	No authenticated session	ErrorResponse

`GET /api/admin/invite`

List pending invitations

Operation ID: listInvitations
Tags: admin

Responses

Status	Description	Schema
`200`	Invitations	object
`401`	No authenticated session	ErrorResponse

`POST /api/admin/invite`

Send a team invitation

Operation ID: sendInvitation
Tags: admin

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Invitation sent	object
`401`	No authenticated session	ErrorResponse

`DELETE /api/admin/invite`

Revoke a pending invitation

Operation ID: revokeInvitation
Tags: admin

Parameters

Name	In	Required	Schema	Description
`id`	query	yes	string

Responses

Status	Description	Schema
`200`	Invitation revoked	object
`404`	Invitation not found	ErrorResponse

`GET /api/admin/members`

List team members

Operation ID: listMembers
Tags: admin

Responses

Status	Description	Schema
`200`	Members and invitations	object
`401`	No authenticated session	ErrorResponse

`DELETE /api/admin/members/{userId}`

Remove a team member

Operation ID: deleteMember
Tags: admin

Parameters

Name	In	Required	Schema	Description
`userId`	path	yes	string

Responses

Status	Description	Schema
`200`	Member removed	object
`404`	Member not found	ErrorResponse

`PUT /api/admin/members/{userId}/role`

Update a member's role

Operation ID: updateMemberRole
Tags: admin

Parameters

Name	In	Required	Schema	Description
`userId`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Role updated	object
`404`	Member not found	ErrorResponse

`GET /api/admin/tenant`

Get tenant profile

Operation ID: getTenantProfile
Tags: admin

Responses

Status	Description	Schema
`200`	Tenant profile	object
`401`	No authenticated session	ErrorResponse

`PUT /api/admin/tenant`

Update tenant profile

Operation ID: updateTenantProfile
Tags: admin

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Profile updated	object
`401`	No authenticated session	ErrorResponse

`POST /api/admin/tenant/delete`

Request tenant deletion (async, 72h completion)

Operation ID: deleteTenant
Tags: admin

Responses

Status	Description	Schema
`202`	Deletion queued	object
`401`	No authenticated session	ErrorResponse

Integrations

External service connections for cloud providers, MCP catalogs, and LLM providers

`GET /api/admin/integrations`

List all integrations for the current tenant

Operation ID: listIntegrations
Tags: integrations

Responses

Status	Description	Schema
`200`	Integration list	object
`401`	No authenticated session	ErrorResponse

`POST /api/admin/integrations`

Create a new integration

Operation ID: createIntegration
Tags: integrations

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`201`	Integration created	object
`400`	Missing required fields	ErrorResponse
`401`	No authenticated session	ErrorResponse
`503`	Store service unavailable	ErrorResponse

`PUT /api/admin/integrations/{id}`

Update an integration

Operation ID: updateIntegration
Tags: integrations

Parameters

Name	In	Required	Schema	Description
`id`	path	yes	string

Request Body

Content type: application/json
Schema: object

Responses

Status	Description	Schema
`200`	Integration updated	object
`404`	Integration not found	ErrorResponse

`DELETE /api/admin/integrations/{id}`

Delete an integration

Operation ID: deleteIntegration
Tags: integrations

Parameters

Name	In	Required	Schema	Description
`id`	path	yes	string

Responses

Status	Description	Schema
`200`	Integration deleted	object
`404`	Integration not found	ErrorResponse

`POST /api/admin/integrations/{id}/test`

Test an integration connection

Operation ID: testIntegration
Tags: integrations

Parameters

Name	In	Required	Schema	Description
`id`	path	yes	string

Responses

Status	Description	Schema
`200`	Test result	object

`POST /api/admin/integrations/{id}/scan`

Trigger an immediate scan

Operation ID: scanIntegration
Tags: integrations

Parameters

Name	In	Required	Schema	Description
`id`	path	yes	string

Responses

Status	Description	Schema
`200`	Scan result	object

Store

Runtime log and trace link queries

`GET /api/store/runtime-logs`

Query runtime logs for a session

Operation ID: getRuntimeLogs
Tags: store

Parameters

Name	In	Required	Schema
`session_id`	query	yes	string
`severity`	query	no	string
`limit`	query	no	integer

Responses

Status	Description	Schema
`200`	Runtime logs	object
`401`	No authenticated session	ErrorResponse

`GET /api/store/trace-links`

Query trace links for a session

Operation ID: getTraceLinks
Tags: store

Parameters

Name	In	Required	Schema	Description
`session_id`	query	yes	string

Responses

Status	Description	Schema
`200`	Trace links	object
`401`	No authenticated session	ErrorResponse

Auth
POST /api/auth/login
- Request Body
- Responses
POST /api/auth/register
- Request Body
- Responses
GET /api/auth/session
- Responses
GET /api/auth/logout
- Responses
POST /api/auth/setup
- Request Body
- Responses
POST /api/auth/forgot-password
- Request Body
- Responses
POST /api/auth/reset-password
- Request Body
- Responses
POST /api/auth/accept-invite
- Request Body
- Responses
GET /api/auth/workos/authorize
- Parameters
- Responses
GET /api/auth/workos/callback
- Parameters
- Responses
Agents
GET /api/agents
- Parameters
- Responses
GET /api/agents/{agentId}
- Parameters
- Responses
GET /api/agents/{agentId}/sessions
- Parameters
- Responses
Sessions
GET /api/agents/{agentId}/sessions
- Parameters
- Responses
GET /api/sessions/{sessionId}
- Parameters
- Responses
Policies
GET /api/policies
- Parameters
- Responses
POST /api/policies
- Request Body
- Responses
GET /api/policies/{policyId}
- Parameters
- Responses
POST /api/policies/{policyId}/assign
- Parameters
- Request Body
- Responses
POST /api/policies/{policyId}/unassign
- Parameters
- Request Body
- Responses
POST /api/policies/{policyId}/toggle
- Parameters
- Responses
GET /api/policies/templates
- Responses
POST /api/policies/dsl/validate
- Request Body
- Responses
POST /api/policies/dsl/compile
- Request Body
- Responses
Governance
GET /api/governance/attestation
- Parameters
- Responses
GET /api/governance/execution
- Parameters
- Responses
GET /api/governance/rollout
- Parameters
- Responses
POST /api/governance/rollout
- Responses
GET /api/governance/rollout/{policyId}
- Parameters
- Responses
POST /api/governance/rollout/{policyId}
- Parameters
- Responses
Discovery
GET /api/discovery
- Parameters
- Responses
GET /api/discovery/{assetId}
- Parameters
- Responses
GET /api/discovery/{assetId}/diff
- Parameters
- Responses
GET /api/discovery/{assetId}/history
- Parameters
- Responses
POST /api/discovery/review
- Request Body
- Responses
GET /api/discovery/saved-views
- Responses
POST /api/discovery/saved-views
- Request Body
- Responses
Mcp
GET /api/mcp
- Parameters
- Responses
GET /api/mcp/{serverId}
- Parameters
- Responses
GET /api/mcp/{serverId}/findings
- Parameters
- Responses
GET /api/mcp/baseline
- Responses
POST /api/mcp/baseline
- Request Body
- Responses
GET /api/mcp/baseline/diff
- Responses
GET /api/mcp/reports
- Responses
POST /api/mcp/review
- Request Body
- Responses
Detection
GET /api/detection/config
- Responses
PUT /api/detection/config
- Request Body
- Responses
GET /api/detection/models
- Responses
GET /api/detection/stats
- Responses
Overview
GET /api/overview
- Responses
Search
GET /api/search/resources
- Parameters
- Responses
Alerts
GET /api/alerts
- Parameters
- Responses
GET /api/alerts/{alertId}
- Parameters
- Responses
Alert Rules
GET /api/alerts/rules
- Responses
POST /api/alerts/rules
- Request Body
- Responses
PUT /api/alerts/rules/{ruleId}
- Parameters
- Request Body
- Responses
DELETE /api/alerts/rules/{ruleId}
- Parameters
- Responses
Incidents
GET /api/incidents
- Parameters
- Responses
POST /api/incidents
- Request Body
- Responses
GET /api/incidents/{incidentId}
- Parameters
- Responses
PUT /api/incidents/{incidentId}
- Parameters
- Request Body
- Responses
POST /api/incidents/{incidentId}/notes
- Parameters
- Request Body
- Responses
GET /api/incidents/{incidentId}/review
- Parameters
- Responses
POST /api/incidents/{incidentId}/review
- Parameters
- Responses
POST /api/incidents/{incidentId}/communications/draft
- Parameters
- Request Body
- Responses
POST /api/incidents/{incidentId}/communications/send
- Parameters
- Request Body
- Responses
POST /api/incidents/{incidentId}/contain
- Parameters
- Request Body
- Responses
Lifecycle
GET /api/lifecycle/overview
- Responses
GET /api/lifecycle/config
- Responses
PUT /api/lifecycle/config
- Request Body
- Responses
GET /api/lifecycle/agents/{agentId}/checklist
- Parameters
- Responses
PUT /api/lifecycle/agents/{agentId}/checklist
- Parameters
- Request Body
- Responses
POST /api/lifecycle/agents/{agentId}/transition
- Parameters
- Request Body
- Responses
Reports
GET /api/reports
- Responses
POST /api/reports
- Request Body
- Responses
GET /api/reports/{reportId}
- Parameters
- Responses
GET /api/reports/{reportId}/export
- Parameters
- Responses
Admin
GET /api/admin/api-keys
- Responses
POST /api/admin/api-keys
- Request Body
- Responses
DELETE /api/admin/api-keys/{keyId}
- Parameters
- Responses
POST /api/admin/api-keys/{keyId}/rotate
- Parameters
- Responses
GET /api/admin/audit-log
- Parameters
- Responses
GET /api/admin/invite
- Responses
POST /api/admin/invite
- Request Body
- Responses
DELETE /api/admin/invite
- Parameters
- Responses
GET /api/admin/members
- Responses
DELETE /api/admin/members/{userId}
- Parameters
- Responses
PUT /api/admin/members/{userId}/role
- Parameters
- Request Body
- Responses
GET /api/admin/tenant
- Responses
PUT /api/admin/tenant
- Request Body
- Responses
POST /api/admin/tenant/delete
- Responses
Integrations
GET /api/admin/integrations
- Responses
POST /api/admin/integrations
- Request Body
- Responses
PUT /api/admin/integrations/{id}
- Parameters
- Request Body
- Responses
DELETE /api/admin/integrations/{id}
- Parameters
- Responses
POST /api/admin/integrations/{id}/test
- Parameters
- Responses
POST /api/admin/integrations/{id}/scan
- Parameters
- Responses
Store
GET /api/store/runtime-logs
- Parameters
- Responses
GET /api/store/trace-links
- Parameters
- Responses

Auth​

POST /api/auth/login​

Request Body​

Responses​

POST /api/auth/register​

Request Body​

Responses​

GET /api/auth/session​

Responses​

GET /api/auth/logout​

Responses​

POST /api/auth/setup​

Request Body​

Responses​

POST /api/auth/forgot-password​

Request Body​

Responses​

POST /api/auth/reset-password​

Request Body​

Responses​

POST /api/auth/accept-invite​

Request Body​

Responses​

GET /api/auth/workos/authorize​

Parameters​

Responses​

GET /api/auth/workos/callback​

Parameters​

Responses​

Agents​

GET /api/agents​

Parameters​

Responses​

GET /api/agents/{agentId}​

Parameters​

Responses​

GET /api/agents/{agentId}/sessions​

Parameters​

Responses​

Sessions​

GET /api/agents/{agentId}/sessions​

Parameters​

Responses​

GET /api/sessions/{sessionId}​

Parameters​

Responses​

Policies​

GET /api/policies​

Parameters​

Responses​

POST /api/policies​

Request Body​

Responses​

GET /api/policies/{policyId}​

Parameters​

Responses​

POST /api/policies/{policyId}/assign​

Parameters​

Request Body​

Responses​

POST /api/policies/{policyId}/unassign​

Parameters​

Request Body​

Responses​

POST /api/policies/{policyId}/toggle​

Parameters​

Responses​

GET /api/policies/templates​

Responses​

POST /api/policies/dsl/validate​

Request Body​

Responses​

POST /api/policies/dsl/compile​

Request Body​

Responses​

Governance​

GET /api/governance/attestation​

Parameters​

Responses​

GET /api/governance/execution​

Auth

`POST /api/auth/login`

Request Body

Responses

`POST /api/auth/register`

Request Body

Responses

`GET /api/auth/session`

Responses

`GET /api/auth/logout`

Responses

`POST /api/auth/setup`

Request Body

Responses

`POST /api/auth/forgot-password`

Request Body

Responses

`POST /api/auth/reset-password`

Request Body

Responses

`POST /api/auth/accept-invite`

Request Body

Responses

`GET /api/auth/workos/authorize`

Parameters

Responses

`GET /api/auth/workos/callback`

Parameters

Responses

Agents

`GET /api/agents`

Parameters

Responses

`GET /api/agents/{agentId}`

Parameters

Responses

`GET /api/agents/{agentId}/sessions`

Parameters

Responses

Sessions

`GET /api/agents/{agentId}/sessions`

Parameters

Responses

`GET /api/sessions/{sessionId}`

Parameters

Responses

Policies

`GET /api/policies`

Parameters

Responses

`POST /api/policies`

Request Body

Responses

`GET /api/policies/{policyId}`

Parameters

Responses

`POST /api/policies/{policyId}/assign`

Parameters

Request Body

Responses

`POST /api/policies/{policyId}/unassign`

Parameters

Request Body

Responses

`POST /api/policies/{policyId}/toggle`

Parameters

Responses

`GET /api/policies/templates`

Responses

`POST /api/policies/dsl/validate`

Request Body

Responses

`POST /api/policies/dsl/compile`

Request Body

Responses

Governance

`GET /api/governance/attestation`

Parameters

Responses

`GET /api/governance/execution`