Base URL
Authentication
All API requests (except health check) require authentication via an API key in theX-API-Key header:
Response Format
All responses are JSON. Successful responses return a2xx status code. Errors return 4xx or 5xx with a JSON body:
Pagination
List endpoints return paginated results wrapped in apagination object:
limit and offset query parameters to page through results.
Common Status Codes
| Code | Meaning |
|---|---|
200 | Success |
201 | Created |
204 | No content (successful update/delete) |
400 | Bad request — check your parameters |
401 | Unauthorized — invalid or missing API key |
403 | Forbidden — valid key but insufficient permissions |
404 | Not found |
429 | Rate limited — slow down |
500 | Internal server error |
Rate Limiting
API requests are rate limited per organization. Rate limit headers are included in every response:Endpoints
| Group | Description |
|---|---|
| Authentication | API key management and auth details |
| Agents | List and manage registered agents |
| Events | Query security and LLM events |
| Sessions | List and retrieve session recordings |
| Policies | Read and update security policies |