Two integration surfaces: syslog for the event stream, REST API for query and SOAR action.

Exchange a one-time issue code (from the dashboard) for a bearer token. Single-use; burns on first call.

$ curl -X POST https://api.cybriq.io/api/v1/auth/token \
    -H "Content-Type: application/json" \
    -d '{"issue_code": "ic_a1b2c3d4..."}'

{
  "token": "cbq_live_pk_5f8d...",
  "scope": ["events:read", "inventory:read"],
  "expires_at": "2026-08-09T00:00:00Z",
  "ip_allowlist": ["198.51.100.0/24"],
  "rotation_deadline": "2026-07-25T00:00:00Z"
}

Returns the calling token's scope and remaining validity. Use in integration startup-checks to fail fast if the token was narrowed or revoked.

Mints a successor token with identical scope and allowlist. Old token remains valid for 24 hours to give you a deploy window.

List every observed device. Filters: site, vlan, vendor, ndaa_status, first_seen_after, last_seen_before. Cursor-paginated.

GET /api/v1/inventory?ndaa_status=prohibited
Authorization: Bearer cbq_live_pk_5f8d...

{
  "devices": [
    {
      "device_dna": "dna_sha256:a3b1...",
      "site": "hq-bldg-1",
      "switch": "edge-sw-04",
      "port": "Gi0/12",
      "vendor": "Hikvision DS-2CD camera (NDAA Section 889)",
      "ndaa_status": "prohibited",
      "first_seen": "2026-03-21T08:14:00Z",
      "last_seen": "2026-05-09T14:00:00Z"
    }
  ],
  "next_cursor": null
}

Diff current inventory against a baseline timestamp. Returns added, removed, and changed devices. Powers the auditor's "what changed since last quarter" question without a spreadsheet.

$ curl -s "https://api.cybriq.io/api/v1/inventory/diff?baseline=2026-02-01T00:00:00Z" \
    -H "Authorization: Bearer cbq_live_pk_5f8d..."

{
  "baseline_at": "2026-02-01T00:00:00Z",
  "current_at":  "2026-05-10T17:30:00Z",
  "added":   [ { "port": "sw3-fl2/port-19", "device_dna": "dna:8c2e...", ... } ],
  "removed": [ { "port": "sw3-fl2/port-04", "device_dna": "dna:4f5c...", ... } ],
  "changed": [ { "port": "sw3-fl2/port-47", "from": "dna:7a4f...", "to": "dna:5b8e...", "similarity": 0.31 } ]
}

Lightweight count endpoint. Useful for dashboards and health checks.

Every drift event on every port across a site, chronological. Filters: site, switch, port, since, until.

$ curl -s "https://api.cybriq.io/api/v1/drift/by-port?site=hq-bldg-3&since=2026-05-01" \
    -H "Authorization: Bearer cbq_live_pk_5f8d..."

{
  "events": [
    {
      "event_id":     "evt_01HQ8M9N...",
      "event":        "device-substituted",
      "severity":     "high",
      "timestamp":    "2026-05-10T17:08:12Z",
      "port":         "sw3-fl2/port-47",
      "previous_dna": "dna:7a4f-1c91-...",
      "current_dna":  "dna:5b8e-2a4f-...",
      "similarity":   0.31,
      "mitre":        ["T1200", "T1556"],
      "controls":     ["PCI-4.0/12.5.1", "SOC2/CC6.1"]
    }
  ],
  "next_cursor": null
}

Drift events tied to a specific device fingerprint across its lifetime, including moves between ports.

Mark an event acknowledged. Body includes operator identity, reason, free-form note. Becomes part of the event's audit trail.

Suppress repeated events for a device-port pair for a stated duration. Logged in the audit trail. Requires events:write scope.

Hand off to Forescout for port quarantine. We don't quarantine ports ourselves; we ask Forescout to. Body specifies event ID and Forescout policy name. Returns Forescout's job ID. Requires soar-action scope and an active Forescout integration.

Same shape, Cisco ISE. Body specifies event ID and ISE authorization-policy name.