# Console v1 API reference

Source snapshot: 23fdccfaa88f69e858769f1dad70f82739e2740f. Private evaluation.

Use OpenAPI: /docs/console-v1/openapi.json. Never send requests to the static documentation server.

## GET /health

Health. Public state-database reachability; not end-to-end pipeline qualification.

Authority: public. Response: Health.

## POST /api/v1/session

Sign in. Create an eight-hour opaque cookie session. Origin, CSRF and JSON required even before login.

Authority: public. Response: Session.
Request schema: Login.

## GET /api/v1/session

Current session. Resolve the server-assigned workspace and role.

Authority: session. Response: CurrentSession.

## DELETE /api/v1/session

Sign out. Revoke this individual session; Origin and CSRF required.

Authority: session. Response: Status.

## GET /api/v1/session/options

Evaluation registration options. Public configuration flag, not database health or production SaaS availability.

Authority: public. Response: SessionOptions.

## POST /api/v1/session/signup

Create isolated evaluation workspace. Disabled by default; 32-workspace cap. No caller-selected tenant/role. Generic workspace_creation_unavailable on duplicate username or cap.

Authority: public. Response: Session.
Request schema: Signup.

## GET /api/v1/overview

Workspace overview. Tenant-scoped counts and observed pipeline state. Inference is disabled.

Authority: session. Response: Overview.

## GET /api/v1/costs

Read cost snapshot. Operator only. Fixed configured snapshot, maximum 1 MiB. No provider/billing API calls; unavailable is not zero.

Authority: operator. Response: Costs.

## GET /api/v1/sources

List sources. Saved or receiving is not provider credential verification.

Authority: session. Response: SourceList.

## POST /api/v1/sources

Create scoped source. Persist configuration, not a connected-provider claim.

Authority: session. Response: Source.
Request schema: CreateSource.

## POST /api/v1/sources/{id}/preflight

Inspect source readiness. Schema and canary checks. Provider transports report external_worker_required and provider_verified:false.

Authority: session. Response: Preflight.

## POST /api/v1/sources/{id}/token

Rotate source token. Operator only. Returned once; previous token revoked. This response is a secret and must not be logged.

Authority: operator. Response: SourceToken.

## POST /api/v1/sources/{id}/ingest

Accept native records. Maximum 1000 records and 8 MiB request. HTTP 202 is durable inbox acceptance, not external sink completion. Poll operation status before acknowledging the source. CloudTrail Records wrapper is also accepted.

Authority: source. Response: IngestReceipt.
Request schema: Ingest.

## GET /api/v1/operations/{id}

Reconcile ingestion status. Source token is limited to operations belonging to its source and tenant. Acknowledge only committed, after inspecting lane receipts.

Authority: source. Response: Operation.

## POST /api/v1/events/query

Query hot events. Typed parameterized tenant-filtered ClickHouse; 500 rows, 31 days, five-second engine limit; no raw SQL.

Authority: session. Response: HotQueryResult.
Request schema: HotQuery.

## POST /api/v1/history/query

Query historical events. Authorized PyIceberg path. Only time/source/limit filters. Dependency failure is explicit, never silently served from hot data.

Authority: session. Response: HistoryQueryResult.
Request schema: HistoryQuery.

## GET /api/v1/events/{id}

Read retained evidence. Tenant-authorized OCSF and raw request bytes/provenance. Raw batch bytes can contain multiple records.

Authority: session. Response: Evidence.

## GET /api/v1/rules

List and reconcile rules. May reconcile observed Arroyo job state. Running is required for enabled; saved is not running.

Authority: session. Response: RuleList.

## POST /api/v1/rules/validate

Validate strict rule subset. Unsupported rule syntax returns valid:false; validation does not deploy.

Authority: session. Response: RuleValidation.
Request schema: RuleInput.

## POST /api/v1/rules

Create versioned rule. Persist validated rule; enabled:true additionally requests actual deployment.

Authority: session. Response: Rule.
Request schema: RuleInput.

## POST /api/v1/rules/{id}/enable

Enable rule pipeline. Durable intent and ambiguous-create reconciliation. Inspect status; do not blindly repeat an unknown create.

Authority: session. Response: Rule.

## POST /api/v1/rules/{id}/disable

Checkpoint-stop rule. Pending/unknown until observed terminal job state.

Authority: session. Response: Rule.

## GET /api/v1/alerts

List alerts. Durable rule matches, not proof of malicious activity.

Authority: session. Response: AlertList.

## GET /api/v1/alerts/{id}

Alert narrative and evidence. Deterministic facts, citations, uncertainty and review guidance; inference disabled.

Authority: session. Response: Alert.

## POST /api/v1/alerts/{id}/triage

Record human triage. Attribute disposition and note with audit.

Authority: session. Response: Alert.
Request schema: Triage.

## GET /api/v1/cases

List cases. Tenant-scoped local case state.

Authority: session. Response: CaseList.

## GET /api/v1/cases/{id}

Read case revision. Read current version before editing or approving a plan.

Authority: session. Response: Case.

## PATCH /api/v1/cases/{id}

Update case. Missing/stale expected_version returns 409. open↔investigating; open/investigating→closed; closed→open.

Authority: session. Response: Case.
Request schema: CasePatch.

## GET /api/v1/attack

Declared ATT&CK metadata. Candidate rule/alert metadata, not confirmed technique detection or full coverage.

Authority: session. Response: Attack.

## GET /api/v1/audit

Read application audit. Append-only application behavior; production tamper resistance needs separate qualification.

Authority: session. Response: AuditList.

## GET /api/v1/workflows

List case workflows. Local case-management workflows only.

Authority: session. Response: WorkflowList.

## POST /api/v1/workflows

Create typed workflow. One to twenty steps; only assignment, priority and note. No scripts, network URLs or cloud containment.

Authority: session. Response: Workflow.
Request schema: WorkflowInput.

## POST /api/v1/workflows/{id}/preview

Preview exact case plan. No case effects. Plan expires in ten minutes and binds case/workflow/policy versions and digest.

Authority: session. Response: Action.
Request schema: Preview.

## GET /api/v1/actions

Reconcile action plans. Inspect persisted plan and receipt after ambiguity; there is no GET /actions/{id} endpoint.

Authority: session. Response: ActionList.

## POST /api/v1/actions/{id}/approve

Approve exact plan. Authenticated human operator. Exact digest and case version required. Repeated identical approval does not execute twice.

Authority: operator. Response: Action.
Request schema: Approve.

## POST /api/v1/actions/{id}/reject

Reject exact plan. Operator role required; exact digest; opposite decisions conflict.

Authority: operator. Response: Action.
Request schema: Reject.