ALLOD API

Returns whether initial setup has been completed and what steps remain.

Forces an immediate sync of the license and catalog data from allodlicense.

Generates and streams a ZIP archive containing logs, config (secrets redacted), and diagnostic info for support.

Returns whether IDS/IPS is enabled, every Source==custom rule individually, and a count+version summary for the curated URLhaus feed (never listed rule-by-rule - it can carry tens of thousands of entries).

Accepts raw Suricata .rules text (Content-Type: text/plain) or a multipart/form-data upload with field name "file", and replaces the entire Source==custom rule set. A malformed line is reported per-line in the response rather than failing the whole import.

The single on/off switch for Suricata rule evaluation (both custom rules and the curated feed). Off by default. Rules keep loading/refreshing regardless of this setting, so toggling it takes effect immediately with nothing to reload.

Overrides the effective action for one rule by Suricata sid, regardless of source. Uses this API's own block/alert/allow vocabulary (not Suricata's drop/alert/pass keywords).

Name	In	Type	Description
sid *	path	integer	The rule's Suricata sid

Custom-source only - a rule loaded from the curated URLhaus feed can't be deleted this way (the feed would just reload it on its next refresh); use PATCH with an "alert" override to silence a specific noisy URLhaus sid instead.

Name	In	Type	Description
sid *	path	integer

Cursor-paginated list of DLP upload/download events.

Name	In	Type	Description
before	query	string(date-time)
before_id	query	string
limit	query	integer

Called by the agent when a screenshot is taken while the device has an active sensitive-context resource (ZTNA/VRM). ocr_text is matched against DLP rules; the event is dropped (not stored) when no sensitive context is active. process/window_title (the foreground window at the moment of capture) are best-effort and may be empty on a headless session. The domain the device was browsing (host/domain_category) is attached server-side from the navigation heatmap, not sent by the agent. Also covers screenshots that never touch disk - a capture pasted straight to the clipboard (PrtScn, Cmd+Ctrl+Shift+3/4) is reported the same way, with path empty and filename set to the synthetic "clipboard-image.png".

Fetches the body sample from S3 and streams it inline, decompressing gzip/zstd/deflate automatically.

Name	In	Type	Description
id *	path	string

Same as /api/casb/shadow-it but authenticated with a license-bearer token rather than an API key. Used by the allodlicense server to aggregate cross-deployment analytics.

Name	In	Type	Description
days	query	integer
limit	query	integer

Returns hosts observed in the last 30 days that fall under the configured internal DNS zone and have no saascat catalog match - internal tools (e.g. a self-hosted git server) that shadow-IT detection can't see because they aren't SaaS apps. Matching is DNS-zone-based, not IP/CIDR-based, to avoid ever matching a private IP range an employee's home network happens to reuse. Consumed by Allod VRM's swgsync poller for asset discovery.

Returns per-app traffic aggregates for the last 30 days, including apps used only through desktop clients. Authenticated with a license-bearer token. Byte totals cover every source (browser and desktop/CLI) and match the Corporate IT view for the same app. BytesUp/BytesDown are wire bytes on the client connection (client to proxy / proxy to client, TLS overhead included) measured by the proxy for every connection, not just inspected ones.

Returns tenant identifiers extracted from proxied traffic, grouped by cloud app.

Name	In	Type	Description
days	query	integer

Returns non-IdP accounts used by more than two distinct people across devices, aggregated from tenant sightings - a shadow-IT and credential-sharing signal.

Name	In	Type	Description
days	query	integer
limit	query	integer

Returns network activity for the last 30 days broken down by originating (non-browser) process name, sorted by DevicePct (share of the fleet running that process) descending. Paginated - use limit/offset to page past the first window. BytesUp/BytesDown are wire bytes on the client connection (client to proxy / proxy to client, TLS overhead included) measured by the proxy for every connection, not just inspected ones.

Name	In	Type	Description
limit	query	integer
offset	query	integer

Name	In	Type	Description
days	query	integer
limit	query	integer

Returns per-extension connection activity for the last 30 days, aggregated from requests carrying an Origin: chrome-extension://... or moz-extension://... header (i.e. actually initiated by the extension's own script, not a page/user directly). Fleet-wide visibility into which extensions talk to the network, independent of whether any firewall extension_initiated rule exists. Sorted by DevicePct descending; paginated - use limit/offset to page past the first window. BytesUp/BytesDown are the request and response bytes of the extension-initiated requests.

Name	In	Type	Description
limit	query	integer
offset	query	integer

Returns connection counts for the last 30 days split by inspection category (managed SaaS, unmanaged SaaS, unknown).

Name	In	Type	Description
days	query	integer
limit	query	integer

WebSocket upgrade for reverse tunnels. Agent registers the local ports it listens on (e.g. debug port). On-prem processes can then connect back to agent localhost through the connector hub.

WebSocket upgrade for on-prem connector daemons. After upgrade, connector sends a register message with its name and the CIDRs it can reach. The hub then routes proxy connections for those CIDRs through the connector. Protocol: JSON control frames + binary data frames with uint32 conn_id prefix.

Powers the Access Requests admin page. Requires an authenticated admin session - not currently available via X-Api-Key.

Powers the end-user self-service page for pre-provisioning a step-up SSO or JIT grant before opening a non-HTTP client. Requires an authenticated session - not currently available via X-Api-Key.

Name	In	Type	Description
device_id *	query	string

Same decision path used by the Slack, Teams, and PagerDuty approval buttons. Requires an authenticated admin session - not currently available via X-Api-Key.

Name	In	Type	Description
id *	path	string

Cursor-paginated event log. Returns DLP upload/download events and firewall block events.

Name	In	Type	Description
before	query	string(date-time)	Cursor: timestamp of last event on previous page
before_id	query	string	Cursor: event_id tie-breaker
limit	query	integer
type	query	string

Returns the weight table behind Controller.ScoreEmailAuthenticity, keyed by signal name (e.g. display_name_mismatch). Used by the events admin UI to render a full per-signal score breakdown for a flagged email.

Returns configuration for the external event store (ClickHouse or compatible).

Returns configuration for structured event log sinks: local file, Elastic Beats, syslog.

Returns recent proxy request log entries (all traffic, not just blocked/DLP). Cursor-paginated.

Name	In	Type	Description
before	query	string(date-time)
before_id	query	string
limit	query	integer
search	query	string

Name	In	Type	Description
id *	path	string

Irreversibly deletes all events, access log entries, and device records associated with the given user.

Returns last-known geographic locations of enrolled devices derived from their IP addresses.

WebSocket upgrade. Agents use this for real-time config pushes and DLP local-path enrichment. Requires Upgrade: websocket header.

Agents post SNI hostname observations gathered during QUIC downgrade mode so the proxy can log them for shadow-IT purposes.

Called by agents during TLS inspection to obtain a CA-signed leaf certificate for a given hostname. Returns PEM-encoded certificate and private key.

Name	In	Type	Description
host *	query	string

Sent periodically by enrolled agents. Response includes config push: block_quic, proxy_token, access_routes (CIDRs for transparent proxy), windivert_url (Windows only), and local_path_enabled.

Called by the allodswg agent on first run to register the device.

Returns CA cert and proxy address for the agent to configure the OS proxy.

Used by agents to self-update. Returns the binary for the requesting platform.

Multipart upload. The binary filename must follow the pattern allodswg-agent-<platform>[.exe].

Sends an upgrade command to all agents connected via WebSocket. Each agent will download the latest binary and restart.

Broadcasts the current firewall rules, CA cert, and proxy settings to all agents connected via WebSocket.

Serves files from the controller assets directory. Used by Windows agents to auto-download WinDivert.dll and WinDivert64.sys on startup.

Name	In	Type	Description
name *	path	string	Filename (alphanumeric, dots, hyphens, underscores only)

Simple Certificate Enrollment Protocol (RFC 8894). MDMs use this to automatically fetch and install the proxy CA as a trusted root. Supports GetCACaps and GetCACert operations.

Name	In	Type	Description
operation *	query	string

Generates a new CA key and self-signed certificate. Pushes the new cert to all connected agents. Optional body fields override server-configured defaults.

Returns metadata about the currently active CA certificate: algorithm, subject (CN, O, C, ST, L), validity period, and fingerprint.

PEM-encoded CA certificate. Add to OS/browser trust stores, or point MDM to the /scep endpoint for automatic distribution.

Name	In	Type	Description
domain *	query	string

Returns the full list of domain category identifiers and their display names used by the firewall and domain classifier.

Name	In	Type	Description
domain *	query	string

Name	In	Type	Description
domain *	query	string

Attempts discovery and a client credentials check against the configured OIDC issuer.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Returns whether an AI provider is configured and the translation feature is enabled.

Proxies a translation request to the configured AI provider (OpenAI-compatible). Used by the browser extension to translate page content.

Admin only. Systems in use (not inactive, rejected or pending) and their providers; providers are ordered by how many critical (high or critical) systems depend on them. A provider used by at least 3 critical systems and at least half of them gets an organisation-wide auto:concentration:<provider> Risk.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Hosting, CDN, DNS and mail providers from the vendor probes, and sub-processors from the RoPA record and the DPA and privacy policy analyses, each mapped to the company behind it.

Name	In	Type	Description
id *	path	string

From the vendor's CSAF advisories, only the products that belong to this system: SBOM purl matches, plus product names matching csaf_products (or the system name when csaf_products is empty). Counts are distinct CVEs; one CVE can be in several buckets when it affects one product version and is fixed in another. updated_at is zero when the feed has never been crawled.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Partial update: fields left out keep their value. csaf_products (array of strings) lists the product names in the vendor's CSAF advisories that belong to this system; empty matches on the system name.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string
type *	path	string	Probe type, e.g. tls, geo, spf, mx, privacy, dpa, sanctions, gleif

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
cid *	path	string
id *	path	string

Name	In	Type	Description
cid *	path	string
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
did *	path	string
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Returns status of GLEIF, EU sanctions list and other intelligence sources.

Name	In	Type	Description
q	query	string	Search query

Called by allodswg to fold VRM-classified systems into its own sensitive-context detection. Only systems with a completed RoPA entry (a linked DataRecord with a classification set) are included - systems without one are simply absent from the map, not an error. Authenticated with the shared license key, not an admin API key.

Called by allodswg to fetch the approved-app list. Authenticated with the shared license key, not an admin API key.

Admin only. Each vendor with system_count and sovereignty_level, the lowest assessed level among its systems (omitted when none is assessed).

Admin only. Body: {name, website_domain, hq_country, ultimate_owner_country, privacy_policy_url, dpa_url, notes}; name is required.

Name	In	Type	Description
id *	path	string

Body: {"cycle_type_id", "due_date": "YYYY-MM-DD"}. The cycle type must be vendor-scoped; due_date defaults to the cycle interval from today.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Body: {"into": "<vendor id>"}. Moves systems, probes, contracts, contacts and reviews to the target vendor, keeps the merged name as an alias of it, and deletes the merged vendor.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Multipart form: file, label, doc_type. Requires docstorage.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Admin only. Replaces the vendor's fields with the body, same shape as create; fields left out are cleared. Systems that don't override a field show the new value.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Body: {"signer_email"}. Emails a one-time signing link when SMTP is configured. Requires docstorage.

Name	In	Type	Description
did *	path	string
id *	path	string

Name	In	Type	Description
cid *	path	string
id *	path	string

Name	In	Type	Description
cid *	path	string
id *	path	string

Admin only. Per vendor with a system in use: climate maturity (0-4), SBTi status, net-zero year, usage footprint (kgCO2e/month, Sustainable Web Design Model v4 from data transfer measured by SWG, or summed from firewall/SSE log byte counts when SWG has no fresh figure), annual spend in EUR and its emissions (vendor's own intensity, else the industry-average factor), and contracts without a known value. ?format=csv downloads it as CSV.

Name	In	Type	Description
format	query	string

Admin only. climate: the effective values (sources tells which came from the sustainability report and which were entered), score 0-4, supplier_factor (kgCO2e per EUR of revenue), and manual: the entered values. contracts: each in-force contract's annual cost in EUR.

Name	In	Type	Description
id *	path	string

Admin only. Body: {sbti_status: ""|committed|near_term|net_zero, net_zero_year, scope1, scope2, scope3 (tCO2e), reporting_year, renewable_share (0-1), revenue_eur, report_url, notes}. Each non-zero field overrides the sustainability report analysis.

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Admin only. Body: {amount, currency (ISO 4217), billing_period: month|year|once, term_months}. Overrides the value the contract analysis extracted; a one-off amount is spread over term_months.

Name	In	Type	Description
did *	path	string

Name	In	Type	Description
did *	path	string

Admin only. Body: {lei, name, country, entity_type, competent_authority, consolidated, currency, hierarchy, parent_lei, integration_date, total_assets, definitions: [19 texts for B_99.01]}. Enumerations take the EBA codes (e.g. eba_CT:x12), countries and currencies ISO codes.

Admin only. The register as the EBA plain-csv reporting package (taxonomy 4.0, DORA module DORA010100): a ZIP named LEI.CON|IND_Country_DORA010100_DORA_RefDate_Timestamp.zip with META-INF/reportPackage.json, reports/report.json, parameters.csv, FilingIndicators.csv and one CSV per template. Refused with 422 while a finding would make the ESAs reject the file; data quality findings do not block it.

Name	In	Type	Description
ref_date	query	string(date)

Admin only. register: every template (B_01.01-B_99.01) as rows of column codes (c0010...) with each value's source (manual, default, derived, contract, gleif, vendor, system) and the record it was built from. issues: findings of the validation (severity reject = the ESAs would refuse the file, error = data quality finding, warning). records: what was entered. suggestions: systems in use not in the register, vendors' sub-processors not in the supply chain. Also code_lists, templates (column types and keys), names, next_function_id and the reporting currency.

Name	In	Type	Description
ref_date	query	string(date)	Reference date, YYYY-MM-DD. Default: 31 December of the previous year.

Admin only. kind: entity (B_01.02), branch (B_01.03), provider (B_05.01; id = the vendor's id for one of allodvrm's vendors), arrangement (B_02.01-B_04.01; id = the reference number), service (B_02.02, B_07.01), function (B_06.01; id = F<n>), chain (B_05.02 rank 2+). Empty fields are prefilled when the register is built. Unknown fields are refused.

Name	In	Type	Description
id *	path	string
kind *	path	string

Name	In	Type	Description
id *	path	string
kind *	path	string

Runs in the background; poll GET /api/v1/admin/org-domains for the outcome.

Body: {"domain"}. Only confirmed domains are scanned; their SPF, MX, DMARC, DKIM, NS, CAA, SRV, TXT verification tokens and CT-logged subdomain CNAMEs become pending-triage systems.

The organisation's DNS records and Content-Security-Policy sources that still point at a decommissioning or inactive system's vendor, from the latest DNS discovery scan. hijackable marks a CSP script source whose domain is not registered.

Name	In	Type	Description
id *	path	string

Body: {"status": "confirmed" | "ignored" | "suggested"}.

Name	In	Type	Description
domain *	path	string

Name	In	Type	Description
domain *	path	string

Body: {"vendor", "label"}. The response is the only time the push token is returned.

Body: {"syslog_sources": [{"ip", "vendor", "label"}]}. Applied immediately. Push sources are not affected.

Authenticated by the push source's token, in the path or as Authorization: Bearer on POST /ingest/logs - not by an API key. Body: newline-delimited JSON, concatenated JSON objects or a JSON array, optionally gzip-compressed. Max 32 MiB as sent, 256 MiB decompressed; 600 requests per minute per IP.

Name	In	Type	Description
token *	path	string

Name	In	Type	Description
id *	path	string

Name	In	Type	Description
id *	path	string

Admin only. {sovereignty, dora}: each feature applies only to some organisations, so all are off until turned on. sovereignty is the EU Cloud Sovereignty Framework (CSF SEAL) assessment - its score, fields and auto-risks; dora is the DORA register of information. While DORA is off, every /api/v1/dora endpoint and the /dora page answer 404.

Admin only. Body: {feature: bool}; a feature left out keeps its state. Turning one off keeps its data. Turning sovereignty off closes its open auto-risks; turning it on again reopens those, while their condition holds.