ALLOD API 1.0.0 - API Reference

SWG - System

Health check and metrics endpoints.

GET /api/metrics Prometheus-compatible metrics

Responses

200 Text/plain metric lines

GET /api/health Health check

Responses

200 Server is healthy

GET /api/admin/setup Get initial setup state

Returns whether initial setup has been completed and what steps remain.

Responses

200 Setup state object

POST /api/admin/setup Complete initial setup step

Request Body *

application/json

object

Responses

200 OK

GET /api/admin/log-level Get current log level

Responses

200 JSON with level field (debug, info, warn, error)

PUT /api/admin/log-level Set log level at runtime

Request Body *

application/json

object

level * string enum: debug | info | warn | error

Responses

200 OK

POST /api/admin/license/sync Sync license with license server

Forces an immediate sync of the license and catalog data from allodlicense.

Responses

200 Sync result with license details

GET /api/admin/license-settings Get license server settings

Responses

200 License settings object (token redacted)

PUT /api/admin/license-settings Update license server settings

Request Body *

application/json

object

license_server_url string

license_token string

Responses

200 OK

GET /api/admin/integrations-config Get integrations configuration

Responses

200 Integrations config object

PUT /api/admin/integrations-config Update integrations configuration

Request Body *

application/json

object

Responses

200 OK

GET /api/admin/debug-bundle Download debug bundle

Generates and streams a ZIP archive containing logs, config (secrets redacted), and diagnostic info for support.

Responses

200 ZIP archive (application/zip)

SWG - Firewall

Firewall rules, default policy and domain allow/deny management.

GET /api/admin/firewall/rules List firewall rules

Responses

200 Array of rule objects

PUT /api/admin/firewall/rules Replace all firewall rules

Request Body *

application/json

object

default_tls_inspection boolean

rules array

Responses

204 Saved

GET /api/admin/firewall Get firewall state (default policy, default TLS inspection, rules)

Responses

200 JSON with default_policy, default_tls_inspection and rules

PATCH /api/admin/firewall Update default firewall settings

Request Body *

application/json

object

default_policy string enum: allow | deny

default_tls_inspection boolean

Responses

200 Updated

SWG - DLP

Data Loss Prevention - events, configuration, body samples.

GET /api/dlp/s3config Get S3 storage configuration for DLP body samples

Responses

200 S3 config object (secret_key redacted)

PUT /api/dlp/s3config Update S3 storage configuration

Request Body *

application/json

object

access_key string

bucket string

enabled boolean

endpoint string

prefix string

region string

retention_days integer

secret_key string

Responses

200 OK

GET /api/dlp/events List DLP events

Cursor-paginated list of DLP upload/download events.

Parameters

Name	In	Type
before	query	string(date-time)
before_id	query	string
limit	query	integer

Responses

200 JSON with events array, has_more, next_before, next_before_id

GET /api/dlp/config Get DLP configuration

Responses

200 DLP config with mode, action, rules, keyword_lists, post_detection_window

PUT /api/dlp/config Replace DLP configuration

Request Body *

application/json

object

Responses

204 Saved

POST /api/agent/screenshot-event Report screenshot content for DLP (agent → server)

Called by the agent when a screenshot is taken while the device has an active sensitive-context resource (ZTNA/DAM). ocr_text is matched against DLP rules; the event is dropped (not stored) when no sensitive context is active. process/window_title (the foreground window at the moment of capture) are best-effort and may be empty on a headless session. The domain the device was browsing (host/domain_category) is attached server-side from the navigation heatmap, not sent by the agent. Also covers screenshots that never touch disk - a capture pasted straight to the clipboard (PrtScn, Cmd+Ctrl+Shift+3/4) is reported the same way, with path empty and filename set to the synthetic "clipboard-image.png".

Request Body *

application/json

object

device_id * string

filename * string - Screenshot filename, or the synthetic "clipboard-image.png" for a clipboard-only capture (there's no real file to name).

ocr_text string

path string - On-disk path of the screenshot file. Empty for a clipboard-only capture that was never saved as a file.

process string - Foreground window's process/app name at screenshot time (best-effort)

sha256 string

user string

window_title string - Foreground window's title, or browser tab URL when the app is a known browser (best-effort)

Responses

200 JSON with action ("alert", "block", or "dropped") and event_id (empty when dropped). On "block" (ocr_text matched a block-severity DLP rule), the agent removes the artifact - deleting the file, or clearing the clipboard for a clipboard-only capture, since there's nothing on disk to remove.

GET /api/dlp/events/{id}/content Retrieve stored body sample for a DLP event

Fetches the body sample from S3 and streams it inline, decompressing gzip/zstd/deflate automatically.

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Body sample (Content-Type reflects the original transfer)

404 Event not found or no stored content

SWG - CASB

Cloud Access Security Broker - shadow IT, app usage, tenant discovery.

GET /api/casb/v1/shadow-it Shadow IT report - license-server authenticated

Same as /api/casb/shadow-it but authenticated with a license-bearer token rather than an API key. Used by the allodlicense server to aggregate cross-deployment analytics.

Parameters

Name	In	Type	Description
days	query	integer
limit	query	integer

Responses

200 Shadow IT report

GET /api/casb/v1/internal-domains Uncatalogued internal-domain discovery - license-server authenticated

Returns hosts observed in the last 30 days that fall under the configured internal DNS zone and have no saascat catalog match - internal tools (e.g. a self-hosted git server) that shadow-IT detection can't see because they aren't SaaS apps. Matching is DNS-zone-based, not IP/CIDR-based, to avoid ever matching a private IP range an employee's home network happens to reuse. Consumed by Allod DAM's swgsync poller for asset discovery.

Responses

200 Object with since (RFC3339) and domains (array of per-host traffic summaries)

GET /api/casb/v1/app-usage App usage aggregates - license-server authenticated

Returns per-app traffic aggregates for the last 30 days. Authenticated with a license-bearer token.

Responses

200 Array of app usage objects

GET /api/casb/tenants Discovered cloud tenants

Returns tenant identifiers extracted from proxied traffic, grouped by cloud app.

Parameters

Name	In	Type	Description
days	query	integer

Responses

200 Array of {app_id, tenant, last_seen, user_count} objects

GET /api/casb/shared-accounts Shared (non-IdP) accounts

Returns non-IdP accounts used by more than two distinct people across devices, aggregated from tenant sightings - a shadow-IT and credential-sharing signal.

Responses

200 Array of {AppID, AppName, Tenant, DistinctUsers, Users, DeviceCount, LastSeen} objects

GET /api/casb/shadow-it Shadow IT report - discovered cloud services

Parameters

Name	In	Type	Description
days	query	integer
limit	query	integer

Responses

200 Array of discovered service objects with app, category, bytes, users

GET /api/casb/processes Process-level CASB observations

Returns SaaS traffic broken down by originating process name (where available from agent UID lookup).

Parameters

Name	In	Type	Description
days	query	integer

Responses

200 Array of {process, app_id, bytes, requests} objects

GET /api/casb/firewall-log CASB-enriched firewall block log

Parameters

Name	In	Type	Description
days	query	integer
limit	query	integer

Responses

200 Array of firewall block events with CASB app metadata

GET /api/casb/coverage CASB coverage breakdown by traffic bucket

Returns connection counts for the last 30 days split by inspection category (managed SaaS, unmanaged SaaS, unknown).

Responses

200 Coverage object with bucket counts

GET /api/casb/corporate-it Corporate IT (managed) app usage

Parameters

Name	In	Type	Description
days	query	integer
limit	query	integer

Responses

200 Array of managed app usage objects

GET /api/casb/config Get CASB configuration

Responses

200 CASB config object

PUT /api/casb/config Update CASB configuration

Request Body *

application/json

object

Responses

200 OK

SWG - ZTNA

Zero Trust Network Access settings.

GET /api/tunnel Agent reverse tunnel WebSocket (agent → server)

WebSocket upgrade for reverse tunnels. Agent registers the local ports it listens on (e.g. debug port). On-prem processes can then connect back to agent localhost through the connector hub.

Responses

101 Switching Protocols

GET /api/connector Connector daemon WebSocket (connector → server)

WebSocket upgrade for on-prem connector daemons. After upgrade, connector sends a register message with its name and the CIDRs it can reach. The hub then routes proxy connections for those CIDRs through the connector. Protocol: JSON control frames + binary data frames with uint32 conn_id prefix.

Responses

101 Switching Protocols

GET /api/admin/ztna-settings Get ZTNA settings

Responses

200 JSON with access_routes array and virtual_subnet CIDR

PUT /api/admin/ztna-settings Update ZTNA settings

Request Body *

application/json

object

access_routes string[] - CIDRs pushed to agents for transparent proxy interception

string[] - CIDRs pushed to agents for transparent proxy interception

items

string

virtual_subnet string - CIDR for device virtual IPs

Responses

200 OK

SWG - Access

Step-up SSO and just-in-time access requests - approval workflow and self-service resource discovery.

GET /api/admin/access-requests List pending JIT access requests

Powers the Access Requests admin page. Requires an authenticated admin session - not currently available via X-Api-Key.

Responses

200 JSON with requests array (id, device_id, user, resource, justification, ttl, requested_at)

GET /api/access/resources List self-service resources available to a device

Powers the end-user self-service page for pre-provisioning a step-up SSO or JIT grant before opening a non-HTTP client. Requires an authenticated session - not currently available via X-Api-Key.

Parameters

Name	In	Type	Description
device_id *	query	string

Responses

200 JSON with resources array (kind, target, description, auth, jit_approval, sign_in_url)

POST /api/admin/access-requests/{id}/decide Approve or deny a pending JIT access request

Same decision path used by the Slack, Teams, and PagerDuty approval buttons. Requires an authenticated admin session - not currently available via X-Api-Key.

Parameters

Name	In	Type	Description
id *	path	string

Request Body *

application/json

object

decision * string enum: approve | deny

Responses

200 Decision applied

404 Request not found or already decided

SWG - Events

Unified event log - firewall blocks and DLP events.

GET /api/events List events (DLP + firewall blocks)

Cursor-paginated event log. Returns DLP upload/download events and firewall block events.

Parameters

Name	In	Type	Description
before	query	string(date-time)	Cursor: timestamp of last event on previous page
before_id	query	string	Cursor: event_id tie-breaker
limit	query	integer
type	query	string

Responses

200 JSON with events array, has_more, next_before, next_before_id

POST /api/admin/event-store/test Test external event store connection

Responses

200 Connection test result

GET /api/admin/event-store Get external event store configuration

Returns configuration for the external event store (ClickHouse or compatible).

Responses

200 Event store config object (password redacted)

PUT /api/admin/event-store Update external event store configuration

Request Body *

application/json

object

dsn string

enabled boolean

Responses

200 OK

GET /api/admin/event-log-config Get structured event log sink configuration

Returns configuration for structured event log sinks: local file, Elastic Beats, syslog.

Responses

200 Event log config object

PUT /api/admin/event-log-config Update structured event log sink configuration

Request Body *

application/json

object

Responses

200 OK

GET /api/access-log Proxy access log

Returns recent proxy request log entries (all traffic, not just blocked/DLP). Cursor-paginated.

Parameters

Name	In	Type
before	query	string(date-time)
before_id	query	string
limit	query	integer
search	query	string

Responses

200 JSON with entries array, has_more, next_before, next_before_id

GET /api/events/{id} Get a single event by ID

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Event object

404 Not found

SWG - Devices

Enrolled agent devices and their status.

GET /api/admin/devices List enrolled devices

Responses

200 Array of device objects with device_id, name, platform, last_seen_at

GET /api/admin/device-locations Get device location data

Returns last-known geographic locations of enrolled devices derived from their IP addresses.

Responses

200 Array of {device_id, country, city, lat, lon, last_seen_at} objects

SWG - Agent

Agent lifecycle - enroll, heartbeat, config distribution, upgrade.

GET /api/ws Agent real-time WebSocket (agent → server)

WebSocket upgrade. Agents use this for real-time config pushes and DLP local-path enrichment. Requires Upgrade: websocket header.

Responses

101 Switching Protocols

POST /api/quic-metadata Report QUIC SNI metadata (agent → server)

Agents post SNI hostname observations gathered during QUIC downgrade mode so the proxy can log them for shadow-IT purposes.

Request Body *

application/json

object

entries array

Responses

204 Accepted

GET /api/mitm-cert Get per-hostname MITM certificate (agent → server)

Called by agents during TLS inspection to obtain a CA-signed leaf certificate for a given hostname. Returns PEM-encoded certificate and private key.

Parameters

Name	In	Type	Description
host *	query	string

Responses

200 JSON with cert and key PEM fields

POST /api/heartbeat Agent heartbeat (agent → server)

Sent periodically by enrolled agents. Response includes config push: block_quic, proxy_token, access_routes (CIDRs for transparent proxy), windivert_url (Windows only), and local_path_enabled.

Request Body *

application/json

object

compliance_ok boolean

compliance_output string

device_id * string

Responses

200 Config push payload

POST /api/enroll Enroll a device (agent → server)

Called by the allodswg agent on first run to register the device.

Request Body *

application/json

object

device_id * string

name string

platform string

Responses

200 Enrollment confirmed

GET /api/config Get proxy config for agent

Returns CA cert and proxy address for the agent to configure the OS proxy.

Responses

200 Config object

GET /api/agent/download Download agent binary for the current platform

Used by agents to self-update. Returns the binary for the requesting platform.

Responses

200 Binary file

404 No binary available for this platform

GET /api/admin/agent-versions List available agent binaries

Responses

200 Array of {filename, platform, version, size} objects

POST /api/admin/agent-upload Upload a new agent binary

Multipart upload. The binary filename must follow the pattern allodswg-agent-<platform>[.exe].

Request Body *

multipart/form-data

object

file string(binary)

Responses

200 JSON with filename, platform, version, sha256

POST /api/admin/agent-upgrade Trigger upgrade on all connected agents

Sends an upgrade command to all agents connected via WebSocket. Each agent will download the latest binary and restart.

Responses

200 JSON with count of agents signaled

POST /api/admin/agent-sync Push config to all connected agents

Broadcasts the current firewall rules, CA cert, and proxy settings to all agents connected via WebSocket.

Responses

200 JSON with count of agents notified

GET /api/agent/assets/{name} Download a platform asset (e.g. WinDivert)

Serves files from the controller assets directory. Used by Windows agents to auto-download WinDivert.dll and WinDivert64.sys on startup.

Parameters

Name	In	Type	Description
name *	path	string	Filename (alphanumeric, dots, hyphens, underscores only)

Responses

200 File contents

404 Asset not found

SWG - CA

Certificate Authority - TLS inspection cert and SCEP for MDM.

GET /scep SCEP endpoint for MDM CA distribution

Simple Certificate Enrollment Protocol (RFC 8894). MDMs use this to automatically fetch and install the proxy CA as a trusted root. Supports GetCACaps and GetCACert operations.

Parameters

Name	In	Type	Description
operation *	query	string

Responses

200 GetCACaps: plain-text capability list. GetCACert: DER-encoded CA certificate (application/x-x509-ca-cert).

400 Unsupported operation

503 CA not yet generated

POST /api/ca/regenerate Regenerate the CA certificate

Generates a new CA key and self-signed certificate. Pushes the new cert to all connected agents. Optional body fields override server-configured defaults.

Request Body

application/json

object

algorithm string enum: ecdsa-p256 | ecdsa-p384 | rsa-2048 | rsa-4096

ca_validity_days integer - CA cert validity in days (recommend ≥730 when using SCEP)

common_name string

country string - ISO 3166-1 alpha-2 country code

leaf_validity_days integer - Per-session leaf cert validity in days

locality string

organization string

province string

Responses

200 New CA info object

GET /api/ca-info Get CA certificate info

Returns metadata about the currently active CA certificate: algorithm, subject (CN, O, C, ST, L), validity period, and fingerprint.

Responses

200 CA info object

503 CA not yet generated

GET /api/ca-cert Download the allodswg CA certificate

PEM-encoded CA certificate. Add to OS/browser trust stores, or point MDM to the /scep endpoint for automatic distribution.

Responses

200 PEM certificate

SWG - Domains

Domain category classification and overrides.

GET /api/domain-classify Classify a domain

Parameters

Name	In	Type	Description
domain *	query	string

Responses

200 JSON with category and metadata

GET /api/categories List all domain categories

Returns the full list of domain category identifiers and their display names used by the firewall and domain classifier.

Responses

200 Array of {id, name} objects

GET /api/admin/domains/lookup Look up the category of a domain

Parameters

Name	In	Type	Description
domain *	query	string

Responses

200 JSON with domain, category, source, override fields

GET /api/admin/domains List domain category overrides

Responses

200 Array of override objects

POST /api/admin/domains Add a domain category override

Request Body *

application/json

object

category * string

domain * string

Responses

200 OK

DELETE /api/admin/domains Remove a domain category override

Parameters

Name	In	Type	Description
domain *	query	string

Responses

200 OK

SWG - Identity

OIDC SSO, SCIM sync, GDPR data export/erase.

GET /api/admin/scim/users List SCIM-synced users

Responses

200 Array of SCIM user objects

POST /api/admin/scim/test Test SCIM provider connection

Responses

200 Connection test result with user count

POST /api/admin/scim/sync Trigger a manual SCIM sync

Responses

200 Sync result

GET /api/admin/scim/groups List SCIM-synced groups

Responses

200 Array of SCIM group objects

GET /api/admin/scim-config Get SCIM identity provider configuration

Responses

200 SCIM config (token redacted)

PUT /api/admin/scim-config Update SCIM configuration

Request Body *

application/json

object

enabled boolean

tenant_id string

token string

Responses

200 OK

POST /api/admin/oidc-config/test Test OIDC provider connection

Attempts discovery and a client credentials check against the configured OIDC issuer.

Responses

200 Test result

GET /api/admin/oidc-config Get OIDC SSO configuration

Responses

200 OIDC config (client_secret redacted)

PUT /api/admin/oidc-config Update OIDC SSO configuration

Request Body *

application/json

object

client_id string

client_secret string

enabled boolean

issuer string

Responses

200 OK

SWG - Proxy

Proxy and GeoDNS configuration.

GET /api/admin/proxy-settings Get proxy settings

Responses

200 JSON with require_agent, quic_mode, quic_mode_unsupported, enable_h2, smtp_inspection

PUT /api/admin/proxy-settings Update proxy settings

Request Body *

application/json

object

enable_h2 boolean

quic_mode string - "inspect" is accepted but hidden from the admin UI and always treated as unsupported (see isQUICInspectUnsupported) - it doesn't achieve real QUIC inspection on any current platform, so it's substituted with quic_mode_unsupported's fallback for every agent enum: bypass | downgrade | inspect

quic_mode_unsupported string - Fallback used whenever quic_mode is "inspect" - which today is always, for every agent platform enum: downgrade | metadata

require_agent boolean

require_idp_user boolean

smtp_inspection boolean

Responses

200 OK

SWG - Compliance

Device compliance posture configuration.

GET /api/admin/compliance Get compliance config and per-device status

Responses

200 JSON with config and devices array

PUT /api/admin/compliance Update compliance config

Request Body *

application/json

object

Responses

204 Saved

SWG - Alerts

Alert configuration and test delivery.

GET /api/admin/syslog-config Get syslog/SIEM forwarding configuration

Responses

200 Syslog config object

PUT /api/admin/syslog-config Update syslog/SIEM forwarding configuration

Request Body *

application/json

object

address string - host:port of syslog receiver

enabled boolean

format string enum: rfc5424 | cef

protocol string enum: udp | tcp

Responses

200 OK

POST /api/admin/alerts/test Send a test alert

Responses

200 OK

GET /api/admin/alerts Get alert configuration

Responses

200 Alert config object (webhook URL, enabled actions)

PUT /api/admin/alerts Update alert configuration

Request Body *

application/json

object

Responses

200 OK

SWG - Keys

API key management for the SWG controller.

GET /api/admin/keys List API keys (incl. revoked)

Responses

200 Array of key objects (key value redacted)

POST /api/admin/keys Create a new API key

Request Body *

application/json

object

name * string

role string enum: superadmin | enrollment

Responses

201 Created key including plaintext value (shown once)

PATCH /api/admin/keys/{id}/unrevoke Un-revoke a previously revoked API key

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 OK

DELETE /api/admin/keys/{id}/permanent Permanently delete an API key

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 OK

DELETE /api/admin/keys/{id} Revoke an API key

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 OK

SWG - AI

AI translation and enrichment.

GET /api/ai/translate/available Check if AI translation is configured

Returns whether an AI provider is configured and the translation feature is enabled.

Responses

200 JSON with available boolean

POST /api/ai/translate Translate text via AI

Proxies a translation request to the configured AI provider (OpenAI-compatible). Used by the browser extension to translate page content.

Request Body *

application/json

object

target_language * string

text * string

Responses

200 JSON with translated text

503 AI translation not configured

GET /api/admin/ai-config Get AI configuration

Responses

200 AI config object (api_key redacted)

PUT /api/admin/ai-config Update AI configuration

Request Body *

application/json

object

api_key string

base_url string

enabled boolean

model string

provider string

Responses

200 OK

DAM - Systems

Vendor systems under governance - the core inventory of third-party SaaS/cloud services.

GET /api/v1/systems List systems

Responses

200 Array of system objects

POST /api/v1/systems Create a system

Responses

201 Created system object

GET /api/v1/systems/{id}/similar Find similar systems

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Array of similar system objects

GET /api/v1/systems/{id}/ropa Get RoPA entry

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 GDPR Article 30 Record of Processing Activities entry

PUT /api/v1/systems/{id}/ropa Update RoPA entry

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Updated RoPA entry

GET /api/v1/systems/{id}/probes Get probe results for a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Array of probe result objects (TLS, geo, SPF, MX, privacy policy, DPA, sanctions)

POST /api/v1/systems/{id}/probe-scan Trigger a full probe scan

Parameters

Name	In	Type	Description
id *	path	string

Responses

202 Scan queued

POST /api/v1/systems/{id}/oscal/import Import OSCAL component definition

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Import result

GET /api/v1/systems/{id} Get a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 System object

PUT /api/v1/systems/{id} Update a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Updated system object

DELETE /api/v1/systems/{id} Delete a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

204 Deleted

POST /api/v1/systems/{id}/probe-scan/{type} Trigger a single probe scan

Parameters

Name	In	Type	Description
id *	path	string
type *	path	string	Probe type, e.g. tls, geo, spf, mx, privacy, dpa, sanctions, gleif

Responses

202 Scan queued

DAM - Contacts

Vendor contacts and DPO information per system.

GET /api/v1/systems/{id}/contacts List contacts for a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Array of contact objects

POST /api/v1/systems/{id}/contacts Create or update a contact

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Contact object

PUT /api/v1/systems/{id}/contacts/{cid} Update a contact

Parameters

Name	In	Type	Description
cid *	path	string
id *	path	string

Responses

200 Updated contact object

DELETE /api/v1/systems/{id}/contacts/{cid} Delete a contact

Parameters

Name	In	Type	Description
cid *	path	string
id *	path	string

Responses

204 Deleted

DAM - Documents

Contracts, DPAs and other documents attached to a system.

GET /api/v1/systems/{id}/documents List documents for a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Array of document metadata objects

POST /api/v1/systems/{id}/documents Upload a document

Parameters

Name	In	Type	Description
id *	path	string

Responses

201 Document metadata object

DELETE /api/v1/systems/{id}/documents/{did} Delete a document

Parameters

Name	In	Type	Description
did *	path	string
id *	path	string

Responses

204 Deleted

DAM - Reviews

Privacy and security review workflows per system.

GET /api/v1/reviews List all reviews

Responses

200 Array of review objects

GET /api/v1/systems/{id}/reviews List reviews for a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Array of review objects

POST /api/v1/systems/{id}/reviews Create a review for a system

Parameters

Name	In	Type	Description
id *	path	string

Responses

201 Created review object

GET /api/v1/reviews/{id} Get a review

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Review object

PUT /api/v1/reviews/{id} Update a review

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Updated review object

DAM - Cycle Types

Review cycle definitions (e.g. Annual GDPR review).

GET /api/v1/cycle-types List cycle types

Responses

200 Array of cycle type objects

POST /api/v1/cycle-types Create a cycle type

Responses

201 Created cycle type object

GET /api/v1/cycle-types/{id} Get a cycle type

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Cycle type object

PUT /api/v1/cycle-types/{id} Update a cycle type

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Updated cycle type object

DELETE /api/v1/cycle-types/{id} Delete a cycle type

Parameters

Name	In	Type	Description
id *	path	string

Responses

204 Deleted

DAM - Classifications

Data classification levels (e.g. Public, Internal, Confidential).

GET /api/v1/classification List classification levels

Responses

200 Array of classification level objects

POST /api/v1/classification Create a classification level

Responses

201 Created classification object

PUT /api/v1/classification/{id} Update a classification level

Parameters

Name	In	Type	Description
id *	path	string

Responses

200 Updated classification object

DELETE /api/v1/classification/{id} Delete a classification level

Parameters

Name	In	Type	Description
id *	path	string

Responses

204 Deleted

DAM - Keys

API key management for the DAM.

GET /api/v1/keys List API keys

Responses

200 Array of API key objects (secret value redacted)

POST /api/v1/keys Create an API key

Responses

201 API key object including the one-time secret value

DELETE /api/v1/keys/{id} Delete an API key

Parameters

Name	In	Type	Description
id *	path	string

Responses

204 Deleted

DAM - Notifications

In-app notifications for governance events.

POST /api/v1/notifications/read-all Mark all notifications as read

Responses

204 All marked as read

GET /api/v1/notifications List notifications

Responses

200 Array of notification objects

POST /api/v1/notifications/{id}/read Mark a notification as read

Parameters

Name	In	Type	Description
id *	path	string

Responses

204 Marked as read

DAM - Identity

OIDC SSO and SCIM identity sync configuration.

GET /api/v1/scim/users List SCIM-synced users

Responses

200 Array of user objects from SCIM

GET /api/v1/scim/groups List SCIM-synced groups

Responses

200 Array of group objects from SCIM

GET /api/v1/admin/scim-push-config Get SCIM push (IdP → DAM) configuration

Responses

200 SCIM push config

PUT /api/v1/admin/scim-push-config Update SCIM push configuration

Responses

200 Updated config

POST /api/v1/admin/scim-pull-test Test SCIM pull connection

Responses

200 Connection test result

POST /api/v1/admin/scim-pull-sync Trigger a SCIM pull sync

Responses

202 Sync queued

GET /api/v1/admin/scim-pull-config Get SCIM pull (DAM → IdP) configuration

Responses

200 SCIM pull config

PUT /api/v1/admin/scim-pull-config Update SCIM pull configuration

Responses

200 Updated config

POST /api/v1/admin/oidc-config/test Test OIDC provider connection

Responses

200 Connection test result

GET /api/v1/admin/oidc-config Get OIDC SSO configuration

Responses

200 OIDC config object

PUT /api/v1/admin/oidc-config Update OIDC SSO configuration

Responses

200 Updated OIDC config

DAM - Admin

License, SWG integration, probe scans, OSCAL imports and vendor catalog.

POST /api/v1/probe-scan Trigger a full probe scan for all systems

Responses

202 Scan queued

POST /api/v1/oscal-scan Trigger a global OSCAL scan

Responses

202 Scan queued

GET /api/v1/intel-status Get intelligence data status

Returns status of GLEIF, EU sanctions list and other intelligence sources.

Responses

200 Intel status object

GET /api/v1/catalog Search SaaSCat vendor catalog

Parameters

Name	In	Type	Description
q	query	string	Search query

Responses

200 Array of catalog entries

GET /api/v1/approved-classifications List RoPA classification levels by saascat_id (SWG integration)

Called by allodswg to fold DAM-classified systems into its own sensitive-context detection. Only systems with a completed RoPA entry (a linked DataRecord with a classification set) are included - systems without one are simply absent from the map, not an error. Authenticated with the shared license key, not an admin API key.

Responses

200 Object mapping saascat_id to classification_level_id (e.g. public/internal/confidential/restricted), plus a count

GET /api/v1/approved-apps List approved apps (SWG integration)

Called by allodswg to fetch the approved-app list. Authenticated with the shared license key, not an admin API key.

Responses

200 Array of approved app domain entries

POST /api/v1/admin/swg-sync Trigger SWG shadow-IT sync

Responses

202 Sync queued

GET /api/v1/admin/swg-config Get SWG sync configuration

Responses

200 SWG sync config (endpoint + license key)

PUT /api/v1/admin/swg-config Update SWG sync configuration

Responses

200 Updated config

POST /api/v1/admin/license-refresh Refresh license status

Responses

200 Updated license status

ALLOD API

Servers

SWG - System

SWG - Firewall

SWG - DLP

SWG - CASB

SWG - ZTNA

SWG - Access

SWG - Events

SWG - Devices

SWG - Agent

SWG - CA

SWG - Domains

SWG - Identity

SWG - Proxy

SWG - Compliance

SWG - Alerts

SWG - Keys

SWG - AI

DAM - Systems

DAM - Contacts

DAM - Documents

DAM - Reviews

DAM - Cycle Types

DAM - Classifications

DAM - Keys

DAM - Notifications

DAM - Identity

DAM - Admin