API Guide

Use /api for REST requests and the running server’s generated reference for endpoint schemas.

API responses, including errors and one-time credentials, use Cache-Control: no-store, private.

Authenticate with a PAT

Create a personal access token under Settings > Access Tokens, copy its one-time value, and send it as a bearer token:

curl --fail-with-body \
  -H 'Authorization: Bearer endura_pat_...' \
  https://team-server.example.com/api/pipelines

PATs inherit owner permissions. GET/HEAD require read capability; other methods require write, including validation/test/sync POSTs. Token creation, rotation, and deletion require interactive sign-in; privileged local tasks are separate.

Browser Authentication

Browser login carries the original route in returnTo, restored after username/password or OIDC authentication, including query and fragment. OIDC redirects use 303 See Other.

returnTo must be root-relative and at most 2,048 UTF-8 bytes. External/protocol-relative URLs, traversal, backslashes, repeated encoding, and /api or /authentication destinations are rejected; missing/unsafe values fall back to /dashboards. Username/password login is non-production only.

Username/password login, logout, and browser-session requests other than GET/HEAD/OPTIONS require exactly one Origin matching settings.tenant.base_url, regardless of CORS. Missing, malformed, duplicate, or nonmatching origins return 403.

Bearer-only requests may omit Origin; if supplied, CORS and origin rules apply.

Array Query Parameters

Repeat the bare key for an array filter:

?id=1&id=2

Literal id[]/id[0] work, but encoded brackets (%5B, %5D) in parameter names return 400. Repeated bare keys avoid client encoding issues.

Pagination

Paginated responses include filtered X-Total-Count. For log tailing, after=<record-id> instead returns up to 512 greater IDs ascending, with existing filters. It ignores page/size/ordering and omits total count. At 512 results, request again after the greatest returned ID.

Integration Runs and Statistics

Operators and Administrators can inspect CI/CD discovery run history through these endpoints:

Run triggers are manual, scheduled, create, and update. Outcomes are running, success, partial, failed, cancelled, and interrupted. A run stores at most 100 diagnostics and reports any additional count in omittedDiagnosticCount.

CI/CD integration responses expose lastSuccessfulRunAt, lastSuccessfulRunDuration, and lastSuccessfulRunScope. Pipeline assignment filtering uses repeated policyAssignment=assigned or policyAssignment=unassigned query parameters and is independent of runtime protection status.

Dashboard clients use GET /api/stats/security-posture for the current internally consistent security-posture calculation. Historical latest-build violation points are available from GET /api/stats/latest-build-violations.

Runtime Sensor Endpoints

Build heartbeats, deployment/workload/violation ingest, /sensors/current/*, and /sensors/logs require Sensor JWTs, as marked in the reference. Sessions/PATs cannot call them.

Sensor-token rotation immediately invalidates earlier generations with 401.

Error Responses

Database outages cause 503 database unavailable across /api except /api/version. Detection waits five seconds between completed probes, plus probe duration; database-dependent requests can fail earlier. Readiness includes dependencies; process health does not.