CrossConnect API

Webhook events 8

Subscribe to any of these and the product posts to your endpoint when it happens.

EVENT device.updated a device's classification changes (role, platform, or vendor is inferred)
EVENT av-readiness.regression an AV protocol's readiness score regresses (a check that used to pass now fails)
EVENT occupancy:purge.deleted occupancy data is purged for a tenant (a retention or privacy purge ran)
EVENT discovery:collector.observed an isolated-network collector uploads a batch of observations
EVENT inbound:expel.security-alert an Expel security alert arrives and is enriched with CrossConnect context
EVENT connectivity-test.test an outbound sink connectivity test is run
EVENT inbound:snmptrap.<trap-kind> an SNMP trap arrives; the kind is the trap's own (for example inbound:snmptrap.linkDown)
EVENT inbound:<source>.<action> an external system posts an observation on the inbound rail; the source and action are

Aruba Digital Twin 4 endpoints

GET /api/v1/aruba-analysis/{deviceId} Read one device twinThe normalized Aruba model and evidence coverage for a device.
POST /api/v1/aruba-analysis/{deviceId}/acl Evaluate an ACL flowEvaluates a supplied flow against the captured Aruba ACL rules. The endpoint never changes a device.
GET /api/v1/aruba-analysis/{deviceId}/forwarding?destination={ip} Trace forwardingLocal route and forwarding decision for a destination address.
GET /api/v1/aruba-analysis/{deviceId}/power-supplies Diagnose power suppliesCollected power-supply state, capacity, and failure findings for one Aruba device.

Blast radius 1 endpoint

GET /api/v1/blast-radius/{deviceSlug} Assess one deviceAffected AV flows (each with whether it will drop), rooms, clock impact, lost

Compliance matrix 3 endpoints

GET /api/v1/compliance-matrix The matrixThe vendor by control matrix for a framework: per cell the canonical snippet and the count of
GET /api/v1/compliance-matrix/coverage Vendor coverageHow many controls the matrix covers per vendor family for a framework.
GET /api/v1/compliance-matrix/frameworks List frameworksThe frameworks a matrix can be generated for, each with its controls.

Faraday 7 endpoints

GET /api/v1/faraday Enclave inventoryBoundary, seal state, integrity, per-zone segmentation proofs, control status, and history.
GET /api/v1/faraday/acl-hygiene ACL hygieneShadowed filter lines that read correct but never fire.
GET /api/v1/faraday/breach Current breachThe open path, if the enclave is breached: which zone reaches which asset, through which
GET /api/v1/faraday/egress Egress checksWhich outside destinations the enclave can still reach.
GET /api/v1/faraday/fragile-seals Seals resting on an absent routeSeals that hold for want of a route rather than because a filter denies them: nothing is
GET /api/v1/faraday/history Breach windowsWhen the enclave opened, what opened it, what closed it, and whether anyone noticed.
GET /api/v1/faraday/prove Prove a path on demandProve segmentation between one outside zone (fromZoneCidr) and one asset (toIp).

Fix plan 1 endpoint

GET /api/v1/fix-plan Per-device fix planEach at-risk device's blended risk and recommended action (Replace / Upgrade / Harden / Monitor), worst-first.

Flow assurance 2 endpoints

GET /api/v1/flow-assurance AssessmentRecent applications, endpoints, tied infrastructure health, services, source status, and findings.
GET /api/v1/flow-assurance/findings Confirmed findingsConfirmed findings from recent flow evidence. An empty list does not prove health.

Network Black Box 1 endpoint

GET /api/v1/black-box/cause Find the breaking changeOnly dstIp is required; startDevice, srcIp, dstPort, protocol, from and to narrow the

Operational maturity 1 endpoint

GET /api/v1/maturity Maturity reportThe overall score + level and each dimension's score, evidence, and recommended next step.

Room readiness 3 endpoints

GET /api/v1/room-readiness/failing Rooms that will failEvery room whose latest verdict is BAD, with the failures that made it so.
GET /api/v1/room-readiness/rooms List tracked roomsThe rooms readiness tracks, with their key, name, and floor.
GET /api/v1/room-readiness/rooms/{roomKey} One room's latest reportVerdict, trigger, the meeting it was assessed for, and every check with its provenance.

Segmentation 1 endpoint

GET /api/v1/segmentation Segmentation reportZone-pair report: leaks, verified isolations, and the cross-plane traffic observed.

Threat detection 2 endpoints

GET /api/v1/threat-detection Scan for threatsAll current findings, highest severity first, each with a title, detail, and remediation.
GET /api/v1/threat-detection/counts Counts by severityHow many findings of each severity (high, medium, low) are currently raised.

Tinker Bell 2 endpoints

GET /api/v1/tinker-bell/scenarios Available scenariosEach what-if scenario and the parameters it takes.
POST /api/v1/tinker-bell/scenarios/{key}/run Run a scenarioA read-only simulation: POST only because the parameters are a free-form map, not because

Wargame 2 endpoints

GET /api/v1/red-twin Wargame reviewSegmentation findings with confidence, evidence source, affected object, and recommendation;
GET /api/v1/red-twin/benchmarks Published benchmark contextEach current finding paired with IBM 2025 breach averages or Uptime 2026 and ITIC 2024

Cables 8 endpoints

GET /api/v1/cables List cablesReturns every active cable for the tenant, each with its A and Z endpoint type/id,
POST /api/v1/cables Create a cableWires endpoint A to endpoint Z. Each endpoint is a ref naming an interface (by device
POST /api/v1/cables/bulk-csv Bulk upsert cables from CSVSlug-keyed upsert from a text/csv body. Existing slugs are updated; new slugs are
GET /api/v1/cables/export.csv Export cables as CSVStreams every cable as text/csv. Endpoints encode as 'interface:device:port' or
DELETE /api/v1/cables/{slug} Soft-delete a cableSoft-deletes the cable; both endpoints are released for re-use immediately.
GET /api/v1/cables/{slug} Get one cableReturns the cable by its stable slug. 404 if the slug is unknown.
PATCH /api/v1/cables/{slug} Update a cable's metadataEdits media attributes (type, color, length, label, description). Endpoints are
POST /api/v1/cables/{slug}/restore Restore a soft-deleted cableBrings back the most-recently soft-deleted cable for the slug. Returns 409 if an active

Circuits 13 endpoints

GET /api/v1/circuits List circuitsReturns every active circuit for the tenant with its provider, CID, type, status, and
POST /api/v1/circuits Create a circuitCID must be unique per (tenant, provider). The provider is named by slug and must
POST /api/v1/circuits/bulk-csv Bulk upsert circuits from CSVSlug-keyed upsert from a text/csv body. On create, provider-slug and cid are required.
POST /api/v1/circuits/bulk-delete Bulk soft-delete circuitsSoft-deletes a batch of circuits by slug. Returns per-slug status; unknown slugs are
GET /api/v1/circuits/export.csv Export circuits as CSVStreams every circuit as text/csv. Round-trips with POST /bulk-csv.
DELETE /api/v1/circuits/{slug} Soft-delete a circuitSoft-deletes the circuit. Terminations are left in place; call DELETE /{slug}/terminations
GET /api/v1/circuits/{slug} Get one circuitReturns the circuit by stable slug. 404 if unknown.
PATCH /api/v1/circuits/{slug} Update a circuitSparse update. Sending null clears commitRateKbps or installDate; omitting the key
POST /api/v1/circuits/{slug}/restore Restore a soft-deleted circuitBrings back the most-recently soft-deleted circuit for the slug. Returns 409 if an
DELETE /api/v1/circuits/{slug}/terminations Clear both terminationsAtomically removes both terminations: the legal way to go from two sides to zero.
GET /api/v1/circuits/{slug}/terminations List a circuit's terminationsReturns the A and Z terminations for the circuit, each with its location, optional
DELETE /api/v1/circuits/{slug}/terminations/{side} Remove one termination sideRemoves a single side. Rejected if the other side is still active: clear both instead.
PUT /api/v1/circuits/{slug}/terminations/{side} Create or replace one termination sideIdempotent upsert keyed by side (A or Z): the side is created or replaced. This is the

Console access 8 endpoints

GET /api/v1/console/devices/{slug}/console-ports List a device's console portsEach port and the console-server port it connects to, if any.
POST /api/v1/console/devices/{slug}/console-ports Add a console portEmits console-port.created.
GET /api/v1/console/devices/{slug}/console-server-ports List console-server portsThe device's console-server (terminal server) ports.
POST /api/v1/console/devices/{slug}/console-server-ports Add a console-server portEmits console-server-port.created.
DELETE /api/v1/console/ports/{portId} Remove a console portEmits console-port.deleted.
POST /api/v1/console/ports/{portId}/connect Connect to a console-server portWires a console port to a console-server port. Emits console-port.updated.
POST /api/v1/console/ports/{portId}/disconnect Disconnect a console portEmits console-port.updated.
DELETE /api/v1/console/server-ports/{csPortId} Remove a console-server portEmits console-server-port.deleted.

Endpoints 2 endpoints

GET /api/v1/endpoints List endpointsEvery learned endpoint (MAC, IP, switch, port, VLAN), most recently seen first.
GET /api/v1/endpoints/locate Find a MAC or IPFind exactly where a MAC or IP is plugged in. Accepts a MAC in any common format, or an IP.

FHRP groups 8 endpoints

GET /api/v1/fhrp-groups List FHRP groupsEvery group for the tenant.
POST /api/v1/fhrp-groups Create an FHRP groupEmits fhrp-group.created.
DELETE /api/v1/fhrp-groups/{slug} Soft-delete an FHRP groupEmits fhrp-group.deleted.
GET /api/v1/fhrp-groups/{slug} Get one group with members404 if unknown.
PATCH /api/v1/fhrp-groups/{slug} Update an FHRP groupEmits fhrp-group.updated.
GET /api/v1/fhrp-groups/{slug}/members List membersMember device/interface + priority.
POST /api/v1/fhrp-groups/{slug}/members Add a memberEmits fhrp-member.created.
DELETE /api/v1/fhrp-groups/{slug}/members/{memberId} Remove a memberEmits fhrp-member.deleted.

L2VPN 8 endpoints

GET /api/v1/l2vpns List L2VPNsEach with a termination count.
POST /api/v1/l2vpns Create an L2VPNEmits l2vpn.created.
DELETE /api/v1/l2vpns/{slug} Soft-delete an L2VPNTerminations go too; no VLAN/interface is deleted. Emits l2vpn.deleted.
GET /api/v1/l2vpns/{slug} Get one L2VPN404 if unknown.
PATCH /api/v1/l2vpns/{slug} Update an L2VPNEmits l2vpn.updated.
GET /api/v1/l2vpns/{slug}/terminations List terminationsThe VLANs/interfaces in this L2VPN.
POST /api/v1/l2vpns/{slug}/terminations Add a terminationAttach a vlan (by slug) or interface (device:interface). Emits l2vpn-termination.created.
DELETE /api/v1/l2vpns/{slug}/terminations/{terminationId} Remove a terminationEmits l2vpn-termination.deleted.

Multicast 7 endpoints

GET /api/v1/multicast/config Config postureThe per-device multicast configuration posture (IGMP snooping, querier, routing, PIM, RP)
GET /api/v1/multicast/diagnoses DiagnosesRanked, plain-English multicast diagnoses correlated from config, flows and IGMP state,
GET /api/v1/multicast/groups Multicast groupsEvery multicast group, merged from observed traffic (224.0.0.0/4), documented AV flows and
GET /api/v1/multicast/health Health scoreThe weighted multicast health score (0-100) with its category breakdown. A category with
GET /api/v1/multicast/interop Interop mismatchesMulti-vendor multicast interop mismatches at the vendor boundary: IGMP version, PIM mode,
GET /api/v1/multicast/rendezvous-points Rendezvous pointsPIM rendezvous points derived from config: address, learning method (static / Auto-RP /
GET /api/v1/multicast/unicast-fanout Unicast fan-outUnicast streams that could be multicast: one source fanning the same stream to many

Network atlas 6 endpoints

GET /api/v1/atlas/overview Network overviewThe shape of the network: counts, top vendors and roles, sites by size, and what needs
GET /api/v1/atlas/resilience Resilience mapWhere the network is redundant and where it is exposed: gateway-redundancy (FHRP) groups
GET /api/v1/atlas/roles/{role} Devices of a roleEvery device of a role (core, distribution, access, firewall, ...), grouped by site.
GET /api/v1/atlas/sites Sites by sizeSites with a device count, largest first.
GET /api/v1/atlas/sites/{slug} One siteEverything at one site: inventory by role and vendor, the device list, and the site contacts.
GET /api/v1/atlas/wan WAN edgesHow the offices connect: the site-to-site circuits and per-site provider/internet edges.

Providers 9 endpoints

GET /api/v1/providers List providersReturns every active provider for the tenant.
POST /api/v1/providers Create a providerSlug must be unique per tenant. ASN, when set, must fit in 4 bytes.
POST /api/v1/providers/bulk-csv Bulk upsert providers from CSVSlug-keyed upsert from a text/csv body. Returns counts and per-row errors.
POST /api/v1/providers/bulk-delete Bulk soft-delete providersSoft-deletes a batch of providers by slug. Returns per-slug status; unknown slugs are
GET /api/v1/providers/export.csv Export providers as CSVStreams every provider as text/csv. Round-trips with POST /bulk-csv.
DELETE /api/v1/providers/{slug} Soft-delete a providerSoft-deletes the provider. Existing circuits keep the FK target.
GET /api/v1/providers/{slug} Get one providerReturns the provider by stable slug. 404 if unknown.
PATCH /api/v1/providers/{slug} Update a providerSparse update. Send null asn to clear it; omit the key to leave it unchanged.
POST /api/v1/providers/{slug}/restore Restore a soft-deleted providerBrings back the most-recently soft-deleted provider for the slug. Returns 409 if an

Reconciliation 4 endpoints

GET /api/v1/reconciliation Get the drift reportReturns the drift report: discovered LLDP adjacencies classified as documented,
POST /api/v1/reconciliation/promote Promote one discovered linkPromotes a single discovered LLDP link into a documented cable, materialising its
POST /api/v1/reconciliation/promote-all Promote every undocumented linkPromotes every undocumented link in one pass. Returns counts of promoted versus
GET /api/v1/reconciliation/unconfirmed-cables List unconfirmed cablesReverse drift: documented cables between two discovered devices that no LLDP neighbour

Relationships 1 endpoint

GET /api/v1/relationships/device/{slug} Get a device's neighbor subgraphReturns a subgraph centered on a device, one hop out: interfaces, then cables, then the

Routing fabric 1 endpoint

GET /api/v1/routing Routing graph for a layerNodes and edges for one layer. Set layer to bgp (default), ospf, or sites.

Topology graph & stats 6 endpoints

GET /api/v1/topology/diagram.svg Render the network diagram as SVGReturns a self-contained image/svg+xml network diagram with a layered layout. Pass
GET /api/v1/topology/down-interfaces List down interfacesReturns every latest-staged interface whose ifOperStatus is down, joined with its
GET /api/v1/topology/graph Get the topology graphReturns the current topology graph for the tenant in a Cytoscape.js JSON shape (nodes
GET /api/v1/topology/poe Per-switch PoE budget vs drawReturns each switch with its collected PSE budget versus draw, sorted by
GET /api/v1/topology/racks/{slug}/power Per-rack PoE power roll-upReturns a rack's combined collected PoE budget versus draw for its reporting
GET /api/v1/topology/stats Topology rollup statsReturns a header-band rollup: device and link counts, the ifOperStatus distribution,

Topology tracing 2 endpoints

GET /api/v1/topology/trace Trace from an interfaceWalks from a starting interface across cables. Circuit terminations transparently jump
GET /api/v1/topology/trace-from-cable Trace from a cable sideWalks outward from one side (A or Z) of a named cable. Returns the ordered hops and

Traffic flows 3 endpoints

POST /api/v1/flows Ingest flowsIngest a batch of collector-summarized flows. Repeated conversations accumulate.
GET /api/v1/flows/summary Flow summaryTotals and per-protocol / per-application byte breakdowns.
GET /api/v1/flows/top Top talkersTop talkers by bytes, with the exporting device resolved.

Tunnels 8 endpoints

GET /api/v1/tunnels List tunnelsEvery tunnel for the tenant.
POST /api/v1/tunnels Create a tunnelEmits tunnel.created.
DELETE /api/v1/tunnels/{slug} Soft-delete a tunnelEmits tunnel.deleted.
GET /api/v1/tunnels/{slug} Get one tunnel404 if unknown.
PATCH /api/v1/tunnels/{slug} Update a tunnelEmits tunnel.updated.
GET /api/v1/tunnels/{slug}/terminations List terminationsEach end: device, interface, outside IP, role.
POST /api/v1/tunnels/{slug}/terminations Add a terminationrole peer|hub|spoke. Emits tunnel-termination.created.
DELETE /api/v1/tunnels/{slug}/terminations/{terminationId} Remove a terminationEmits tunnel-termination.deleted.

Discovery IPs 1 endpoint

POST /api/v1/discovery/ips/reconcile Promote IP addressesDocument IPs discovered over SNMP in the space whose prefix contains them, and bind each to

Discovery VLANs 1 endpoint

POST /api/v1/discovery/vlans/reconcile Promote VLANsCreate VLAN records for discovered VLANs not yet documented and bind each to the device it

Discovery VRFs 1 endpoint

POST /api/v1/discovery/vrfs/reconcile Promote VRFsCreate VRF records for VRFs discovered over SNMP that are not yet documented. Idempotent.

Discovery aggregates 1 endpoint

POST /api/v1/discovery/aggregates/reconcile Promote LAGs and tunnelsType ieee8023adLag interfaces as LAG aggregates and create Tunnel records (with

Discovery endpoints 1 endpoint

POST /api/v1/discovery/endpoints/reconcile Promote endpointsBuild (or refresh) endpoint records from the latest forwarding + ARP observations: one per

Discovery promotion 1 endpoint

POST /api/v1/discovery/promote Promote everythingPromote all discovered facts (LAG aggregates + tunnels, VRFs, VLANs, IPs) into the source

Aggregates and RIRs 9 endpoints

DELETE /api/v1/aggregates Soft-delete an aggregateEmits aggregate.deleted.
GET /api/v1/aggregates List aggregatesEvery aggregate for the tenant.
PATCH /api/v1/aggregates Update an aggregateRe-attribute the RIR or edit notes. Emits aggregate.updated.
POST /api/v1/aggregates Create an aggregateEmits aggregate.created.
GET /api/v1/aggregates/by-cidr Get an aggregate by CIDRAggregates are keyed by canonical CIDR (passed as a query param because it contains a slash). 404 if unknown.
GET /api/v1/aggregates/rirs List RIRsThe registries aggregates can be attributed to.
POST /api/v1/aggregates/rirs Create a RIREmits rir.created.
DELETE /api/v1/aggregates/rirs/{slug} Soft-delete a RIREmits rir.deleted.
PATCH /api/v1/aggregates/rirs/{slug} Update a RIREmits rir.updated.

DNS 6 endpoints

DELETE /api/v1/dns/records/{id} Delete a DNS recordDeletes a single record by its id.
GET /api/v1/dns/zones List DNS zonesReturns the tenant's DNS zones.
POST /api/v1/dns/zones Create a DNS zoneCreates a zone (domain) with optional SOA mname/rname and a default TTL. Returns 201.
DELETE /api/v1/dns/zones/{name} Delete a DNS zoneDeletes the zone and all of its records.
GET /api/v1/dns/zones/{name}/records List a zone's recordsReturns every record in the named zone.
POST /api/v1/dns/zones/{name}/records Add a record to a zoneAdds a record; the value is validated for the record type and CNAME exclusivity is enforced. Returns 201.

IP addresses 8 endpoints

GET /api/v1/ip-addresses List IP addressesEvery address for the tenant, optionally scoped to one space with ?space=<slug>.
POST /api/v1/ip-addresses Create an IP addressBare hosts are accepted and canonicalized to /32 or /128. Returns 201 with a Location header pointing at the by-address endpoint.
POST /api/v1/ip-addresses/allocate-next-free Allocate next free hostAllocates and documents the next free host inside the named prefix, returning 201 with a Location header. Returns 409 when the prefix is full.
POST /api/v1/ip-addresses/bulk-csv Upsert IP addresses from CSVConsumes text/csv and upserts keyed by (space-slug, address): existing rows patched, new ones created. Returns counts and per-row errors.
DELETE /api/v1/ip-addresses/by-address Soft-delete an addressSoft-deletes the address identified by space + address (canonical host-prefix CIDR).
GET /api/v1/ip-addresses/by-address Get one addressLooks up a single address by canonical host-prefix CIDR within a space. 404 if unknown.
PATCH /api/v1/ip-addresses/by-address Update an addressSparse update of status/description for the address identified by space + address. Omit a field to leave it unchanged.
GET /api/v1/ip-addresses/export.csv Export IP addresses as CSVReturns text/csv of every address (space-slug, address, status, description). Round-trips with POST /bulk-csv.

IP spaces 9 endpoints

GET /api/v1/ip-spaces List IP spacesReturns every active IP space for the tenant.
POST /api/v1/ip-spaces Create an IP spaceSlug must be unique within the tenant. permitDuplicates relaxes per-space address uniqueness. Returns 201 with a Location header.
POST /api/v1/ip-spaces/bulk-csv Upsert IP spaces from CSVConsumes text/csv and upserts slug-keyed: existing slugs are patched, new ones created. Returns rows read plus created/updated counts and per-row errors.
POST /api/v1/ip-spaces/bulk-delete Bulk soft-delete IP spacesSoft-deletes a batch of spaces by slug. Returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/ip-spaces/export.csv Export IP spaces as CSVReturns text/csv of every space (slug, name, description, permitDuplicates). Round-trips with POST /bulk-csv.
DELETE /api/v1/ip-spaces/{slug} Soft-delete an IP spaceSoft delete (deleted_at timestamp). Contained prefixes and addresses keep their FK target.
GET /api/v1/ip-spaces/{slug} Get one IP spaceReturns the space by slug, or 404 if the slug is unknown.
PATCH /api/v1/ip-spaces/{slug} Update an IP spaceSparse update: omit a field to leave it unchanged. Slug is immutable.
POST /api/v1/ip-spaces/{slug}/restore Restore a soft-deleted IP spaceBrings back the most-recently soft-deleted space for the slug. Returns 409 if an active space already occupies the slug.

IPAM roles 5 endpoints

GET /api/v1/ipam-roles List IPAM rolesOrdered by weight then name.
POST /api/v1/ipam-roles Create a roleEmits ipam-role.created.
DELETE /api/v1/ipam-roles/{slug} Soft-delete a roleEmits ipam-role.deleted.
GET /api/v1/ipam-roles/{slug} Get one role404 if unknown.
PATCH /api/v1/ipam-roles/{slug} Update a roleSlug immutable. Emits ipam-role.updated.

Prefixes 12 endpoints

GET /api/v1/prefixes List prefixesEvery prefix for the tenant, optionally scoped to one space with ?space=<slug>.
POST /api/v1/prefixes Create a prefixHost bits in the supplied CIDR are masked out (canonicalized). Returns 201 with a Location header pointing at the by-cidr endpoint.
POST /api/v1/prefixes/allocate-next-free-subnet Allocate next free child subnetCarves and documents the first free child subnet of the given length out of the parent CIDR, returning 201 with a Location header. Returns 409 when the parent is fully carved out.
POST /api/v1/prefixes/bulk-csv Upsert prefixes from CSVConsumes text/csv and upserts keyed by (space-slug, cidr): existing rows patched, new ones created. Returns counts and per-row errors.
DELETE /api/v1/prefixes/by-cidr Soft-delete a prefix by CIDRSoft-deletes the prefix identified by space + cidr. The CIDR is canonicalized at parse time.
GET /api/v1/prefixes/by-cidr Get one prefix by CIDRLooks up a single prefix by canonical CIDR within a space. 404 if unknown.
PATCH /api/v1/prefixes/by-cidr Update a prefix by CIDRSparse update of status/description for the prefix identified by space + cidr. Omit a field to leave it unchanged.
GET /api/v1/prefixes/export.csv Export prefixes as CSVReturns text/csv of every prefix (space-slug, cidr, status, description). Round-trips with POST /bulk-csv.
GET /api/v1/prefixes/next-free-subnet Next free child subnetReturns the first child subnet of the given length not already documented; nextFreeSubnet is null when every child is carved out. Read-only.
GET /api/v1/prefixes/overlapping Find overlapping prefixesReturns the documented prefixes in the space that overlap the given CIDR (a NetBox-style overlap check before adding a prefix). Set excludeExact=true to ignore an exact match.
GET /api/v1/prefixes/subnets Map child subnetsSplits a parent prefix into child subnets of the given prefix length, flagging which children already exist as documented prefixes.
GET /api/v1/prefixes/utilization Prefix utilizationRead-only: returns usable/used/free host counts, percent used, and the next free host for the prefix. Does not allocate anything.

VLANs 9 endpoints

GET /api/v1/vlans List VLANsReturns every active VLAN for the tenant, ordered by VID.
POST /api/v1/vlans Create a VLANVID must be 1..4094 and unique within the tenant; slug must be unique too. Returns 201 with a Location header.
POST /api/v1/vlans/bulk-csv Upsert VLANs from CSVConsumes text/csv and upserts slug-keyed. VID is required on create. Returns counts and per-row errors.
POST /api/v1/vlans/bulk-delete Bulk soft-delete VLANsSoft-deletes a batch of VLANs by slug. Returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/vlans/export.csv Export VLANs as CSVReturns text/csv of every VLAN (slug, vid, name, description, status). Round-trips with POST /bulk-csv.
DELETE /api/v1/vlans/{slug} Soft-delete a VLANSoft-deletes the VLAN; its VID becomes available for re-use immediately.
GET /api/v1/vlans/{slug} Get one VLANReturns the VLAN by stable slug, or 404 if unknown.
PATCH /api/v1/vlans/{slug} Update a VLANSparse update of name/description/status. The VID is immutable.
POST /api/v1/vlans/{slug}/restore Restore a soft-deleted VLANBrings back the most-recently soft-deleted VLAN for the slug. Returns 409 if an active VLAN occupies the slug or the vid.

VRFs 9 endpoints

GET /api/v1/vrfs List VRFsReturns every active VRF for the tenant.
POST /api/v1/vrfs Create a VRFSlug must be unique within the tenant. The optional RD is validated per RFC 4364. Returns 201 with a Location header.
POST /api/v1/vrfs/bulk-csv Upsert VRFs from CSVConsumes text/csv and upserts slug-keyed. RD is always set on upsert. Returns counts and per-row errors.
POST /api/v1/vrfs/bulk-delete Bulk soft-delete VRFsSoft-deletes a batch of VRFs by slug. Returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/vrfs/export.csv Export VRFs as CSVReturns text/csv of every VRF (slug, name, rd, description). Round-trips with POST /bulk-csv.
DELETE /api/v1/vrfs/{slug} Soft-delete a VRFSoft-deletes the VRF; its route distinguisher becomes available for re-use.
GET /api/v1/vrfs/{slug} Get one VRFReturns the VRF by stable slug, or 404 if unknown.
PATCH /api/v1/vrfs/{slug} Update a VRFSparse update of name/description/rd. Send rd: null to clear it; omit the rd key to leave it unchanged.
POST /api/v1/vrfs/{slug}/restore Restore a soft-deleted VRFBrings back the most-recently soft-deleted VRF for the slug. Returns 409 if an active VRF occupies the slug or the rd.

Authentication 2 endpoints

POST /api/v1/auth/login Admin login for a tenantExchanges a tenant slug and that tenant's admin secret for an HMAC-signed JWT. On success returns
POST /api/v1/auth/login-user User login for a tenantExchanges a tenant slug, username, and secret for a role-scoped JWT that carries the user's role

OIDC SSO 2 endpoints

GET /auth/oidc/callback Finish the SSO sign-inThe provider redirects here with a code and state. The state is checked against the session; the
GET /auth/oidc/login Start the SSO sign-inGenerates state, nonce, and a PKCE verifier, stores them on the HTTP session, then issues a 302

Tenants 5 endpoints

GET /api/v1/tenants List tenantsReturns every active tenant with its id, slug, name, and timestamps. No tenant header.
POST /api/v1/tenants Create a tenantCreates a tenant; the slug must be unique across the active set (409 on conflict). Returns 201 with a
DELETE /api/v1/tenants/{slug} Soft-delete a tenantSoft-deletes the tenant and returns 204; the slug becomes available for re-use. No tenant header.
GET /api/v1/tenants/{slug} Get one tenantReturns the tenant matching the slug, or 404 if none is active under it. No tenant header.
PATCH /api/v1/tenants/{slug} Rename a tenantChanges a tenant's display name; the slug is immutable. Returns the updated tenant. No tenant header.

Users & RBAC 6 endpoints

GET /api/v1/users List usersReturns the tenant's active users with username, role, effective permission keys, and timestamps;
POST /api/v1/users Create a userCreates a user with a role (viewer, editor, or admin) and an initial secret. Returns 201 with the
DELETE /api/v1/users/{username} Soft-delete a userSoft-deletes the user and returns 204. Rejects removing the tenant's last admin.
PUT /api/v1/users/{username}/permissions Set extra permission grantsReplaces the user's extra permission grants (keys like 'upgrade:approve') that sit on top of their
PUT /api/v1/users/{username}/role Change a user's roleSets the user's role to viewer, editor, or admin and returns the updated user. Rejects demoting the
PUT /api/v1/users/{username}/secret Reset a user's secretSets a new secret for the user and returns 204. Write-only; the secret is never echoed back.

Admin config 1 endpoint

GET /api/v1/admin/config Operational config summaryReturns the operational settings an admin cares about: data retention horizons,

Admin health 1 endpoint

GET /api/v1/admin/health Aggregate operator snapshotReturns version, Java version, JVM uptime, heap used/max/percent, active tenant count,

Attachments 4 endpoints

GET /api/v1/attachments List attachments for an objectReturns attachment metadata only (no bytes) for the object addressed by objectType + objectKey.
POST /api/v1/attachments Upload a fileMultipart upload of a file against a target object addressed by objectType + objectKey.
DELETE /api/v1/attachments/{id} Delete an attachmentDeletes the attachment. Returns 204 No Content.
GET /api/v1/attachments/{id}/download Download an attachmentStreams the attachment's bytes with its stored content type and a Content-Disposition

Automation inventory 2 endpoints

GET /api/v1/inventory/ansible Ansible dynamic inventoryReturns Ansible dynamic-inventory JSON (--list shape): hosts grouped by role, vendor, and
GET /api/v1/inventory/ansible.ini Static Ansible inventory.iniReturns a static Ansible inventory.ini (text/plain) grouped by role, ready to drop in and run.

DNS query-log ingest 1 endpoint

POST /api/v1/integrations/dns-logs Ingest resolver query-log linesBody is text/plain, one log line per newline. Suspicious queries are recorded as inbound

Demo seed 1 endpoint

POST /api/v1/demo/seed Seed demo inventorySeeds an AV-integrator fleet (~80 devices across 3 sites with full LLDP topology and staged

Discovery runs 7 endpoints

POST /api/v1/discovery/aggregates/reconcile Auto-document LAGs and tunnelsPromotes interface-type facts from the latest sweep into first-class records: interfaces seen as
POST /api/v1/discovery/endpoints/reconcile Auto-build endpoint recordsBuilds (or refreshes) endpoint records from the forwarding + ARP observations: one per MAC,
POST /api/v1/discovery/ips/reconcile Auto-document IPs and their interface bindingsDocuments IPs discovered over SNMP (ipAddrTable) in the space whose prefix contains each
POST /api/v1/discovery/promote Promote everything discovered, in one callRuns every discovery reconciler at once (LAG aggregates + tunnels, VRFs, VLANs, IPs, and
POST /api/v1/discovery/run Run a discovery sweepRuns one discovery sweep for the tenant against the configured DiscoverySource for every
POST /api/v1/discovery/vlans/reconcile Auto-document VLANsCreates VLAN records for VLANs discovered over SNMP (Q-BRIDGE dot1qVlanStaticTable) that are
POST /api/v1/discovery/vrfs/reconcile Auto-document VRFsCreates VRF records for VRFs discovered over SNMP (MPLS-L3VPN-STD-MIB) that are not yet

Identity-log ingest 1 endpoint

POST /api/v1/integrations/identity-logs Ingest DHCP/RADIUS log linesBody is text/plain, one log line per newline. A new or changed binding is recorded; a

Import jobs 8 endpoints

GET /api/v1/imports List import jobsReturns the tenant's import jobs, newest first, each with its status and planned-change counts.
POST /api/v1/imports Open an import jobOpens a new import job against a source (netbox|nautobot) and base URL. Status starts at
GET /api/v1/imports/{jobId} Get one import jobReturns one import job by id. 404 if unknown to the tenant.
POST /api/v1/imports/{jobId}/commit Commit an importPromotes staging to canonical data atomically. Moves VALIDATED to COMMITTED and issues a
GET /api/v1/imports/{jobId}/items List per-record dispositionsReturns each staged record's disposition (CREATE/UPDATE/CONFLICT/SKIP) with field-level diffs
POST /api/v1/imports/{jobId}/rollback Roll back an importReverses a committed import using its rollback token. Moves COMMITTED to ROLLED_BACK.
POST /api/v1/imports/{jobId}/stage Stage an importConnects to the source with the supplied API token, pulls and maps records, and writes
POST /api/v1/imports/{jobId}/validate Validate stagingRuns the invariant suite over the staged data. Moves STAGED to VALIDATED, or to FAILED if

Inbound events 1 endpoint

POST /api/v1/inbound/event Ingest an external eventRecords the event in the tamper-evident audit chain (and so the activity feed) and as a

Key rotation 5 endpoints

GET /api/v1/admin/key-rotation Key rotation statusThe current master-key state: which key is active, when it was created, and whether a
POST /api/v1/admin/key-rotation/generate Generate a new master keyCreate a new master key (not yet active) so it can be rotated in.
POST /api/v1/admin/key-rotation/restore Restore a previous keyRoll back to a prior master key (recovery path if a rotation needs to be undone).
POST /api/v1/admin/key-rotation/rotate Rotate to the new master keyMake the new master key active and re-wrap the data key under it. The old key is retained
POST /api/v1/admin/key-rotation/rotate-data-key Rotate the data keyRoll the data encryption key (and re-encrypt the protected secrets) without changing the

NetBox compatibility 1 endpoint

GET /api/netbox/api/dcim/devices/ NetBox-shaped device listReturns a NetBox-shaped, paginated device list for nb_inventory: results carrying role, type,

Plugins 3 endpoints

GET /api/v1/plugins List started pluginsReturns the plugins that successfully started at boot, each with name, version, and description.
GET /api/v1/plugins/declared List all declared pluginsReturns every discovered plugin, including any that failed to start, so an operator can
GET /api/v1/plugins/{name} Get one pluginReturns metadata for one plugin by name plus a started flag derived from the boot registry.

Prometheus metrics 1 endpoint

GET /api/v1/metrics Prometheus metricsReturns text/plain Prometheus exposition: catalogd vs active connector counts, plus

Version 1 endpoint

GET /api/v1/version Service version and runtimeReturns the service version, the Java runtime version, and JVM uptime in seconds.

Credentials 2 endpoints

POST /api/v1/credentials/bulk-csv Bulk import credentials CSVCreate or update SNMP and SSH credentials from CSV, keyed by (kind, slug). Returns a summary
GET /api/v1/credentials/export.csv Export credentials CSVAll SNMP and SSH credentials as CSV with secrets blanked. Round-trips with the bulk import.

Inbound review 4 endpoints

GET /api/v1/inbound-review Pending proposalsPending inbound observations awaiting review, highest confidence first.
GET /api/v1/inbound-review/count Pending countCount of pending inbound observations.
POST /api/v1/inbound-review/{id}/confirm Confirm a proposalConfirm an inbound observation.
POST /api/v1/inbound-review/{id}/dismiss Dismiss a proposalDismiss an inbound observation.

Outbound sinks 3 endpoints

GET /api/v1/outbound-sinks Current configurationCurrent sink configuration and shipping status for the tenant.
PUT /api/v1/outbound-sinks Set sinksSet the SIEM and chat URLs and the enabled flag. A blank URL disables that sink.
POST /api/v1/outbound-sinks/test Send a testSend a test payload to the configured sinks and return the per-sink outcome.

Device models 9 endpoints

GET /api/v1/device-models List device modelsReturns every active device model for the tenant.
POST /api/v1/device-models Create a device modelvendorSlug must reference an existing vendor. Returns 201 with a Location header.
POST /api/v1/device-models/bulk-csv Upsert device models from CSVSlug-keyed upsert; vendor-slug must already exist when creating a row. Body is text/csv. Returns counts and per-row errors.
POST /api/v1/device-models/bulk-delete Bulk soft-delete device modelsSoft-deletes a batch of models by slug and returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/device-models/export.csv Export device models as CSVReturns every model as text/csv, with vendor ids resolved to vendor slugs. Round-trips with POST /bulk-csv.
DELETE /api/v1/device-models/{slug} Soft-delete a device modelMarks the model deleted and frees its slug for re-use. Returns 204.
GET /api/v1/device-models/{slug} Get one device modelReturns the model by stable slug. 404 if unknown.
PATCH /api/v1/device-models/{slug} Update a device modelSparse update of name and description; omit a field to leave it unchanged. Slug and vendor are immutable.
POST /api/v1/device-models/{slug}/restore Restore a device modelBrings back the most-recently soft-deleted model for the slug. Returns 409 if an active model already occupies it.

Devices 10 endpoints

GET /api/v1/devices List devicesReturns every active device for the tenant.
POST /api/v1/devices Create a deviceSlug must be unique within the tenant. locationSlug and deviceModelSlug, when given, must
POST /api/v1/devices/bulk-csv Upsert devices from CSVSlug-keyed upsert: existing rows are PATCHed, new rows are created. Body is text/csv. Returns counts of rows read, created, updated, and any per-row errors.
POST /api/v1/devices/bulk-delete Bulk soft-delete devicesSoft-deletes a batch of devices by slug and returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/devices/export.csv Export devices as CSVReturns every device as text/csv (Content-Disposition attachment). Round-trips with POST /bulk-csv.
DELETE /api/v1/devices/{slug} Soft-delete a deviceMarks the device deleted and frees its slug for immediate re-use. Returns 204.
GET /api/v1/devices/{slug} Get one deviceReturns the device addressed by its stable slug. 404 if no active device holds that slug.
PATCH /api/v1/devices/{slug} Update a deviceSparse update: omit a field to leave it unchanged. For locationSlug and deviceModelSlug,
PUT /api/v1/devices/{slug}/owner Set the device's ownerRecords a responsible owner (name + email) who is notified ahead of upgrades. Returns the updated device.
POST /api/v1/devices/{slug}/restore Restore a deviceBrings back the most-recently soft-deleted device for the slug. Returns 409 if an active device already occupies it.

Interfaces 5 endpoints

GET /api/v1/devices/{deviceSlug}/interfaces List a device's interfacesReturns every active interface on the named device.
POST /api/v1/devices/{deviceSlug}/interfaces Create an interfaceName must be unique per device. Returns 201 with a Location header carrying the URL-encoded name.
DELETE /api/v1/devices/{deviceSlug}/interfaces/{name} Soft-delete an interfaceMarks the interface deleted. URL-encode slashes in the name. Returns 204.
GET /api/v1/devices/{deviceSlug}/interfaces/{name} Get one interfaceReturns the interface by name; URL-encode any slashes in the name. 404 if unknown.
PATCH /api/v1/devices/{deviceSlug}/interfaces/{name} Update an interfaceSparse update: for the nullable fields (speed, MTU, MAC, mode) sending null clears them while

Interfaces (bulk CSV) 2 endpoints

POST /api/v1/interfaces/bulk-csv Upsert interfaces from CSVKeyed by (device-slug, name): existing rows are PATCHed, new rows are created. Body is text/csv.
GET /api/v1/interfaces/export.csv Export all interfaces as CSVReturns every interface for the tenant as text/csv, with device ids resolved to device slugs. Round-trips with POST /bulk-csv.

Locations 9 endpoints

GET /api/v1/locations List locationsReturns every active location for the tenant.
POST /api/v1/locations Create a locationSlug must be unique within the tenant. An optional parentSlug nests the location under an
POST /api/v1/locations/bulk-csv Upsert locations from CSVSlug-keyed upsert; parent-slug must already exist when set. Body is text/csv. Returns counts and per-row errors.
POST /api/v1/locations/bulk-delete Bulk soft-delete locationsSoft-deletes a batch of locations by slug and returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/locations/export.csv Export locations as CSVReturns every location as text/csv, with parent ids resolved to parent slugs. Round-trips with POST /bulk-csv.
DELETE /api/v1/locations/{slug} Soft-delete a locationMarks the location deleted. Children stay but their parent reference no longer resolves on read. Returns 204.
GET /api/v1/locations/{slug} Get one locationReturns the location by stable slug, including its parent id. 404 if unknown.
PATCH /api/v1/locations/{slug} Update a locationSparse update: send null parentSlug to clear the parent, omit the key to leave it. Slug is immutable.
POST /api/v1/locations/{slug}/restore Restore a locationBrings back the most-recently soft-deleted location for the slug. Returns 409 if an active location already occupies it.

Network services 8 endpoints

GET /api/v1/network-services List network servicesEach service with slug, name, criticality, owner, and member count.
POST /api/v1/network-services Create a servicecriticality is critical|high|normal|low; slug is derived from the name. Emits network-service.created.
DELETE /api/v1/network-services/members/{memberRowId} Remove a member bindingBy the binding row id.
GET /api/v1/network-services/suggestions Suggest services from trafficCandidate services triangulated from traffic flows, running-service names, and shared VLANs,
DELETE /api/v1/network-services/{id} Delete a serviceSoft-deletes the service and its members. Emits network-service.deleted.
GET /api/v1/network-services/{id} Get one serviceBy id. 404 if unknown.
GET /api/v1/network-services/{id}/members List membersThe inventory objects bound to the service.
POST /api/v1/network-services/{id}/members Bind a membermemberType is device|vlan|circuit|prefix. Idempotent.

Power 12 endpoints

GET /api/v1/power/devices/{slug}/outlets List a PDU's outletsEach outlet and the inlet port that feeds it.
POST /api/v1/power/devices/{slug}/outlets Add an outlet to a PDUEmits power-outlet.created.
GET /api/v1/power/devices/{slug}/ports List a device's power portsThe device's PSU inputs and what each draws from.
POST /api/v1/power/devices/{slug}/ports Add a power port to a deviceDefine a PSU input with a maximum and allocated draw, fed by a feed or an outlet. Emits power-port.created.
GET /api/v1/power/feeds List power feedsEvery feed for the tenant, with the rack it serves and its rated capacity.
POST /api/v1/power/feeds Create a power feedDefine a feed: voltage, amperage, phase, and rated watts. Emits power-feed.created.
DELETE /api/v1/power/feeds/{slug} Soft-delete a power feedEmits power-feed.deleted.
GET /api/v1/power/feeds/{slug} Get one feedFeed by slug. 404 if unknown.
PATCH /api/v1/power/feeds/{slug} Update a power feedAdjust a feed's electrical attributes. Emits power-feed.updated.
GET /api/v1/power/feeds/{slug}/load Feed load roll-upWalks the chain (ports and outlets fed by this feed) and returns allocated watts, rated watts, and utilization percent.
DELETE /api/v1/power/outlets/{outletId} Remove an outletEmits power-outlet.deleted.
DELETE /api/v1/power/ports/{portId} Remove a power portEmits power-port.deleted.

Racks 7 endpoints

GET /api/v1/racks List racks with occupancyReturns every rack with total, used, and free U, device count, and utilization percent.
GET /api/v1/racks/where Locate a racked deviceReturns where a device is racked (rack plus U-position, height, and face). 404 when it is not mounted.
PUT /api/v1/racks/{slug} Set a rack's heightSets the rack's total height in rack units. Returns the updated elevation.
POST /api/v1/racks/{slug}/devices Place a device in the rackMounts a device at a U-position and face, rejecting overlaps and out-of-bounds positions. Returns the updated elevation.
DELETE /api/v1/racks/{slug}/devices/{deviceSlug} Remove a device from a rackUnracks the device; it stays in the inventory. Returns the updated elevation.
GET /api/v1/racks/{slug}/elevation Get a rack's elevationReturns the rack's mounted devices with U-position, U-height, face, vendor/model, status, and the free units.
GET /api/v1/racks/{slug}/free-slot Find the next free slotReturns the lowest free U-position that fits a uHeight-U device on the given face. 404 when nothing fits.

Services 5 endpoints

GET /api/v1/services List servicesEvery service for the tenant. Optionally filter to one host with hostType + hostRef.
POST /api/v1/services Create a servicePorts are validated and normalized to 1..65535. Emits service.created.
DELETE /api/v1/services/{id} Soft-delete a serviceEmits service.deleted.
GET /api/v1/services/{id} Get one serviceBy id. 404 if unknown.
PATCH /api/v1/services/{id} Update a serviceHost is immutable. Emits service.updated.

Vendors 10 endpoints

GET /api/v1/vendors List vendorsReturns every active vendor for the tenant.
POST /api/v1/vendors Create a vendorSlug must be unique within the tenant. Returns 201 with a Location header.
POST /api/v1/vendors/bulk-csv Upsert vendors from CSVSlug-keyed upsert: existing rows are PATCHed, new rows are created. Body is text/csv. Returns counts and per-row errors.
POST /api/v1/vendors/bulk-delete Bulk soft-delete vendorsSoft-deletes a batch of vendors by slug and returns per-slug status; unknown slugs are reported but do not abort the call.
GET /api/v1/vendors/export.csv Export vendors as CSVReturns every vendor as text/csv. Round-trips with POST /bulk-csv.
DELETE /api/v1/vendors/{slug} Soft-delete a vendorMarks the vendor deleted and frees its slug for re-use. Returns 204.
GET /api/v1/vendors/{slug} Get one vendorReturns the vendor by stable slug. 404 if unknown.
PATCH /api/v1/vendors/{slug} Update a vendorSparse update of the name; omit it to leave it unchanged. Slug is immutable.
PUT /api/v1/vendors/{slug}/logo Set or clear a vendor logoSets the vendor's logo URL; a null or blank url clears it. Returns the updated vendor.
POST /api/v1/vendors/{slug}/restore Restore a vendorBrings back the most-recently soft-deleted vendor for the slug. Returns 409 if an active vendor already occupies it.

Virtualization 13 endpoints

GET /api/v1/virtualization/clusters List clustersEach with a VM count.
POST /api/v1/virtualization/clusters Create a clusterEmits vm-cluster.created.
DELETE /api/v1/virtualization/clusters/{slug} Soft-delete a clusterVMs are detached, not deleted. Emits vm-cluster.deleted.
GET /api/v1/virtualization/clusters/{slug} Get one cluster404 if unknown.
PATCH /api/v1/virtualization/clusters/{slug} Update a clusterEmits vm-cluster.updated.
GET /api/v1/virtualization/clusters/{slug}/vms List VMs on a cluster404 if the cluster is unknown.
GET /api/v1/virtualization/vms List virtual machinesEvery VM for the tenant with its cluster.
POST /api/v1/virtualization/vms Create a VMEmits virtual-machine.created.
DELETE /api/v1/virtualization/vms/{slug} Soft-delete a VMEmits virtual-machine.deleted.
PATCH /api/v1/virtualization/vms/{slug} Update a VMEmits virtual-machine.updated.
GET /api/v1/virtualization/vms/{slug}/interfaces List a VM's interfacesThe VM's NICs.
POST /api/v1/virtualization/vms/{slug}/interfaces Add a VM interfaceEmits vm-interface.created.
DELETE /api/v1/virtualization/vms/{slug}/interfaces/{interfaceId} Remove a VM interfaceEmits vm-interface.deleted.

Iris 4 endpoints

GET /api/v1/iris/av-endpoints AV endpointsSaved non-camera AV inventory. Product responses are shown only for PJLink displays, supported Cisco or Poly codecs, and Q-SYS DSPs.
GET /api/v1/iris/cameras Camera reportThe same saved camera rows used by the UI, including management response, recent flow-candidate evidence, exact switch attachment, per-port PoE correlation, and per-source status and freshness.
GET /api/v1/iris/cameras/by-site Cameras by siteCameras grouped by site with how many are alarming at each.
GET /api/v1/iris/cameras/summary Fleet countersConfigured media sources, power-present/no-response conditions, not-observed cameras, stable identity changes, Covered List matches, CVEs, and attention counts.

Luminaire 2 endpoints

GET /api/v1/bat-signal Lighting inventoryNodes, universes, measured sources, packet health, RDMnet services, and configured Luminex data.
GET /api/v1/bat-signal/brands Implemented collectorsThe standards and product collectors implemented by this build.

Silhouette 1 endpoint

GET /api/v1/wobble Inferred devicesEach finding: what kind, how severe, the device and port it was seen on, the VLAN, the

Strikeout 2 endpoints

GET /api/v1/strikeout Machine inventoryProduct identity, IP, MAC, open ports, discovery time, and switch-port evidence.
GET /api/v1/strikeout/brands Identifiable brandsThe pitching-system names this build recognizes and the evidence required for each.

Wi-Fi coverage 7 endpoints

GET /api/v1/wifi/aps/{apSlug}/uplink What an AP is plugged intoUplink switch, switch port, AP port, link speed, and packet loss on that link. 404 when
GET /api/v1/wifi/floors Floors with plan geometryThe floors that have an imported floor plan: the ones a real BOM can be computed for.
GET /api/v1/wifi/floors/{floorSlug} One floor's real geometryAP positions in meters, zone polygons, dead zones, and wiring-closet markers.
GET /api/v1/wifi/floors/{floorSlug}/bom Wireless bill of materialsAPs, switching, cable footage computed from the real AP and closet positions, mounts,
GET /api/v1/wifi/sites Coverage by siteEvery site's AP count, clients, coverage %, dead zones, channel overlaps, and a
GET /api/v1/wifi/sites/{siteSlug} One site's coverageAPs, zones with RSSI and the AP serving each, dead zones, and co-channel overlaps.
GET /api/v1/wifi/sites/{siteSlug}/architecture Site wireless architectureHow the site hangs together: controllers, switches, and APs, with the links between them.

Wireless RF evidence and planning 4 endpoints

GET /api/v1/wifi/rf Analyze the latest RF evidenceRuns the planner without saving a plan. The result includes evidence age and source, current
GET /api/v1/wifi/rf/plans List saved RF plansReturns saved planning runs newest first, including their evidence costs, confidence, status,
POST /api/v1/wifi/rf/plans Run and save an RF planRuns the same analysis and stores the plan, every per-radio recommendation, the algorithm
POST /api/v1/wifi/rf/snapshots Store measured RF evidenceAccepts one normalized snapshot from a controller, scanner, or survey adapter. Each radio

Cisco Spaces presence webhook 1 endpoint

POST /api/v1/occupancy/cisco-spaces/events Ingest Cisco Spaces eventsAccepts a Cisco Spaces presence event payload and updates the relevant zone's occupancy.

Cleaning 4 endpoints

GET /api/v1/cleaning Cleaning reportCleaned, outstanding, skipped-unused, labor minutes saved, and distinct areas.
GET /api/v1/cleaning/due Tasks due nowThe cleaning tasks currently due, worst-first, each with why it was raised and the
GET /api/v1/cleaning/gatherings Recent gatheringsThe gatherings that triggered a cleaning task. Optional limit (default 20).
GET /api/v1/cleaning/patterns Gathering patternsThe recurring day and hour each area fills up, with how many weeks of evidence back it.

Mist presence webhook 1 endpoint

POST /api/v1/occupancy/mist/zone-events Ingest Mist zone eventsAccepts a Mist zone-enter/exit event payload and updates the zone's occupancy.

Occupancy 4 endpoints

GET /api/v1/occupancy List occupancy zonesEvery occupancy zone with its current count, capacity, and utilization.
GET /api/v1/occupancy/report.pdf Occupancy PDF reportA printable occupancy summary across zones for the selected window.
GET /api/v1/occupancy/{slug}/dwell Dwell-time breakdownHow long people stay in one zone, bucketed: short visits vs sustained use.
GET /api/v1/occupancy/{slug}/series Occupancy time-seriesThe occupancy count over time for one zone (for charts and trend lines).

Occupancy OData feed 3 endpoints

GET /api/v1/occupancy/odata OData service documentThe service root listing the available entity sets.
GET /api/v1/occupancy/odata/$metadata OData schemaThe CSDL metadata document BI tools read to discover fields and types.
GET /api/v1/occupancy/odata/Occupancy Occupancy entity setThe occupancy rows as an OData collection (supports the usual $filter/$select query options).

Occupancy admin 2 endpoints

GET /api/v1/occupancy/admin/export Export occupancy recordsDownload the aggregated occupancy records (e.g. for archival or external analysis).
POST /api/v1/occupancy/admin/purge Purge occupancy historyDelete stored occupancy history past a cutoff, a privacy/retention control. Irreversible.

Sense 2 endpoints

GET /api/v1/sense Room reportEvery room's presence, whether AV is in use, PoE watts, device count, a confidence score
GET /api/v1/sense/rooms List roomsThe rooms Sense knows about: key, name, and floor.

AV readiness 3 endpoints

GET /api/v1/av-readiness Readiness overviewOverall score and per-protocol readiness, each with its individual checks.
GET /api/v1/av-readiness/plan Remediation planThe prioritized actions that would most raise the readiness score, with where and how.
GET /api/v1/av-readiness/{protocolKey} One protocolReadiness for a single protocol (for example dante, aes67, st2110): score and per-check

Capacity 3 endpoints

GET /api/v1/capacity Capacity overviewCapacity overview with forecast-to-full. growthPctPerMonth defaults to 5%.
GET /api/v1/capacity/by-service Capacity by serviceCapacity projected onto each network service, worst and most-critical first.
GET /api/v1/capacity/near-max Near-max resourcesOnly the resources at or near their max-utilization threshold.

Change preview 1 endpoint

POST /api/v1/change-preview Preview a config changePreview the reachability delta of a proposed config on one device. available=false when

Change safety 1 endpoint

GET /api/v1/change-safety Assess change safetyPass a device slug; returns the verdict and the reasons behind it.

Compliance frameworks 2 endpoints

GET /api/v1/compliance/frameworks List available frameworksReturns each framework's key, name, and control count.
GET /api/v1/compliance/frameworks/{key} Evaluate the tenant against a frameworkRuns every control in the named framework and returns each control's status and evidence plus an overall score.

Config check 1 endpoint

GET /api/v1/config-check Audit fleet configsPer-device parse status and the list of correctness issues. available=false when Batfish

Config grade 2 endpoints

GET /api/v1/config-grade/devices Gradeable devicesList device slugs that have a running config available to grade.
GET /api/v1/config-grade/{deviceSlug} Grade one deviceGrade one device's config A to F: score, pass/fail counts, and per-control results with

Config hardening 3 endpoints

GET /api/v1/config-hardening Fleet hardening rollupOverall score, per-control pass/fail, and per-device hardening findings.
GET /api/v1/config-hardening/devices Assessable devicesList device slugs that have a running config to assess.
GET /api/v1/config-hardening/{deviceSlug} Device hardening findingsHardening findings for one device. 404 if the device has no assessable config.

Data quality 1 endpoint

GET /api/v1/data-quality Compute the data-quality scoreComputes and returns the tenant's data-quality score (overall score plus per-check findings).

Device history 1 endpoint

GET /api/v1/device-history/{deviceSlug} Device timelineThe change timeline and move history for one device.

Golden config & compliance 10 endpoints

GET /api/v1/golden-config/compliance Fleet compliance roll-upReturns compliant / non-compliant / unassessed counts, average coverage, and per-device lines across the whole tenant.
POST /api/v1/golden-config/detect-drift Run a drift sweep nowEvaluates every device and emits DriftDetected (audit + webhooks) for those newly fallen out of compliance. Returns the newly-drifted device slugs and a count.
GET /api/v1/golden-config/devices/{slug}/compliance Per-device compliance reportCompares the device's latest running config against its intended config and returns missing lines, extra lines, and a coverage percentage.
GET /api/v1/golden-config/devices/{slug}/history List stored config snapshotsReturns the device's stored running and intended snapshots, newest first; bodies are omitted (summaries only).
PUT /api/v1/golden-config/devices/{slug}/intended Set the intended golden configSets the device's intended config directly from the supplied body; latest write wins.
POST /api/v1/golden-config/devices/{slug}/promote-running Promote the latest running snapshot to intendedBlesses the device's most recent running snapshot as its intended golden config, so current reality becomes the baseline.
POST /api/v1/golden-config/devices/{slug}/render-intended Render and set the intended config from a templateSubstitutes the device's name / slug / managementIp into the supplied template and stores the result as the device's intended golden config.
POST /api/v1/golden-config/devices/{slug}/running Record a running-config snapshotStores a new running-config snapshot for the device; history accumulates so you keep every backup.
GET /api/v1/golden-config/devices/{slug}/running-diff Diff the two most recent running snapshotsReturns the lines added and removed between the device's two most recent running backups.
GET /api/v1/golden-config/search Fleet-wide config grepSearches every device's latest running config for the query string and returns the matching devices with their matching lines.

Hotspots 2 endpoints

GET /api/v1/hotspots Top critical items across the estateReturns up to the requested number of findings. Each item carries its category, affected object, action, evidence source, evidence status, observation time when supplied, and evidence reference when supplied. The limit is clamped to 1..50 (default 10).
GET /api/v1/hotspots/status Queue freshness and producer statusReturns the complete ranked queue with CURRENT, PARTIAL, STALE, LOADING, or FAILED status, the assembly time, refresh state, and one READ or FAILED row per producer.

Journal 4 endpoints

POST /api/v1/journal Append an entryAppend a journal entry to an object (objectType, objectId, kind, author, body).
GET /api/v1/journal/for Entries for an objectJournal entries for one object identified by (objectType, objectId).
GET /api/v1/journal/recent Recent entriesRecent journal entries across the tenant (default limit 50).
DELETE /api/v1/journal/{id} Delete an entryDelete a journal entry by id.

Lifecycle (EoL/EoS) 9 endpoints

PUT /api/v1/lifecycle/devices/{slug}/software Set a device's running software versionRecords the software version a device currently runs, which feeds software-lifecycle and CVE matching.
GET /api/v1/lifecycle/eol-lookup Look up end-of-support dates from endoflife.dateQueries endoflife.date for a product + version (e.g. cisco-ios-xe, 17.9.4) and returns the matching cycle's dates. 404 when no cycle matches. Not tenant-scoped data, but still requires the tenant header.
GET /api/v1/lifecycle/fleet Fleet hardware-lifecycle roll-upReturns models with notices, devices covered, devices at risk / end-of-support, and the at-risk models.
GET /api/v1/lifecycle/models Per-model lifecycle todayReturns each model's lifecycle status and how many devices run it, worst (most at-risk) first.
DELETE /api/v1/lifecycle/models/{slug}/notice Remove a model's EoL noticeDeletes the model's end-of-life notice. Returns 204.
GET /api/v1/lifecycle/models/{slug}/notice Get a model's EoL noticeReturns the model's recorded end-of-life notice. 404 when none is recorded.
PUT /api/v1/lifecycle/models/{slug}/notice Set a model's EoL noticeUpserts the end-of-sale / end-of-support notice for a device model. Dates are ISO-8601 (yyyy-MM-dd) or null. Returns the stored notice.
GET /api/v1/lifecycle/software/fleet Fleet software-lifecycle roll-upReturns devices whose version is classified approved / deprecated / end-of-support / unknown, with the at-risk devices listed.
PUT /api/v1/lifecycle/software/notices/{vendor}/{version} Set a software EoS noticeRecords a validated-software / end-of-support notice for a (vendor, version). The approved flag and endOfSupport date classify devices running it (approved defaults to true when omitted).

Maintenance windows 6 endpoints

GET /api/v1/maintenance-windows List windowsEvery window for the tenant.
POST /api/v1/maintenance-windows Create a windowEmits maintenance-window.created.
GET /api/v1/maintenance-windows/active List active windowsWindows in progress right now.
DELETE /api/v1/maintenance-windows/{slug} Soft-delete a windowEmits maintenance-window.deleted.
GET /api/v1/maintenance-windows/{slug} Get one window404 if unknown.
PATCH /api/v1/maintenance-windows/{slug} Update a windowEmits maintenance-window.updated.

Outages 1 endpoint

GET /api/v1/outages List active outagesEach outage carries its scope, severity, title, likely cause, and the affected device slugs

Packet loss 2 endpoints

GET /api/v1/packet-loss Fleet packet lossEvery port with measurable loss, worst first: device, interface, loss band, and drops per
GET /api/v1/packet-loss/history Per-port historyThe loss-band time series for one port, oldest to newest. Identify the port by deviceId and

QoS 2 endpoints

GET /api/v1/qos QoS reportScore, coverage, per-device policies and bindings, and the prioritized findings.
GET /api/v1/qos/runtime Live class runtimePer-class matched and dropped counters where the device exposes them.

Runbooks 10 endpoints

GET /api/v1/runbooks List runbooksList runbooks for the tenant.
POST /api/v1/runbooks Create a runbookCreate a runbook. The slug is derived from the title.
GET /api/v1/runbooks/export.pdf Export library PDFExport the runbook library as a grouped PDF.
GET /api/v1/runbooks/grouped Runbooks by categoryRunbooks grouped by category.
DELETE /api/v1/runbooks/targets/{targetId} Remove a targetRemove a runbook target by id.
DELETE /api/v1/runbooks/{slug} Delete a runbookDelete a runbook.
GET /api/v1/runbooks/{slug} Get a runbookGet one runbook by slug.
PUT /api/v1/runbooks/{slug} Update a runbookUpdate a runbook's title, category, or body.
GET /api/v1/runbooks/{slug}/targets List targetsList the targets a runbook applies to.
POST /api/v1/runbooks/{slug}/targets Add a targetAdd a target (type + ref, e.g. a hotspot kind or a device) to a runbook.

Secrets 4 endpoints

GET /api/v1/secrets List secrets (metadata only)Returns group, name, description, and timestamps for every secret. Values are never included.
POST /api/v1/secrets Store or rotate a secretStores or rotates a secret under a (group, name); the value is encrypted at rest and never returned. Requires EDITOR or ADMIN. Returns 201 with metadata only.
DELETE /api/v1/secrets/{group}/{name} Delete a secretDeletes the secret. Returns 204.
POST /api/v1/secrets/{group}/{name}/reveal Reveal a secret's valueDecrypts and returns the secret's value. Privileged (POST; EDITOR or ADMIN) and audited by access.

Security advisories (CVEs) 4 endpoints

GET /api/v1/cves List recorded advisoriesReturns the tenant's recorded advisories, most severe first.
POST /api/v1/cves Record a security advisoryRecords a CVE advisory (id + severity, with an optional vendor and affected version). Returns 201 with the stored advisory.
GET /api/v1/cves/affected List affected devicesReturns the devices affected by recorded advisories, matched on vendor and running version.
DELETE /api/v1/cves/{id} Delete an advisoryDeletes a recorded advisory. Returns 204.

Service readiness 1 endpoint

GET /api/v1/readiness Readiness rollupEach group with its worst-member state and member counts. groupBy is site (default), role, or service.

Upgrade executions 6 endpoints

GET /api/v1/upgrade-executions List upgrade executionsReturns the tenant's upgrade executions, newest first.
POST /api/v1/upgrade-executions Open an execution requestOpens an execution request against an existing upgrade plan. Requires the upgrade:create permission. Returns 201 with the execution (status, requestedBy, requestedAt).
POST /api/v1/upgrade-executions/{id}/approve Approve an executionApproves the execution and time-boxes the approval window. Requires the upgrade:approve permission; the approver must differ from the requester.
POST /api/v1/upgrade-executions/{id}/dry-run Dry-run an executionRenders and validates the script without making any changes. Requires the upgrade:execute permission. Sets dryRunOk on success.
POST /api/v1/upgrade-executions/{id}/execute Execute an upgradeRuns the upgrade. Requires the upgrade:execute permission, a passing dry-run, and a live (unexpired) approval. Records exit code and output.
POST /api/v1/upgrade-executions/{id}/reject Reject an executionRejects the execution with a reason. Requires the upgrade:approve permission.

Upgrade plans 5 endpoints

GET /api/v1/upgrades List upgrade plansReturns the tenant's upgrade plans, soonest scheduled first.
POST /api/v1/upgrades Create an upgrade planSchedules an upgrade of the named devices to a target version, with contacts, an automation tool, and notify offsets. Returns 201 with the created plan (status, devices, schedule).
DELETE /api/v1/upgrades/{id} Delete an upgrade planDeletes the plan. Returns 204.
POST /api/v1/upgrades/{id}/cancel Cancel an upgrade planCancels the plan and stops any further advance notifications. Returns 204.
GET /api/v1/upgrades/{id}/script Get the generated automation scriptReturns the plan's generated automation script (text/plain) in its chosen tool: Terraform, OpenTofu, Ansible, Puppet, or Chef.

AI assistant 3 endpoints

POST /api/v1/assistant/ask Ask a questionRuns the prompt against the tenant's data via grounded tools and returns the answer, its citations and tool calls, and whether it was accepted. If citations do not pass the post-filter the answer is suppressed and a rejection reason is given. A write-oriented question may return a proposed write-intent id and summary instead of mutating data.
GET /api/v1/assistant/audit Recent assistant audit entriesRecent AI audit entries for the tenant, newest first, each capturing the prompt, tool calls, citations, whether citations passed, the answer or rejection reason, and latency.
GET /api/v1/assistant/conversations/{id}/audit Audit entries for one conversationAll audit entries for a single conversation, oldest first, so you can replay the exchange and its reasoning path.

AI settings 4 endpoints

GET /api/v1/ai-settings Get the AI configurationReturns the tenant's provider, model, endpoint, and flags. The API key is never returned, only whether one is set.
PUT /api/v1/ai-settings Save the AI configurationSaves provider, model, base URL, temperature, max tokens, and enabled flag. Omit apiKey to keep the stored key; send a new one to replace it. Returns the updated view (key still not returned).
GET /api/v1/ai-settings/providers List provider setup guidanceReturns, for each major AI provider, how to obtain an API key and the mode plus base URL to configure here.
POST /api/v1/ai-settings/test Test the AI configurationBuilds the client from the saved configuration and makes a minimal call against the provider, returning whether it succeeded.

Activity log 3 endpoints

GET /api/v1/logs Query the activity logReturns log entries for the tenant, most recent first, filtered by any combination of kind, actor, and free-text. An optional limit caps the result.
GET /api/v1/logs/export.csv Export the activity log as CSVExports the (filtered) activity log as a text/csv document: a portable, tamper-evident audit record. Same filters as the query endpoint, with no limit applied.
GET /api/v1/logs/integrity Verify the activity-log chainRecomputes every row's hash, chain linkage, and signature for the tenant and reports whether the chain is intact and where the first break is, if any.

Contacts 8 endpoints

GET /api/v1/contacts List contactsEach with a link count.
POST /api/v1/contacts Create a contactSlug derived from name. Emits contact.created.
GET /api/v1/contacts/for/{objectType}/{objectId} List contacts for an objectEach linked contact with its role.
DELETE /api/v1/contacts/{slug} Soft-delete a contactLinks removed; objects untouched. Emits contact.deleted.
GET /api/v1/contacts/{slug} Get one contact404 if unknown.
PATCH /api/v1/contacts/{slug} Update a contactEmits contact.updated.
DELETE /api/v1/contacts/{slug}/links Unlink a contactFor a given role. Emits contact-assignment.deleted.
POST /api/v1/contacts/{slug}/links Link a contact to an objectWith a role (admin|technical|billing|operational|on-call|other). Idempotent. Emits contact-assignment.created.

Custom fields 7 endpoints

GET /api/v1/custom-fields/{entityType} List field definitionsDefinitions for an entity type (device or location), ordered by label.
POST /api/v1/custom-fields/{entityType} Define a fieldCreate a field definition with a type and (for select/multiselect) choices. Emits custom-field.created.
GET /api/v1/custom-fields/{entityType}/values/{entityId} Get an object's custom-field valuesAll values set on one object, keyed by field key.
PUT /api/v1/custom-fields/{entityType}/values/{entityId}/{key} Set or clear a valueValidated against the field's type; null/blank clears it. Emits custom-field.updated.
DELETE /api/v1/custom-fields/{entityType}/{key} Delete a definitionEmits custom-field.deleted.
GET /api/v1/custom-fields/{entityType}/{key} Get one definition404 if unknown.
PATCH /api/v1/custom-fields/{entityType}/{key} Update a definitionLabel and choices are mutable; key, entityType, and type are not. Emits custom-field.updated.

Custom links 5 endpoints

GET /api/v1/custom-links List custom linksEvery custom link for the tenant.
POST /api/v1/custom-links Create a custom linkobjectType is device|location|circuit|all; urlTemplate may contain {{var}} tokens.
GET /api/v1/custom-links/resolve Resolve links for an objectReturns the links that apply to an object with their templates filled. Pass objectType plus any
DELETE /api/v1/custom-links/{id} Soft-delete a custom linkRemoves the link; no object is affected.
PUT /api/v1/custom-links/{id} Update a custom linkReplace a link's fields.

Customers 10 endpoints

GET /api/v1/customers List customersReturns every active customer for the tenant, each with its group slug and a count of owned objects.
POST /api/v1/customers Create a customerSlug must be unique within the tenant. An optional groupSlug nests the customer under an existing group. Emits customer.created.
GET /api/v1/customers/groups List customer groupsReturns the tenant's customer groups.
POST /api/v1/customers/groups Create a customer groupGroups are a one-level grouping for customers. Emits customer-group.created.
DELETE /api/v1/customers/groups/{slug} Delete a customer groupMembers are detached (set group-less), not deleted. Emits customer-group.deleted.
DELETE /api/v1/customers/{slug} Soft-delete a customerReleases the customer's ownership assignments; the owned objects themselves are untouched. Emits customer.deleted.
GET /api/v1/customers/{slug} Get one customer with what it ownsReturns the customer plus the list of objects it owns as (objectType, objectRef) pairs. 404 if the slug is unknown.
PATCH /api/v1/customers/{slug} Update a customerChange name, group, or description. Emits customer.updated.
GET /api/v1/customers/{slug}/owns List objects a customer ownsReturns the (objectType, objectRef) pairs the customer owns.
POST /api/v1/customers/{slug}/owns Assign an object to a customerRecords (or reassigns) ownership. objectType is one of device|prefix|circuit|vlan|location|ip-space. One owner per object. Emits customer.updated.

Event audit 3 endpoints

GET /api/v1/audit/events Recent eventsRecent events for the tenant, newest first. Optionally filter by kind; the underlying scan window is widened (at least 500 rows) so even an infrequent kind still fills the limit when matches exist.
DELETE /api/v1/audit/events/purge Purge old eventsManually drops audit rows older than the supplied retention horizon. Tenant-agnostic admin op; returns how many rows were dropped.
GET /api/v1/audit/events/verify Verify the audit chainRecomputes each row's content hash, chain linkage, and HMAC signature for the tenant and returns the first break, if any.

Export templates 6 endpoints

GET /api/v1/export-templates List templatesEvery template for the tenant.
POST /api/v1/export-templates Create a templateEmits export-template.created.
DELETE /api/v1/export-templates/{slug} Soft-delete a templateEmits export-template.deleted.
GET /api/v1/export-templates/{slug} Get one template404 if unknown.
PATCH /api/v1/export-templates/{slug} Update a templateEmits export-template.updated.
GET /api/v1/export-templates/{slug}/render Render a templateRender the saved template over current tenant data; returns text/csv or application/json per the template's format.

Management ranges 3 endpoints

GET /api/v1/scan-ranges List rangesEvery management range with its CIDR, label, credential and host count.
POST /api/v1/scan-ranges Add a rangeAdd a CIDR subnet for discovery to scan.
DELETE /api/v1/scan-ranges/{slug} Remove a rangeRemoves a range by slug.

Report subscriptions 5 endpoints

GET /api/v1/report-subscriptions List scheduled-report subscriptionsEvery subscription for the tenant, with its report slug, recipients, interval, enabled flag, and last-run time.
POST /api/v1/report-subscriptions Create a scheduled-report subscriptionSchedules a report (by slug) to run every intervalMinutes and email its result to the recipients. Returns 201.
DELETE /api/v1/report-subscriptions/{id} Delete a subscriptionRemoves the subscription so it no longer runs. Returns 204.
POST /api/v1/report-subscriptions/{id}/enabled Enable or disable a subscriptionToggles whether the scheduler runs this subscription. Returns 204.
POST /api/v1/report-subscriptions/{id}/run Run and deliver nowRuns the subscription's report immediately and attempts delivery. Returns whether email was actually sent (vs. only logged when no SMTP is configured).

Reports 3 endpoints

GET /api/v1/reports List the built-in report catalogReturns every report definition the product ships, each with its slug, title, and description.
GET /api/v1/reports/{slug} Get one report definitionReturns the definition (slug, title, description, parameter spec) for a single report. 404 if the slug is unknown.
GET /api/v1/reports/{slug}/run Run a reportExecutes the report against current tenant data and returns columns, rows, and run metadata. 404 if the slug is unknown.

SMTP settings 3 endpoints

GET /api/v1/smtp-settings Get the SMTP configurationReturns the tenant's host, port, username, from-address, TLS, and enabled flag. The password is never returned, only whether one is set.
PUT /api/v1/smtp-settings Save the SMTP configurationSaves host, port (default 587), username, from-address, TLS (default on), and enabled flag. Omit password to keep the stored one. Returns the updated view (password still not returned).
POST /api/v1/smtp-settings/test Send a test emailSends a test email to the given address to verify the SMTP configuration. Returns whether it was actually sent or only logged (no SMTP configured).

Saved filters 5 endpoints

GET /api/v1/saved-filters List saved filtersEvery saved filter, or scope to one view with ?target.
POST /api/v1/saved-filters Create a saved filterEmits saved-filter.created.
DELETE /api/v1/saved-filters/{slug} Soft-delete a saved filterEmits saved-filter.deleted.
GET /api/v1/saved-filters/{slug} Get one saved filter404 if unknown.
PATCH /api/v1/saved-filters/{slug} Update a saved filterEmits saved-filter.updated.

Saved queries 7 endpoints

GET /api/v1/saved-queries List saved queriesEvery saved query for the tenant, each with its base report slug and stored params JSON.
POST /api/v1/saved-queries Create a saved queryBinds a base report slug to a set of params under a tenant-unique slug. Returns 201 with a Location header.
POST /api/v1/saved-queries/cleanup Remove orphaned saved queriesSoft-deletes saved queries whose base report is no longer in the catalog. Returns how many were removed.
DELETE /api/v1/saved-queries/{slug} Soft-delete a saved queryMarks the saved query deleted. Returns 204.
GET /api/v1/saved-queries/{slug} Get one saved queryReturns the saved query by slug. 404 if unknown.
PATCH /api/v1/saved-queries/{slug} Update a saved querySparse update: omit params to leave them unchanged, send {} to clear them. Name and description are also editable.
GET /api/v1/saved-queries/{slug}/run Run a saved queryApplies the saved params over the base report and returns columns, rows, and run metadata. 404 if unknown.

Search 1 endpoint

GET /api/v1/search Substring search across primary entitiesMatches the query against slug, name, and CID across devices, locations, prefixes, VLANs,

Stats 1 endpoint

GET /api/v1/stats Tenant inventory snapshotReturns inventory counts for the tenant grouped into catalog, operational, IPAM, and connectivity sections.

Tags 8 endpoints

GET /api/v1/tags List tagsEach with an assignment count.
POST /api/v1/tags Create a tagSlug derived from name; color defaults. Emits tag.created.
DELETE /api/v1/tags/{slug} Soft-delete a tagEmits tag.deleted.
GET /api/v1/tags/{slug} Get one tag404 if unknown.
PATCH /api/v1/tags/{slug} Update a tagEmits tag.updated.
DELETE /api/v1/tags/{slug}/objects Detach a tag from an objectEmits tag-assignment.deleted.
GET /api/v1/tags/{slug}/objects List objects carrying a tagObject ids of a given type that carry the tag.
POST /api/v1/tags/{slug}/objects Attach a tag to an objectIdempotent. Emits tag-assignment.created.

Webhooks (REST management) 11 endpoints

GET /api/v1/webhooks List webhook subscriptionsEvery subscription for the tenant. The secret is omitted (empty string) on every read.
POST /api/v1/webhooks Create a subscriptionRegisters a target URL and event-kind filter. The response carries the shared secret ONCE; record it before discarding because subsequent reads blank it out. If you omit secret, one is generated. Returns 201 with a Location header.
GET /api/v1/webhooks/deliveries Recent deliveries across the tenantRecent delivery attempts across every subscription in this tenant, each with attempt number, success flag, HTTP status, note, and timestamps.
DELETE /api/v1/webhooks/deliveries/purge Purge old delivery rowsManually drops webhook delivery audit rows older than the supplied retention horizon. Tenant-agnostic admin op; returns how many rows were dropped.
GET /api/v1/webhooks/pending-retries Retry queue snapshotA snapshot of the durable retry queue for this tenant: the count of armed retries and the next fire time. Use the list endpoint for the full set.
GET /api/v1/webhooks/pending-retries/list Full pending-retry listThe full pending-retry list for this tenant, in fire order, each with its subscription, event kind, next attempt number, and next retry time.
DELETE /api/v1/webhooks/{id} Soft-delete a subscriptionStops further deliveries. Returns 204.
GET /api/v1/webhooks/{id} Get one subscriptionReturns the subscription by id, with the secret omitted (empty string). 404 if unknown.
PATCH /api/v1/webhooks/{id} Update a subscriptionSparse update: omit a field to leave it unchanged. You can change the URL, event-kind filter, enabled flag, description, or rotate the secret.
GET /api/v1/webhooks/{id}/deliveries Recent deliveries for one subscriptionRecent delivery attempts for a single subscription, newest first.
POST /api/v1/webhooks/{id}/test-fire Fire a synthetic test eventSubmits a synthetic TestEvent.Fired event to this subscription so you can confirm the endpoint and signing end to end. It lands in the delivery audit like any real event. Returns 202 Accepted with the submitted body. 404 if the subscription is unknown.

Write intents (AI-proposed changes) 12 endpoints

GET /api/v1/write-intents List intentsDefaults to pending intents only; pass all=true for the full history. Each carries kind, summary, status, and payload.
POST /api/v1/write-intents/device-create Propose a device createProposes a DEVICE_CREATE intent. Nothing is mutated until confirmed. Returns 201 with a Location header.
POST /api/v1/write-intents/device-rename Propose a device renameProposes a DEVICE_RENAME intent. Nothing is mutated until confirmed.
POST /api/v1/write-intents/device-set-location Propose a device set-locationProposes a DEVICE_SET_LOCATION intent. Send a null locationSlug to clear the device's location. Nothing is mutated until confirmed.
POST /api/v1/write-intents/interface-set-enabled Propose an interface enable/disableProposes an INTERFACE_SET_ENABLED intent. Pass enabled=true or false. Nothing is mutated until confirmed.
POST /api/v1/write-intents/location-create Propose a location createProposes a LOCATION_CREATE intent. Defaults kind to 'site' when not set. Nothing is mutated until confirmed.
POST /api/v1/write-intents/location-rename Propose a location renameProposes a LOCATION_RENAME intent. Nothing is mutated until confirmed.
POST /api/v1/write-intents/vendor-create Propose a vendor createProposes a VENDOR_CREATE intent. Nothing is mutated until confirmed.
POST /api/v1/write-intents/vendor-rename Propose a vendor renameProposes a VENDOR_RENAME intent. Nothing is mutated until confirmed.
GET /api/v1/write-intents/{id} Get one intentReturns the full intent, including its payload JSON and (once applied) the prior values captured. 404 if unknown.
POST /api/v1/write-intents/{id}/cancel Cancel an intentDismisses the intent without applying anything. An optional reason is recorded.
POST /api/v1/write-intents/{id}/confirm Confirm and apply an intentConfirms and executes the intent atomically, capturing prior values for the audit log. Returns the updated intent.

Config contexts 6 endpoints

GET /api/v1/config-contexts List contextsList config contexts for the tenant.
POST /api/v1/config-contexts Create a contextCreate a config context (name, weight, JSON data, optional location/status/device scopes).
GET /api/v1/config-contexts/matching/{deviceSlug} Matching contextsList the config contexts that apply to one device.
GET /api/v1/config-contexts/render/{deviceSlug} Render for a deviceRender the merged config-context JSON for one device (its applicable contexts, by weight).
DELETE /api/v1/config-contexts/{slug} Delete a contextDelete a config context.
PUT /api/v1/config-contexts/{slug} Update a contextUpdate a config context.

Data sources 5 endpoints

GET /api/v1/data-sources List sourcesList data sources for the tenant.
POST /api/v1/data-sources Create a sourceCreate a data source (name, kind, location, optional branch).
DELETE /api/v1/data-sources/{slug} Delete a sourceDelete a data source.
PUT /api/v1/data-sources/{slug}/git-auth Set Git authSet the Git authentication for a source (method, SSH username, host fingerprint, credential).
POST /api/v1/data-sources/{slug}/sync Sync nowTrigger a sync of this source into config contexts.

Event rules 4 endpoints

GET /api/v1/event-rules List rulesList event rules for the tenant.
POST /api/v1/event-rules Create a ruleCreate an event rule (name, metric, op, threshold, action, actionTarget).
DELETE /api/v1/event-rules/{id} Delete a ruleDelete an event rule.
PATCH /api/v1/event-rules/{id}/enabled Enable or disableEnable or disable a rule.

First-run setup 3 endpoints

POST /api/v1/setup/grade Grade the environment before installingAssesses the intended deployment and returns findings and weak spots (the same pre-install
POST /api/v1/setup/install Install (idempotent)Runs the install steps and creates the first admin atomically, returning each step's result
GET /api/v1/setup/status Is first-run complete?Whether the instance has been initialized. Safe to poll from a readiness probe.

Trace export 2 endpoints

GET /api/v1/admin/trace-export Current stateWhether trace export is on, the configured OTLP endpoint, and when it last changed.
PUT /api/v1/admin/trace-export Turn on/offSet trace export on or off (body {"enabled": true|false}); applies immediately and is

CrossConnect reference.

Webhook events 8

Aruba Digital Twin 4 endpoints

Blast radius 1 endpoint

Compliance matrix 3 endpoints

Faraday 7 endpoints

Fix plan 1 endpoint

Flow assurance 2 endpoints

Network Black Box 1 endpoint

Operational maturity 1 endpoint

Room readiness 3 endpoints

Segmentation 1 endpoint

Threat detection 2 endpoints

Tinker Bell 2 endpoints

Wargame 2 endpoints

Cables 8 endpoints

Circuits 13 endpoints

Console access 8 endpoints

Endpoints 2 endpoints

FHRP groups 8 endpoints

L2VPN 8 endpoints

Multicast 7 endpoints

Network atlas 6 endpoints

Providers 9 endpoints

Reconciliation 4 endpoints

Relationships 1 endpoint

Routing fabric 1 endpoint

Topology graph & stats 6 endpoints

Topology tracing 2 endpoints

Traffic flows 3 endpoints

Tunnels 8 endpoints

Discovery IPs 1 endpoint

Discovery VLANs 1 endpoint

Discovery VRFs 1 endpoint

Discovery aggregates 1 endpoint

Discovery endpoints 1 endpoint

Discovery promotion 1 endpoint

Aggregates and RIRs 9 endpoints

DNS 6 endpoints

IP addresses 8 endpoints

IP spaces 9 endpoints

IPAM roles 5 endpoints

Prefixes 12 endpoints

VLANs 9 endpoints

VRFs 9 endpoints

Authentication 2 endpoints

OIDC SSO 2 endpoints

Tenants 5 endpoints

Users & RBAC 6 endpoints

Admin config 1 endpoint

Admin health 1 endpoint

Attachments 4 endpoints

Automation inventory 2 endpoints

DNS query-log ingest 1 endpoint

Demo seed 1 endpoint

Discovery runs 7 endpoints

Identity-log ingest 1 endpoint

Import jobs 8 endpoints

Inbound events 1 endpoint

Key rotation 5 endpoints

NetBox compatibility 1 endpoint

Plugins 3 endpoints

Prometheus metrics 1 endpoint

Version 1 endpoint

Credentials 2 endpoints

Inbound review 4 endpoints

Outbound sinks 3 endpoints

Device models 9 endpoints

Devices 10 endpoints

Interfaces 5 endpoints

Interfaces (bulk CSV) 2 endpoints

Locations 9 endpoints

Network services 8 endpoints

Power 12 endpoints

Racks 7 endpoints

Services 5 endpoints

Vendors 10 endpoints

Virtualization 13 endpoints

Iris 4 endpoints

Luminaire 2 endpoints