docs / reference/api

API reference

Every endpoint of the cloud control plane.

Authentication

Bearer token in the Authorization header. Project API key is the only credential type. Keys are bcrypt-hashed at rest; ekmire never stores the plaintext.

Authorization: Bearer <your-project-api-key>

Events endpoints

List, filter, and fetch events. Pagination via cursor.

GET   /v1/events                        # list events (filter by severity, source, rule_id)
GET   /v1/events/:id                    # single event
POST  /v1/events                        # ingest events (CLI/proxy)
PATCH /v1/events/:id/false-positive     # mark false positive
GET   /v1/events/stats                  # aggregated stats (by severity, source, rule, day)
GET   /v1/events/export                 # NDJSON or CSV export (Pro/Team only)

Rules endpoints

Fetch the current signed rule bundle.

GET /v1/rules/bundle/current    # current bundle (version, rules, signature)

Rate limits

1,000 req/min per project on Free, 10,000/min on Pro, unlimited on Team. Rate limit headers are returned on every response: X-RateLimit-Remaining, X-RateLimit-Reset.

Event types