API docs by Redocly

NexusLink REST API (0.0.1)

Download OpenAPI specification:

API to manipulate groups, rules, policies and retrieve information about peers and users

Users

Interact with and view information about users.

List all Users

Returns a list of all users

Authorizations:
BearerAuthTokenAuth
query Parameters
service_user
boolean

Filters users and returns either regular users or service users

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a User

Creates a new service user or sends an invite to a regular user

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

User invite information

email
string

User's Email to send invite to

name
string

User's full name

role
required
string

User's NexusLink account role

auto_groups
required
Array of strings

Group IDs to auto-assign to peers registered by this user

is_service_user
required
boolean

Is true if this user is a service user

Responses

Request samples

Content type
application/json
{
  • "email": "demo@nexusremotesolutions.com",
  • "name": "Tom Schulz",
  • "role": "admin",
  • "auto_groups": [
    ],
  • "is_service_user": false
}

Response samples

Content type
application/json
{
  • "id": "google-oauth2|277474792786460067937",
  • "email": "demo@nexusremotesolutions.com",
  • "password": "super_secure_password",
  • "name": "Tom Schulz",
  • "role": "admin",
  • "status": "active",
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "auto_groups": [
    ],
  • "is_current": true,
  • "is_service_user": false,
  • "is_blocked": false,
  • "pending_approval": false,
  • "issued": "api",
  • "idp_id": "okta-abc123",
  • "permissions": {
    }
}

Update a User

Update information about a User

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Request Body schema: application/json

User update

role
required
string

User's NexusLink account role

auto_groups
required
Array of strings

Group IDs to auto-assign to peers registered by this user

is_blocked
required
boolean

If set to true then user is blocked and can't use the system

Responses

Request samples

Content type
application/json
{
  • "role": "admin",
  • "auto_groups": [
    ],
  • "is_blocked": false
}

Response samples

Content type
application/json
{
  • "id": "google-oauth2|277474792786460067937",
  • "email": "demo@nexusremotesolutions.com",
  • "password": "super_secure_password",
  • "name": "Tom Schulz",
  • "role": "admin",
  • "status": "active",
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "auto_groups": [
    ],
  • "is_current": true,
  • "is_service_user": false,
  • "is_blocked": false,
  • "pending_approval": false,
  • "issued": "api",
  • "idp_id": "okta-abc123",
  • "permissions": {
    }
}

Delete a User

This method removes a user from accessing the system. For this leaves the IDP user intact unless the --user-delete-from-idp is passed to management startup.

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Responses

Resend user invitation

Resend user invitation

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Responses

Approve user

Approve a user that is pending approval

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Responses

Response samples

Content type
application/json
{
  • "id": "google-oauth2|277474792786460067937",
  • "email": "demo@nexusremotesolutions.com",
  • "password": "super_secure_password",
  • "name": "Tom Schulz",
  • "role": "admin",
  • "status": "active",
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "auto_groups": [
    ],
  • "is_current": true,
  • "is_service_user": false,
  • "is_blocked": false,
  • "pending_approval": false,
  • "issued": "api",
  • "idp_id": "okta-abc123",
  • "permissions": {
    }
}

Reject user

Reject a user that is pending approval by removing them from the account

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Responses

Change user password

Change the password for a user. Only available when embedded IdP is enabled. Users can only change their own password.

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Request Body schema: application/json
required

Password change request

old_password
required
string

The current password

new_password
required
string

The new password to set

Responses

Request samples

Content type
application/json
{
  • "old_password": "currentPassword123",
  • "new_password": "newSecurePassword456"
}

Retrieve current user

Get information about the current user

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": "google-oauth2|277474792786460067937",
  • "email": "demo@nexusremotesolutions.com",
  • "password": "super_secure_password",
  • "name": "Tom Schulz",
  • "role": "admin",
  • "status": "active",
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "auto_groups": [
    ],
  • "is_current": true,
  • "is_service_user": false,
  • "is_blocked": false,
  • "pending_approval": false,
  • "issued": "api",
  • "idp_id": "okta-abc123",
  • "permissions": {
    }
}

List user invites

Lists all pending invites for the account. Only available when embedded IdP is enabled.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a user invite

Creates an invite link for a new user. Only available when embedded IdP is enabled. The user is not created until they accept the invite.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required

User invite information

email
required
string

User's email address

name
required
string

User's full name

role
required
string

User's NexusLink account role

auto_groups
required
Array of strings

Group IDs to auto-assign to peers registered by this user

expires_in
integer

Invite expiration time in seconds (default 72 hours)

Responses

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "name": "John Doe",
  • "role": "user",
  • "auto_groups": [
    ],
  • "expires_in": 259200
}

Response samples

Content type
application/json
{
  • "id": "d5p7eedra0h0lt6f59hg",
  • "email": "user@example.com",
  • "name": "John Doe",
  • "role": "user",
  • "auto_groups": [
    ],
  • "expires_at": "2024-01-25T10:00:00Z",
  • "created_at": "2024-01-22T10:00:00Z",
  • "expired": false,
  • "invite_token": "nbi_Xk5Lz9mP2vQwRtYu1aN3bC4dE5fGh0ABC123"
}

Delete a user invite

Deletes a pending invite. Only available when embedded IdP is enabled.

Authorizations:
BearerAuthTokenAuth
path Parameters
inviteId
required
string

The ID of the invite to delete

Responses

Regenerate a user invite

Regenerates an invite link for an existing invite. Invalidates the previous token and creates a new one.

Authorizations:
BearerAuthTokenAuth
path Parameters
inviteId
required
string

The ID of the invite to regenerate

Request Body schema: application/json

Regenerate options

expires_in
integer

Invite expiration time in seconds (default 72 hours)

Responses

Request samples

Content type
application/json
{
  • "expires_in": 259200
}

Response samples

Content type
application/json
{
  • "invite_token": "nbi_Xk5Lz9mP2vQwRtYu1aN3bC4dE5fGh0ABC123",
  • "invite_expires_at": "2024-01-28T10:00:00Z"
}

Get invite information

Retrieves public information about an invite. This endpoint is unauthenticated and protected by the token itself.

path Parameters
token
required
string

The invite token

Responses

Response samples

Content type
application/json
{
  • "email": "user@example.com",
  • "name": "John Doe",
  • "expires_at": "2024-01-25T10:00:00Z",
  • "valid": true,
  • "invited_by": "Admin User"
}

Accept an invite

Accepts an invite and creates the user with the provided password. This endpoint is unauthenticated and protected by the token itself.

path Parameters
token
required
string

The invite token

Request Body schema: application/json
required

Password to set for the new user

password
required
string <password> >= 8 characters ^(?=.*[0-9])(?=.*[A-Z])(?=.*[^a-zA-Z0-9]).{8,...

The password the user wants to set. Must be at least 8 characters long and contain at least one uppercase letter, one digit, and one special character (any character that is not a letter or digit, including spaces).

Responses

Request samples

Content type
application/json
{
  • "password": "SecurePass123!"
}

Response samples

Content type
application/json
{
  • "success": true
}

Tokens

Interact with and view information about tokens.

List all Tokens

Returns a list of all tokens for a user

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Token

Create a new token for a user

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

Request Body schema: application/json

PersonalAccessToken create parameters

name
required
string

Name of the token

expires_in
required
integer [ 1 .. 365 ]

Expiration in days

Responses

Request samples

Content type
application/json
{
  • "name": "My first token",
  • "expires_in": 30
}

Response samples

Content type
application/json
{
  • "plain_token": "2023-05-02T14:48:20.465209Z",
  • "personal_access_token": {
    }
}

Retrieve a Token

Returns a specific token for a user

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

tokenId
required
string

The unique identifier of a token

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i54g6lnn4g9hqv7n0",
  • "name": "My first token",
  • "expiration_date": "2023-05-05T14:38:28.977616Z",
  • "created_by": "google-oauth2|277474792786460067937",
  • "created_at": "2023-05-02T14:48:20.465209Z",
  • "last_used": "2023-05-04T12:45:25.9723616Z"
}

Delete a Token

Delete a token for a user

Authorizations:
BearerAuthTokenAuth
path Parameters
userId
required
string

The unique identifier of a user

tokenId
required
string

The unique identifier of a token

Responses

Peers

Interact with and view information about peers.

List all Peers

Returns a list of all peers

Authorizations:
BearerAuthTokenAuth
query Parameters
name
string

Filter peers by name

ip
string

Filter peers by IP address

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Retrieve a Peer

Get information about a peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Responses

Response samples

Content type
application/json
{
  • "id": "chacbco6lnnbn6cg5s90",
  • "name": "stage-host-1",
  • "created_at": "2023-05-05T09:00:35.477782Z",
  • "ip": "10.64.0.1",
  • "ipv6": "fd00:4e42:ab12::1",
  • "connection_ip": "35.64.0.1",
  • "connected": true,
  • "last_seen": "2023-05-05T10:05:26.420578Z",
  • "os": "Darwin 13.2.1",
  • "kernel_version": "23.2.0",
  • "geoname_id": 2643743,
  • "version": "0.14.0",
  • "groups": [
    ],
  • "ssh_enabled": true,
  • "user_id": "google-oauth2|277474792786460067937",
  • "hostname": "stage-host-1",
  • "ui_version": "0.14.0",
  • "dns_label": "stage-host-1.nexuslink.cloud",
  • "login_expiration_enabled": false,
  • "login_expired": false,
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "inactivity_expiration_enabled": false,
  • "approval_required": true,
  • "disapproval_reason": "string",
  • "country_code": "DE",
  • "city_name": "Berlin",
  • "serial_number": "C02XJ0J0JGH7",
  • "extra_dns_labels": [
    ],
  • "ephemeral": false,
  • "local_flags": {
    }
}

Update a Peer

Update information about a peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Request Body schema: application/json

update a peer

name
required
string
ssh_enabled
required
boolean
login_expiration_enabled
required
boolean
inactivity_expiration_enabled
required
boolean
approval_required
boolean

(Cloud only) Indicates whether peer needs approval

ip
string <ipv4>

Peer's IP address

ipv6
string <ipv6>

Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.

Responses

Request samples

Content type
application/json
{
  • "name": "stage-host-1",
  • "ssh_enabled": true,
  • "login_expiration_enabled": false,
  • "inactivity_expiration_enabled": false,
  • "approval_required": true,
  • "ip": "100.64.0.15",
  • "ipv6": "fd00:4e42:ab12::1"
}

Response samples

Content type
application/json
{
  • "id": "chacbco6lnnbn6cg5s90",
  • "name": "stage-host-1",
  • "created_at": "2023-05-05T09:00:35.477782Z",
  • "ip": "10.64.0.1",
  • "ipv6": "fd00:4e42:ab12::1",
  • "connection_ip": "35.64.0.1",
  • "connected": true,
  • "last_seen": "2023-05-05T10:05:26.420578Z",
  • "os": "Darwin 13.2.1",
  • "kernel_version": "23.2.0",
  • "geoname_id": 2643743,
  • "version": "0.14.0",
  • "groups": [
    ],
  • "ssh_enabled": true,
  • "user_id": "google-oauth2|277474792786460067937",
  • "hostname": "stage-host-1",
  • "ui_version": "0.14.0",
  • "dns_label": "stage-host-1.nexuslink.cloud",
  • "login_expiration_enabled": false,
  • "login_expired": false,
  • "last_login": "2023-05-05T09:00:35.477782Z",
  • "inactivity_expiration_enabled": false,
  • "approval_required": true,
  • "disapproval_reason": "string",
  • "country_code": "DE",
  • "city_name": "Berlin",
  • "serial_number": "C02XJ0J0JGH7",
  • "extra_dns_labels": [
    ],
  • "ephemeral": false,
  • "local_flags": {
    }
}

Delete a Peer

Delete a peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Responses

List accessible Peers

Returns a list of peers that the specified peer can connect to within the network.

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Temporary Access Peer

Creates a temporary access peer that can be used to access this peer and this peer only. The temporary access peer and its access policies will be automatically deleted after it disconnects.

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Request Body schema: application/json

Temporary Access Peer create request

name
required
string

Peer's hostname

wg_pub_key
required
string

Peer's WireGuard public key

rules
required
Array of strings

List of temporary access rules

Responses

Request samples

Content type
application/json
{
  • "name": "temp-host-1",
  • "wg_pub_key": "n0r3pL4c3h0ld3rK3y==",
  • "rules": [
    ]
}

Response samples

Content type
application/json
{
  • "name": "temp-host-1",
  • "id": "chacbco6lnnbn6cg5s90",
  • "rules": [
    ]
}

Setup Keys

Interact with and view information about setup keys.

List all Setup Keys

Returns a list of all Setup Keys

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Setup Key

Creates a setup key

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Setup Key request

name
required
string

Setup Key name

type
required
string

Setup key type, one-off for single time usage and reusable

expires_in
required
integer [ 86400 .. 31536000 ]

Expiration time in seconds

auto_groups
required
Array of strings

List of group IDs to auto-assign to peers registered with this key

usage_limit
required
integer

A number of times this key can be used. The value of 0 indicates the unlimited usage.

ephemeral
boolean

Indicate that the peer will be ephemeral or not

allow_extra_dns_labels
boolean

Allow extra DNS labels to be added to the peer

Responses

Request samples

Content type
application/json
{
  • "name": "Default key",
  • "type": "reusable",
  • "expires_in": 86400,
  • "auto_groups": [
    ],
  • "usage_limit": 0,
  • "ephemeral": true,
  • "allow_extra_dns_labels": true
}

Response samples

Content type
application/json
{
  • "id": 2531583362,
  • "name": "Default key",
  • "expires": "2023-06-01T14:47:22.291057Z",
  • "type": "reusable",
  • "valid": true,
  • "revoked": false,
  • "used_times": 2,
  • "last_used": "2023-05-05T09:00:35.477782Z",
  • "state": "valid",
  • "auto_groups": [
    ],
  • "updated_at": "2023-05-05T09:00:35.477782Z",
  • "usage_limit": 0,
  • "ephemeral": true,
  • "allow_extra_dns_labels": true,
  • "key": "A616097E-FCF0-48FA-9354-CA4A61142761"
}

Retrieve a Setup Key

Get information about a setup key

Authorizations:
BearerAuthTokenAuth
path Parameters
keyId
required
string

The unique identifier of a setup key

Responses

Response samples

Content type
application/json
{
  • "id": 2531583362,
  • "name": "Default key",
  • "expires": "2023-06-01T14:47:22.291057Z",
  • "type": "reusable",
  • "valid": true,
  • "revoked": false,
  • "used_times": 2,
  • "last_used": "2023-05-05T09:00:35.477782Z",
  • "state": "valid",
  • "auto_groups": [
    ],
  • "updated_at": "2023-05-05T09:00:35.477782Z",
  • "usage_limit": 0,
  • "ephemeral": true,
  • "allow_extra_dns_labels": true,
  • "key": "A6160****"
}

Update a Setup Key

Update information about a setup key

Authorizations:
BearerAuthTokenAuth
path Parameters
keyId
required
string

The unique identifier of a setup key

Request Body schema: application/json

update to Setup Key

revoked
required
boolean

Setup key revocation status

auto_groups
required
Array of strings

List of group IDs to auto-assign to peers registered with this key

Responses

Request samples

Content type
application/json
{
  • "revoked": false,
  • "auto_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": 2531583362,
  • "name": "Default key",
  • "expires": "2023-06-01T14:47:22.291057Z",
  • "type": "reusable",
  • "valid": true,
  • "revoked": false,
  • "used_times": 2,
  • "last_used": "2023-05-05T09:00:35.477782Z",
  • "state": "valid",
  • "auto_groups": [
    ],
  • "updated_at": "2023-05-05T09:00:35.477782Z",
  • "usage_limit": 0,
  • "ephemeral": true,
  • "allow_extra_dns_labels": true,
  • "key": "A6160****"
}

Delete a Setup Key

Delete a Setup Key

Authorizations:
BearerAuthTokenAuth
path Parameters
keyId
required
string

The unique identifier of a setup key

Responses

Groups

Interact with and view information about groups.

List all Groups

Returns a list of all groups

Authorizations:
BearerAuthTokenAuth
query Parameters
name
string
Example: name=devs

Filter groups by name (exact match)

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Group

Creates a group

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Group request

name
required
string

Group name identifier

peers
Array of strings

List of peers ids

Array of objects (Resource)

Responses

Request samples

Content type
application/json
{
  • "name": "devs",
  • "peers": [
    ],
  • "resources": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "devs",
  • "peers_count": 2,
  • "resources_count": 5,
  • "issued": "api",
  • "peers": [
    ],
  • "resources": [
    ]
}

Retrieve a Group

Get information about a group

Authorizations:
BearerAuthTokenAuth
path Parameters
groupId
required
string

The unique identifier of a group

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "devs",
  • "peers_count": 2,
  • "resources_count": 5,
  • "issued": "api",
  • "peers": [
    ],
  • "resources": [
    ]
}

Update a Group

Update/Replace a group

Authorizations:
BearerAuthTokenAuth
path Parameters
groupId
required
string

The unique identifier of a group

Request Body schema: application/json

Update Group request

name
required
string

Group name identifier

peers
Array of strings

List of peers ids

Array of objects (Resource)

Responses

Request samples

Content type
application/json
{
  • "name": "devs",
  • "peers": [
    ],
  • "resources": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "devs",
  • "peers_count": 2,
  • "resources_count": 5,
  • "issued": "api",
  • "peers": [
    ],
  • "resources": [
    ]
}

Delete a Group

Delete a group

Authorizations:
BearerAuthTokenAuth
path Parameters
groupId
required
string

The unique identifier of a group

Responses

Policies

Interact with and view information about policies.

List all Policies

Returns a list of all policies

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Policy

Creates a policy

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Policy request

name
required
string

Policy name identifier

description
string

Policy friendly description

enabled
required
boolean

Policy status

source_posture_checks
Array of strings

Posture checks ID's applied to policy source groups

required
Array of objects (PolicyRuleUpdate)

Policy rule object for policy UI editor

Responses

Request samples

Content type
application/json
{
  • "name": "ch8i4ug6lnn4g9hqv7mg",
  • "description": "This is a default policy that allows connections between all the resources",
  • "enabled": true,
  • "source_posture_checks": [
    ],
  • "rules": [
    ]
}

Response samples

Content type
application/json
{
  • "name": "ch8i4ug6lnn4g9hqv7mg",
  • "description": "This is a default policy that allows connections between all the resources",
  • "enabled": true,
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "source_posture_checks": [
    ],
  • "rules": [
    ]
}

Retrieve a Policy

Get information about a Policies

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of a policy

Responses

Response samples

Content type
application/json
{
  • "name": "ch8i4ug6lnn4g9hqv7mg",
  • "description": "This is a default policy that allows connections between all the resources",
  • "enabled": true,
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "source_posture_checks": [
    ],
  • "rules": [
    ]
}

Update a Policy

Update/Replace a Policy

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of a policy

Request Body schema: application/json

Update Policy request

name
required
string

Policy name identifier

description
string

Policy friendly description

enabled
required
boolean

Policy status

source_posture_checks
Array of strings

Posture checks ID's applied to policy source groups

required
Array of objects (PolicyRuleUpdate)

Policy rule object for policy UI editor

Responses

Request samples

Content type
application/json
{
  • "name": "ch8i4ug6lnn4g9hqv7mg",
  • "description": "This is a default policy that allows connections between all the resources",
  • "enabled": true,
  • "source_posture_checks": [
    ],
  • "rules": [
    ]
}

Response samples

Content type
application/json
{
  • "name": "ch8i4ug6lnn4g9hqv7mg",
  • "description": "This is a default policy that allows connections between all the resources",
  • "enabled": true,
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "source_posture_checks": [
    ],
  • "rules": [
    ]
}

Delete a Policy

Delete a policy

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of a policy

Responses

Posture Checks

Interact with and view information about posture checks.

List all Posture Checks

Returns a list of all posture checks

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Posture Check

Creates a posture check

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New posture check request

name
required
string

Posture check name identifier

description
required
string

Posture check friendly description

object (Checks)

List of objects that perform the actual checks

Responses

Request samples

Content type
application/json
{
  • "name": "Default",
  • "description": "This checks if the peer is running required NexusLink's version",
  • "checks": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "name": "Default",
  • "description": "This checks if the peer is running required NexusLink's version",
  • "checks": {
    }
}

Retrieve a Posture Check

Get information about a posture check

Authorizations:
BearerAuthTokenAuth
path Parameters
postureCheckId
required
string

The unique identifier of a posture check

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "name": "Default",
  • "description": "This checks if the peer is running required NexusLink's version",
  • "checks": {
    }
}

Update a Posture Check

Update/Replace a posture check

Authorizations:
BearerAuthTokenAuth
path Parameters
postureCheckId
required
string

The unique identifier of a posture check

Request Body schema: application/json

Update Rule request

name
required
string

Posture check name identifier

description
required
string

Posture check friendly description

object (Checks)

List of objects that perform the actual checks

Responses

Request samples

Content type
application/json
{
  • "name": "Default",
  • "description": "This checks if the peer is running required NexusLink's version",
  • "checks": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7mg",
  • "name": "Default",
  • "description": "This checks if the peer is running required NexusLink's version",
  • "checks": {
    }
}

Delete a Posture Check

Delete a posture check

Authorizations:
BearerAuthTokenAuth
path Parameters
postureCheckId
required
string

The unique identifier of a posture check

Responses

Routes

Interact with and view information about routes.

List all Routes

Returns a list of all routes

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Route

Creates a Route

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Routes request

description
required
string

Route description

network_id
required
string [ 1 .. 40 ] characters

Route network identifier, to group HA routes

enabled
required
boolean

Route status

peer
string

Peer Identifier associated with route. This property can not be set together with peer_groups

peer_groups
Array of strings

Peers Group Identifier associated with route. This property can not be set together with peer

network
string

Network range in CIDR format, Conflicts with domains

domains
Array of strings[ items [ 1 .. 32 ] characters ]

Domain list to be dynamically resolved. Max of 32 domains can be added per route configuration. Conflicts with network

metric
required
integer [ 1 .. 9999 ]

Route metric number. Lowest number has higher priority

masquerade
required
boolean

Indicate if peer should masquerade traffic to this route's prefix

groups
required
Array of strings

Group IDs containing routing peers

keep_route
required
boolean

Indicate if the route should be kept after a domain doesn't resolve that IP anymore

access_control_groups
Array of strings

Access control group identifier associated with route.

skip_auto_apply
boolean

Indicate if this exit node route (0.0.0.0/0) should skip auto-application for client routing

Responses

Request samples

Content type
application/json
{
  • "description": "My first route",
  • "network_id": "Route 1",
  • "enabled": true,
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "network": "10.64.0.0/24",
  • "domains": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "groups": [
    ],
  • "keep_route": true,
  • "access_control_groups": [
    ],
  • "skip_auto_apply": false
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "network_type": "IPv4",
  • "description": "My first route",
  • "network_id": "Route 1",
  • "enabled": true,
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "network": "10.64.0.0/24",
  • "domains": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "groups": [
    ],
  • "keep_route": true,
  • "access_control_groups": [
    ],
  • "skip_auto_apply": false
}

Retrieve a Route

Get information about a Routes

Authorizations:
BearerAuthTokenAuth
path Parameters
routeId
required
string

The unique identifier of a route

Responses

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "network_type": "IPv4",
  • "description": "My first route",
  • "network_id": "Route 1",
  • "enabled": true,
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "network": "10.64.0.0/24",
  • "domains": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "groups": [
    ],
  • "keep_route": true,
  • "access_control_groups": [
    ],
  • "skip_auto_apply": false
}

Update a Route

Update/Replace a Route

Authorizations:
BearerAuthTokenAuth
path Parameters
routeId
required
string

The unique identifier of a route

Request Body schema: application/json

Update Route request

description
required
string

Route description

network_id
required
string [ 1 .. 40 ] characters

Route network identifier, to group HA routes

enabled
required
boolean

Route status

peer
string

Peer Identifier associated with route. This property can not be set together with peer_groups

peer_groups
Array of strings

Peers Group Identifier associated with route. This property can not be set together with peer

network
string

Network range in CIDR format, Conflicts with domains

domains
Array of strings[ items [ 1 .. 32 ] characters ]

Domain list to be dynamically resolved. Max of 32 domains can be added per route configuration. Conflicts with network

metric
required
integer [ 1 .. 9999 ]

Route metric number. Lowest number has higher priority

masquerade
required
boolean

Indicate if peer should masquerade traffic to this route's prefix

groups
required
Array of strings

Group IDs containing routing peers

keep_route
required
boolean

Indicate if the route should be kept after a domain doesn't resolve that IP anymore

access_control_groups
Array of strings

Access control group identifier associated with route.

skip_auto_apply
boolean

Indicate if this exit node route (0.0.0.0/0) should skip auto-application for client routing

Responses

Request samples

Content type
application/json
{
  • "description": "My first route",
  • "network_id": "Route 1",
  • "enabled": true,
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "network": "10.64.0.0/24",
  • "domains": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "groups": [
    ],
  • "keep_route": true,
  • "access_control_groups": [
    ],
  • "skip_auto_apply": false
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "network_type": "IPv4",
  • "description": "My first route",
  • "network_id": "Route 1",
  • "enabled": true,
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "network": "10.64.0.0/24",
  • "domains": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "groups": [
    ],
  • "keep_route": true,
  • "access_control_groups": [
    ],
  • "skip_auto_apply": false
}

Delete a Route

Delete a route

Authorizations:
BearerAuthTokenAuth
path Parameters
routeId
required
string

The unique identifier of a route

Responses

DNS

Interact with and view information about DNS configuration.

List all Nameserver Groups

Returns a list of all Nameserver Groups

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Nameserver Group

Creates a Nameserver Group

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Nameserver Groups request

name
required
string [ 1 .. 40 ] characters

Name of nameserver group name

description
required
string

Description of the nameserver group

required
Array of objects (Nameserver) [ 1 .. 3 ] characters

Nameserver list

enabled
required
boolean

Nameserver group status

groups
required
Array of strings

Distribution group IDs that defines group of peers that will use this nameserver group

primary
required
boolean

Defines if a nameserver group is primary that resolves all domains. It should be true only if domains list is empty.

domains
required
Array of strings[ items [ 1 .. 255 ] characters ]

Match domain list. It should be empty only if primary is true.

search_domains_enabled
required
boolean

Search domain status for match domains. It should be true only if domains list is not empty.

Responses

Request samples

Content type
application/json
{
  • "name": "Google DNS",
  • "description": "Google DNS servers",
  • "nameservers": [
    ],
  • "enabled": true,
  • "groups": [
    ],
  • "primary": true,
  • "domains": [
    ],
  • "search_domains_enabled": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Google DNS",
  • "description": "Google DNS servers",
  • "nameservers": [
    ],
  • "enabled": true,
  • "groups": [
    ],
  • "primary": true,
  • "domains": [
    ],
  • "search_domains_enabled": true
}

Retrieve a Nameserver Group

Get information about a Nameserver Groups

Authorizations:
BearerAuthTokenAuth
path Parameters
nsgroupId
required
string

The unique identifier of a Nameserver Group

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Google DNS",
  • "description": "Google DNS servers",
  • "nameservers": [
    ],
  • "enabled": true,
  • "groups": [
    ],
  • "primary": true,
  • "domains": [
    ],
  • "search_domains_enabled": true
}

Update a Nameserver Group

Update/Replace a Nameserver Group

Authorizations:
BearerAuthTokenAuth
path Parameters
nsgroupId
required
string

The unique identifier of a Nameserver Group

Request Body schema: application/json

Update Nameserver Group request

name
required
string [ 1 .. 40 ] characters

Name of nameserver group name

description
required
string

Description of the nameserver group

required
Array of objects (Nameserver) [ 1 .. 3 ] characters

Nameserver list

enabled
required
boolean

Nameserver group status

groups
required
Array of strings

Distribution group IDs that defines group of peers that will use this nameserver group

primary
required
boolean

Defines if a nameserver group is primary that resolves all domains. It should be true only if domains list is empty.

domains
required
Array of strings[ items [ 1 .. 255 ] characters ]

Match domain list. It should be empty only if primary is true.

search_domains_enabled
required
boolean

Search domain status for match domains. It should be true only if domains list is not empty.

Responses

Request samples

Content type
application/json
{
  • "name": "Google DNS",
  • "description": "Google DNS servers",
  • "nameservers": [
    ],
  • "enabled": true,
  • "groups": [
    ],
  • "primary": true,
  • "domains": [
    ],
  • "search_domains_enabled": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Google DNS",
  • "description": "Google DNS servers",
  • "nameservers": [
    ],
  • "enabled": true,
  • "groups": [
    ],
  • "primary": true,
  • "domains": [
    ],
  • "search_domains_enabled": true
}

Delete a Nameserver Group

Delete a Nameserver Group

Authorizations:
BearerAuthTokenAuth
path Parameters
nsgroupId
required
string

The unique identifier of a Nameserver Group

Responses

Retrieve DNS settings

Returns a DNS settings object

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Update DNS Settings

Updates a DNS settings object

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

A DNS settings object

disabled_management_groups
required
Array of strings

Groups whose DNS management is disabled

Responses

Request samples

Content type
application/json
{
  • "disabled_management_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "disabled_management_groups": [
    ]
}

DNS Zones

Interact with and view information about custom DNS zones.

List all DNS Zones

Returns a list of all custom DNS zones

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a DNS Zone

Creates a new custom DNS zone

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

A DNS zone object

name
required
string [ 1 .. 255 ] characters

Zone name identifier

domain
required
string

Zone domain (FQDN)

enabled
boolean
Default: true

Zone status

enable_search_domain
required
boolean

Enable this zone as a search domain

distribution_groups
required
Array of strings

Group IDs that defines groups of peers that will resolve this zone

Responses

Request samples

Content type
application/json
{
  • "name": "Office Zone",
  • "domain": "example.com",
  • "enabled": true,
  • "enable_search_domain": false,
  • "distribution_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "records": [
    ],
  • "name": "Office Zone",
  • "domain": "example.com",
  • "enabled": true,
  • "enable_search_domain": false,
  • "distribution_groups": [
    ]
}

Retrieve a DNS Zone

Returns information about a specific DNS zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "records": [
    ],
  • "name": "Office Zone",
  • "domain": "example.com",
  • "enabled": true,
  • "enable_search_domain": false,
  • "distribution_groups": [
    ]
}

Update a DNS Zone

Updates a custom DNS zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

Request Body schema: application/json

A DNS zone object

name
required
string [ 1 .. 255 ] characters

Zone name identifier

domain
required
string

Zone domain (FQDN)

enabled
boolean
Default: true

Zone status

enable_search_domain
required
boolean

Enable this zone as a search domain

distribution_groups
required
Array of strings

Group IDs that defines groups of peers that will resolve this zone

Responses

Request samples

Content type
application/json
{
  • "name": "Office Zone",
  • "domain": "example.com",
  • "enabled": true,
  • "enable_search_domain": false,
  • "distribution_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "records": [
    ],
  • "name": "Office Zone",
  • "domain": "example.com",
  • "enabled": true,
  • "enable_search_domain": false,
  • "distribution_groups": [
    ]
}

Delete a DNS Zone

Deletes a custom DNS zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

Responses

List all DNS Records

Returns a list of all DNS records in a zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a DNS Record

Creates a new DNS record in a zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

Request Body schema: application/json

A DNS record object

name
required
string

FQDN for the DNS record. Must be a subdomain within or match the zone's domain.

type
required
string (DNSRecordType)
Enum: "A" "AAAA" "CNAME"

DNS record type

content
required
string [ 1 .. 255 ] characters

DNS record content (IP address for A/AAAA, domain for CNAME)

ttl
required
integer >= 0

Time to live in seconds

Responses

Request samples

Content type
application/json
{
  • "name": "www.example.com",
  • "type": "A",
  • "content": "192.168.1.1",
  • "ttl": 300
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "www.example.com",
  • "type": "A",
  • "content": "192.168.1.1",
  • "ttl": 300
}

Retrieve a DNS Record

Returns information about a specific DNS record

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

recordId
required
string
Example: chacbco6lnnbn6cg5s92

The unique identifier of a DNS record

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "www.example.com",
  • "type": "A",
  • "content": "192.168.1.1",
  • "ttl": 300
}

Update a DNS Record

Updates a DNS record in a zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

recordId
required
string
Example: chacbco6lnnbn6cg5s92

The unique identifier of a DNS record

Request Body schema: application/json

A DNS record object

name
required
string

FQDN for the DNS record. Must be a subdomain within or match the zone's domain.

type
required
string (DNSRecordType)
Enum: "A" "AAAA" "CNAME"

DNS record type

content
required
string [ 1 .. 255 ] characters

DNS record content (IP address for A/AAAA, domain for CNAME)

ttl
required
integer >= 0

Time to live in seconds

Responses

Request samples

Content type
application/json
{
  • "name": "www.example.com",
  • "type": "A",
  • "content": "192.168.1.1",
  • "ttl": 300
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "www.example.com",
  • "type": "A",
  • "content": "192.168.1.1",
  • "ttl": 300
}

Delete a DNS Record

Deletes a DNS record from a zone

Authorizations:
BearerAuthTokenAuth
path Parameters
zoneId
required
string
Example: chacbco6lnnbn6cg5s91

The unique identifier of a zone

recordId
required
string
Example: chacbco6lnnbn6cg5s92

The unique identifier of a DNS record

Responses

Events

View information about the account and network events.

List all Audit Events

Returns a list of all audit events

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

List all Traffic Events

Returns a list of all network traffic events

Authorizations:
BearerAuthTokenAuth
query Parameters
page
integer >= 1
Default: 1

Page number

page_size
integer [ 1 .. 50000 ]
Default: 1000

Number of items per page

user_id
string

Filter by user ID

reporter_id
string

Filter by reporter ID

source_id
string

Filter by source endpoint ID

destination_id
string

Filter by destination endpoint ID

protocol
integer

Filter by protocol

type
string
Enum: "TYPE_UNKNOWN" "TYPE_START" "TYPE_END" "TYPE_DROP"

Filter by event type

connection_type
string
Enum: "P2P" "ROUTED"

Filter by connection type

direction
string
Enum: "INGRESS" "EGRESS" "DIRECTION_UNKNOWN"

Filter by direction

search
string

Case-insensitive partial match on user email, source/destination names, and source/destination addresses

start_date
string <date-time>

Start date for filtering events (ISO 8601 format, e.g., 2024-01-01T00:00:00Z).

end_date
string <date-time>

End date for filtering events (ISO 8601 format, e.g., 2024-01-31T23:59:59Z).

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "page": 0,
  • "page_size": 0,
  • "total_records": 0,
  • "total_pages": 0
}

List all Reverse Proxy Access Logs

Returns a paginated list of all reverse proxy access log entries

Authorizations:
BearerAuthTokenAuth
query Parameters
page
integer >= 1
Default: 1

Page number for pagination (1-indexed)

page_size
integer [ 1 .. 100 ]
Default: 50

Number of items per page (max 100)

sort_by
string
Default: "timestamp"
Enum: "timestamp" "url" "host" "path" "method" "status_code" "duration" "source_ip" "user_id" "auth_method" "reason"

Field to sort by (url sorts by host then path)

sort_order
string
Default: "desc"
Enum: "asc" "desc"

Sort order (ascending or descending)

search
string

General search across request ID, host, path, source IP, user email, and user name

source_ip
string

Filter by source IP address

host
string

Filter by host header

path
string

Filter by request path (supports partial matching)

user_id
string

Filter by authenticated user ID

user_email
string

Filter by user email (partial matching)

user_name
string

Filter by user name (partial matching)

method
string
Enum: "GET" "POST" "PUT" "PATCH" "DELETE" "HEAD" "OPTIONS"

Filter by HTTP method

status
string
Enum: "success" "failed"

Filter by status (success = 2xx/3xx, failed = 1xx/4xx/5xx)

status_code
integer [ 100 .. 599 ]

Filter by HTTP status code

start_date
string <date-time>

Filter by timestamp >= start_date (RFC3339 format)

end_date
string <date-time>

Filter by timestamp <= end_date (RFC3339 format)

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "page": 1,
  • "page_size": 50,
  • "total_records": 523,
  • "total_pages": 11
}

Accounts

View information about the accounts.

List all Accounts

Returns a list of accounts of a user. Always returns a list of one account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete an Account

Deletes an account and all its resources. Only account owners can delete accounts.

Authorizations:
BearerAuthTokenAuth
path Parameters
accountId
required
string

The unique identifier of an account

Responses

Update an Account

Update information about an account

Authorizations:
BearerAuthTokenAuth
path Parameters
accountId
required
string

The unique identifier of an account

Request Body schema: application/json

update an account

required
object (AccountSettings)
object (AccountOnboarding)

Responses

Request samples

Content type
application/json
{
  • "settings": {
    },
  • "onboarding": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7l0",
  • "settings": {
    },
  • "domain": "nexusremotesolutions.com",
  • "domain_category": "private",
  • "created_at": "2023-05-05T09:00:35.477782Z",
  • "created_by": "google-oauth2|277474792786460067937",
  • "onboarding": {
    }
}

Ingress Ports

Interact with and view information about the ingress peers and ports.

List all Port Allocations

Returns a list of all ingress port allocations for a peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

query Parameters
name
string

Filters ingress port allocations by name

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Port Allocation

Creates a new ingress port allocation for a peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Request Body schema: application/json

New Ingress Port Allocation request

name
required
string

Name of the ingress port allocation

enabled
required
boolean

Indicates if an ingress port allocation is enabled

Array of objects (IngressPortAllocationRequestPortRange)

List of port ranges that are forwarded by the ingress peer

object (IngressPortAllocationRequestDirectPort)

Direct port allocation

Responses

Request samples

Content type
application/json
{
  • "name": "Ingress Port Allocation 1",
  • "enabled": true,
  • "port_ranges": [
    ],
  • "direct_port": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Ingress Peer Allocation 1",
  • "ingress_peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "region": "germany",
  • "enabled": true,
  • "ingress_ip": "192.34.0.123",
  • "port_range_mappings": [
    ]
}

Retrieve a Port Allocation

Get information about an ingress port allocation

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

allocationId
required
string

The unique identifier of an ingress port allocation

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Ingress Peer Allocation 1",
  • "ingress_peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "region": "germany",
  • "enabled": true,
  • "ingress_ip": "192.34.0.123",
  • "port_range_mappings": [
    ]
}

Update a Port Allocation

Update information about an ingress port allocation

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

allocationId
required
string

The unique identifier of an ingress port allocation

Request Body schema: application/json

update an ingress port allocation

name
required
string

Name of the ingress port allocation

enabled
required
boolean

Indicates if an ingress port allocation is enabled

Array of objects (IngressPortAllocationRequestPortRange)

List of port ranges that are forwarded by the ingress peer

object (IngressPortAllocationRequestDirectPort)

Direct port allocation

Responses

Request samples

Content type
application/json
{
  • "name": "Ingress Port Allocation 1",
  • "enabled": true,
  • "port_ranges": [
    ],
  • "direct_port": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "Ingress Peer Allocation 1",
  • "ingress_peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "region": "germany",
  • "enabled": true,
  • "ingress_ip": "192.34.0.123",
  • "port_range_mappings": [
    ]
}

Delete a Port Allocation

Delete an ingress port allocation

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

allocationId
required
string

The unique identifier of an ingress port allocation

Responses

List all Ingress Peers

Returns a list of all ingress peers

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Ingress Peer

Creates a new ingress peer

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Ingress Peer request

peer_id
required
string

ID of the peer that is used as an ingress peer

enabled
required
boolean

Defines if an ingress peer is enabled

fallback
required
boolean

Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer

Responses

Request samples

Content type
application/json
{
  • "peer_id": "ch8i4ug6lnn4g9hqv7m0",
  • "enabled": true,
  • "fallback": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "ingress_ip": "192.34.0.123",
  • "available_ports": {
    },
  • "enabled": true,
  • "connected": true,
  • "fallback": true,
  • "region": "germany"
}

Retrieve a Ingress Peer

Get information about an ingress peer

Authorizations:
BearerAuthTokenAuth
path Parameters
ingressPeerId
required
string

The unique identifier of an ingress peer

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "ingress_ip": "192.34.0.123",
  • "available_ports": {
    },
  • "enabled": true,
  • "connected": true,
  • "fallback": true,
  • "region": "germany"
}

Update a Ingress Peer

Update information about an ingress peer

Authorizations:
BearerAuthTokenAuth
path Parameters
ingressPeerId
required
string

The unique identifier of an ingress peer

Request Body schema: application/json

update an ingress peer

enabled
required
boolean

Defines if an ingress peer is enabled

fallback
required
boolean

Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "fallback": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "peer_id": "x7p3kqf2rdd8j5zxw4n9",
  • "ingress_ip": "192.34.0.123",
  • "available_ports": {
    },
  • "enabled": true,
  • "connected": true,
  • "fallback": true,
  • "region": "germany"
}

Delete a Ingress Peer

Delete an ingress peer

Authorizations:
BearerAuthTokenAuth
path Parameters
ingressPeerId
required
string

The unique identifier of an ingress peer

Responses

Identity Providers

Interact with and view information about identity providers.

List all Identity Providers

Returns a list of all identity providers configured for the account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Identity Provider

Creates a new identity provider configuration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

Identity provider configuration

type
required
string (IdentityProviderType)
Enum: "oidc" "zitadel" "entra" "google" "okta" "pocketid" "microsoft" "adfs"

Type of identity provider

name
required
string

Human-readable name for the identity provider

issuer
required
string

OIDC issuer URL

client_id
required
string

OAuth2 client ID

client_secret
required
string

OAuth2 client secret

Responses

Request samples

Content type
application/json
{
  • "type": "oidc",
  • "name": "My OIDC Provider",
  • "issuer": "https://accounts.google.com",
  • "client_id": "123456789.apps.googleusercontent.com",
  • "client_secret": "secret123"
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7l0",
  • "type": "oidc",
  • "name": "My OIDC Provider",
  • "issuer": "https://accounts.google.com",
  • "client_id": "123456789.apps.googleusercontent.com"
}

Retrieve an Identity Provider

Get information about a specific identity provider

Authorizations:
BearerAuthTokenAuth
path Parameters
idpId
required
string

The unique identifier of an identity provider

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7l0",
  • "type": "oidc",
  • "name": "My OIDC Provider",
  • "issuer": "https://accounts.google.com",
  • "client_id": "123456789.apps.googleusercontent.com"
}

Update an Identity Provider

Update an existing identity provider configuration

Authorizations:
BearerAuthTokenAuth
path Parameters
idpId
required
string

The unique identifier of an identity provider

Request Body schema: application/json

Identity provider update

type
required
string (IdentityProviderType)
Enum: "oidc" "zitadel" "entra" "google" "okta" "pocketid" "microsoft" "adfs"

Type of identity provider

name
required
string

Human-readable name for the identity provider

issuer
required
string

OIDC issuer URL

client_id
required
string

OAuth2 client ID

client_secret
required
string

OAuth2 client secret

Responses

Request samples

Content type
application/json
{
  • "type": "oidc",
  • "name": "My OIDC Provider",
  • "issuer": "https://accounts.google.com",
  • "client_id": "123456789.apps.googleusercontent.com",
  • "client_secret": "secret123"
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7l0",
  • "type": "oidc",
  • "name": "My OIDC Provider",
  • "issuer": "https://accounts.google.com",
  • "client_id": "123456789.apps.googleusercontent.com"
}

Delete an Identity Provider

Delete an identity provider configuration

Authorizations:
BearerAuthTokenAuth
path Parameters
idpId
required
string

The unique identifier of an identity provider

Responses

Services

Interact with and view information about reverse proxy services.

List available proxy clusters

Returns a list of available proxy clusters with their connection status

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete a self-hosted proxy cluster

Removes all self-hosted (BYOP) proxy registrations for the given cluster address owned by the account.

Authorizations:
BearerAuthTokenAuth
path Parameters
clusterAddress
required
string

The address of the proxy cluster

Responses

List all Services

Returns a list of all reverse proxy services

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Service

Creates a new reverse proxy service

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New service request

name
required
string

Service name

domain
required
string

Domain for the service

mode
string
Default: "http"
Enum: "http" "tcp" "udp" "tls"

Service mode. "http" for L7 reverse proxy, "tcp"/"udp"/"tls" for L4 passthrough.

listen_port
integer [ 0 .. 65535 ]

Port the proxy listens on (L4/TLS only). Set to 0 for auto-assignment.

Array of objects (ServiceTarget)

List of target backends for this service

enabled
required
boolean
Default: true

Whether the service is enabled

pass_host_header
boolean

When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address

rewrite_redirects
boolean

When true, Location headers in backend responses are rewritten to replace the backend address with the public-facing domain

object (ServiceAuthConfig)
object (AccessRestrictions)

Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.

private
boolean
Default: false

When true, the service is NexusLink-only — its target points at a proxy cluster, inbound peers authenticate via their WireGuard tunnel identity (no OIDC), and an ACL policy is auto-generated from access_groups to the cluster's proxy-peer group. Requires mode=http.

access_groups
Array of strings

NexusLink group IDs whose peers may reach this private service over the tunnel. Required when private=true; ignored otherwise. Mutually exclusive with bearer auth (SSO).

Responses

Request samples

Content type
application/json
{
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 5432,
  • "targets": [
    ],
  • "enabled": true,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "cs8i4ug6lnn4g9hqv7mg",
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 8443,
  • "port_auto_assigned": false,
  • "proxy_cluster": "eu.proxy.nexuslink2.com",
  • "targets": [
    ],
  • "enabled": true,
  • "terminated": false,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "meta": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Retrieve a Service

Get information about a specific reverse proxy service

Authorizations:
BearerAuthTokenAuth
path Parameters
serviceId
required
string

The unique identifier of a service

Responses

Response samples

Content type
application/json
{
  • "id": "cs8i4ug6lnn4g9hqv7mg",
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 8443,
  • "port_auto_assigned": false,
  • "proxy_cluster": "eu.proxy.nexuslink2.com",
  • "targets": [
    ],
  • "enabled": true,
  • "terminated": false,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "meta": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Update a Service

Update an existing service

Authorizations:
BearerAuthTokenAuth
path Parameters
serviceId
required
string

The unique identifier of a service

Request Body schema: application/json

Service update request

name
required
string

Service name

domain
required
string

Domain for the service

mode
string
Default: "http"
Enum: "http" "tcp" "udp" "tls"

Service mode. "http" for L7 reverse proxy, "tcp"/"udp"/"tls" for L4 passthrough.

listen_port
integer [ 0 .. 65535 ]

Port the proxy listens on (L4/TLS only). Set to 0 for auto-assignment.

Array of objects (ServiceTarget)

List of target backends for this service

enabled
required
boolean
Default: true

Whether the service is enabled

pass_host_header
boolean

When true, the original client Host header is passed through to the backend instead of being rewritten to the backend's address

rewrite_redirects
boolean

When true, Location headers in backend responses are rewritten to replace the backend address with the public-facing domain

object (ServiceAuthConfig)
object (AccessRestrictions)

Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.

private
boolean
Default: false

When true, the service is NexusLink-only — its target points at a proxy cluster, inbound peers authenticate via their WireGuard tunnel identity (no OIDC), and an ACL policy is auto-generated from access_groups to the cluster's proxy-peer group. Requires mode=http.

access_groups
Array of strings

NexusLink group IDs whose peers may reach this private service over the tunnel. Required when private=true; ignored otherwise. Mutually exclusive with bearer auth (SSO).

Responses

Request samples

Content type
application/json
{
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 5432,
  • "targets": [
    ],
  • "enabled": true,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "cs8i4ug6lnn4g9hqv7mg",
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 8443,
  • "port_auto_assigned": false,
  • "proxy_cluster": "eu.proxy.nexuslink2.com",
  • "targets": [
    ],
  • "enabled": true,
  • "terminated": false,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "meta": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Delete a Service

Delete an existing service

Authorizations:
BearerAuthTokenAuth
path Parameters
serviceId
required
string

The unique identifier of a service

Responses

Retrieve Service Domains

Get information about domains that can be used for service endpoints.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Custom domain

Create a new Custom domain for use with service endpoints, this will trigger an initial validation check

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

Custom domain creation request

domain
required
string

Domain name

target_cluster
required
string

The proxy cluster this domain should be validated against

Responses

Request samples

Content type
application/json
{
  • "domain": "myapp.example.com",
  • "target_cluster": "eu.proxy.nexuslink2.com"
}

Response samples

Content type
application/json
{
  • "id": "cs8i4ug6lnn4g9hqv7mg",
  • "name": "myapp.example.nexuslink.app",
  • "domain": "myapp.example.nexuslink.app",
  • "mode": "http",
  • "listen_port": 8443,
  • "port_auto_assigned": false,
  • "proxy_cluster": "eu.proxy.nexuslink2.com",
  • "targets": [
    ],
  • "enabled": true,
  • "terminated": false,
  • "pass_host_header": false,
  • "rewrite_redirects": false,
  • "auth": {
    },
  • "access_restrictions": {
    },
  • "meta": {
    },
  • "private": false,
  • "access_groups": [
    ]
}

Delete a Custom domain

Delete an existing service custom domain

Authorizations:
BearerAuthTokenAuth
path Parameters
domainId
required
string

The custom domain ID

Responses

Validate a custom domain

Trigger domain ownership validation for a custom domain

Authorizations:
BearerAuthTokenAuth
path Parameters
domainId
required
string

The custom domain ID

Responses

Instance

Instance setup and status endpoints for initial configuration.

Get Instance Status

Returns the instance status including whether initial setup is required. This endpoint does not require authentication.

Responses

Response samples

Content type
application/json
{
  • "setup_required": true
}

Get Version Info

Returns version information for NexusLink components including the current management server version and latest available versions from GitHub.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "management_current_version": "0.35.0",
  • "dashboard_available_version": "2.10.0",
  • "management_available_version": "0.35.0",
  • "management_update_available": true
}

Setup Instance

Creates the initial admin user for the instance. This endpoint does not require authentication but only works when setup is required (no accounts exist and embedded IDP is enabled).

When the management server is started with NB_SETUP_PAT_ENABLED=true and the request includes create_pat: true, the endpoint also provisions the NexusLink account for the new owner user and returns the plain text Personal Access Token in personal_access_token. The optional pat_expire_in value applies only when create_pat is true and defaults to 1 day when omitted. If a post-user step fails, setup-created resources are rolled back when safe; if account cleanup fails, the owner user is left in place to avoid leaving an account without its admin user.

Request Body schema: application/json
required

Initial admin user details

email
required
string

Email address for the admin user

password
required
string <password> >= 8 characters

Password for the admin user (minimum 8 characters)

name
required
string

Display name for the admin user (defaults to email if not provided)

create_pat
boolean

If true and the server has setup-time PAT issuance enabled (NB_SETUP_PAT_ENABLED=true), create a Personal Access Token for the new owner user and return it in the response. Ignored when the server feature is disabled.

pat_expire_in
integer [ 1 .. 365 ]
Default: 1

Expiration of the Personal Access Token in days. Applies only when create_pat is true and the server feature is enabled. Defaults to 1 day when omitted.

Responses

Request samples

Content type
application/json
{
  • "email": "admin@example.com",
  • "password": "securepassword123",
  • "name": "Admin User",
  • "create_pat": true,
  • "pat_expire_in": 30
}

Response samples

Content type
application/json
{
  • "user_id": "abc123def456",
  • "email": "admin@example.com",
  • "personal_access_token": "nbp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Jobs

Interact with and view information about remote jobs.

List Jobs

Retrieve all jobs for a given peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create Job

Create a new job for a given peer

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

Request Body schema: application/json
required

Create job request

required
object (WorkloadRequest)

Responses

Request samples

Content type
application/json
{
  • "workload": {
    }
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "completed_at": "2019-08-24T14:15:22Z",
  • "triggered_by": "string",
  • "status": "pending",
  • "failed_reason": "string",
  • "workload": {
    }
}

Get Job

Retrieve details of a specific job

Authorizations:
BearerAuthTokenAuth
path Parameters
peerId
required
string

The unique identifier of a peer

jobId
required
string

The unique identifier of a job

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "completed_at": "2019-08-24T14:15:22Z",
  • "triggered_by": "string",
  • "status": "pending",
  • "failed_reason": "string",
  • "workload": {
    }
}

Usage

Retrieve current usage statistics for the account.

Get current usage

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "active_users": 15,
  • "total_users": 20,
  • "active_peers": 10,
  • "total_peers": 25
}

Subscription

Manage and view information about account subscriptions.

Get current subscription

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "plan_tier": "basic",
  • "price_id": "price_1HhxOpBzq4JbCqRmJxkpzL2V",
  • "remaining_trial": 3600,
  • "features": [
    ],
  • "currency": "USD",
  • "price": 1000,
  • "provider": [
    ],
  • "updated_at": "2021-08-01T12:00:00Z"
}

Change subscription

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
priceID
string

The Price ID to change the subscription to.

plan_tier
string

The plan tier to change the subscription to.

Responses

Request samples

Content type
application/json
{
  • "priceID": "price_1HhxOpBzq4JbCqRmJxkpzL2V",
  • "plan_tier": "business"
}

Plans

Retrieve available plans and products.

Get available plans

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Checkout

Manage checkout sessions for plan subscriptions.

Create checkout session

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
baseURL
required
string

The base URL for the redirect after checkout.

priceID
required
string

The Price ID for checkout.

enableTrial
boolean

Enables a 14-day trial for the account.

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{}

AWS Marketplace

Manage AWS Marketplace subscriptions.

Activate AWS Marketplace subscription.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
plan_tier
required
string

The plan tier to activate the subscription for.

Responses

Request samples

Content type
application/json
{
  • "plan_tier": "business"
}

Enrich AWS Marketplace subscription with Account ID.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
aws_user_id
required
string

The AWS user ID.

Responses

Request samples

Content type
application/json
{
  • "aws_user_id": "eRF345hgdgFyu"
}

Portal

Access customer portal for subscription management.

Get customer portal URL

Authorizations:
BearerAuthTokenAuth
query Parameters
baseURL
required
string
Example: baseURL=https://app.nexuslink2.com/plans

The base URL for the redirect after accessing the portal.

Responses

Response samples

Content type
application/json
{}

Invoice

Manage and retrieve account invoices.

Get account's paid invoices

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get account invoice URL to Stripe.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of the invoice

Responses

Get account invoice CSV.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of the invoice

Responses

Response samples

Content type
text/csv
description,qty,unit_price,amount
line item 2, 5, 1.00, 5.00
line item 1, 10, 0.50, 5.00

MSP

MSP portal for Tenant management.

Get MSP tenants

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create MSP tenant

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
name
required
string

The name for the MSP tenant

domain
required
string

The name for the MSP tenant

required
Array of objects (TenantGroupResponse)

MSP users Groups that can access the Tenant and Roles to assume

Responses

Request samples

Content type
application/json
{
  • "name": "My new tenant",
  • "domain": "tenant.com",
  • "groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "My new tenant",
  • "domain": "tenant.com",
  • "groups": [
    ],
  • "activated_at": "2021-08-01T12:00:00Z",
  • "dns_challenge": "YXNkYSBkYXNhc2Rhc2RhIGFzZGFzZDJhc2QyNDUxNQ",
  • "created_at": "2021-08-01T12:00:00Z",
  • "updated_at": "2021-08-01T12:00:00Z",
  • "invited_at": "2021-08-01T12:00:00Z",
  • "status": "active"
}

Update MSP tenant

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of a tenant account

Request Body schema: application/json
required
name
required
string

The name for the MSP tenant

required
Array of objects (TenantGroupResponse)

MSP users Groups that can access the Tenant and Roles to assume

Responses

Request samples

Content type
application/json
{
  • "name": "My new tenant",
  • "groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "My new tenant",
  • "domain": "tenant.com",
  • "groups": [
    ],
  • "activated_at": "2021-08-01T12:00:00Z",
  • "dns_challenge": "YXNkYSBkYXNhc2Rhc2RhIGFzZGFzZDJhc2QyNDUxNQ",
  • "created_at": "2021-08-01T12:00:00Z",
  • "updated_at": "2021-08-01T12:00:00Z",
  • "invited_at": "2021-08-01T12:00:00Z",
  • "status": "active"
}

Unlink a tenant

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of a tenant account

Request Body schema: application/json
required
owner
required
string

The new owners user ID.

Responses

Request samples

Content type
application/json
{
  • "owner": "google-oauth2|123456789012345678901"
}

Verify a tenant domain DNS challenge

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of a tenant account

Responses

Response samples

Content type
application/json
{
  • "dns_challenge": "YXNkYSBkYXNhc2Rhc2RhIGFzZGFzZDJhc2QyNDUxNQ"
}

Create subscription for Tenant

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of a tenant account

Request Body schema: application/json
required
priceID
required
string

The Price ID to change the subscription to.

Responses

Request samples

Content type
application/json
{
  • "priceID": "price_1HhxOpBzq4JbCqRmJxkpzL2V"
}

Invite existing account as a Tenant to the MSP account

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of an existing tenant account

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "name": "My new tenant",
  • "domain": "tenant.com",
  • "groups": [
    ],
  • "activated_at": "2021-08-01T12:00:00Z",
  • "dns_challenge": "YXNkYSBkYXNhc2Rhc2RhIGFzZGFzZDJhc2QyNDUxNQ",
  • "created_at": "2021-08-01T12:00:00Z",
  • "updated_at": "2021-08-01T12:00:00Z",
  • "invited_at": "2021-08-01T12:00:00Z",
  • "status": "active"
}

Response by the invited Tenant account owner

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
string

The unique identifier of an existing tenant account

Request Body schema: application/json
required
value
required
string
Enum: "accept" "decline"

Accept or decline the invitation.

Responses

Request samples

Content type
application/json
{
  • "value": "accept"
}

IDP SCIM Integrations

Manage generic SCIM identity provider integrations for user and group sync.

Create SCIM IDP Integration

Creates a new SCIM integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

prefix
required
string

The connection prefix used for the SCIM provider

provider
required
string

Name of the SCIM identity provider

Responses

Request samples

Content type
application/json
{
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "prefix": "string",
  • "provider": "string"
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 123,
  • "prefix": "string",
  • "provider": "string",
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Get All SCIM IDP Integrations

Retrieves all SCIM IDP integrations for the authenticated account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get SCIM IDP Integration

Retrieves an SCIM IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the SCIM IDP integration.

Responses

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 123,
  • "prefix": "string",
  • "provider": "string",
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Update SCIM IDP Integration

Updates an existing SCIM IDP Integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the SCIM IDP integration.

Request Body schema: application/json
required
enabled
boolean

Whether the integration is enabled

group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

prefix
string

The connection prefix used for the SCIM provider

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "prefix": "string"
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 123,
  • "prefix": "string",
  • "provider": "string",
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Delete SCIM IDP Integration

Deletes an SCIM IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the SCIM IDP integration.

Responses

Response samples

Content type
application/json
{ }

Regenerate SCIM Token

Regenerates the SCIM API token for an SCIM IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the SCIM IDP integration.

Responses

Response samples

Content type
application/json
{
  • "auth_token": "nbs_F3f0d..."
}

Get SCIM Integration Sync Logs

Retrieves synchronization logs for a SCIM IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the SCIM IDP integration.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

IDP Google Integrations

Manage Google Workspace identity provider integrations for user and group sync.

Create Google IDP Integration

Creates a new Google Workspace IDP integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

service_account_key
required
string

Base64-encoded Google service account key

customer_id
required
string

Customer ID from Google Workspace Account Settings

sync_interval
integer >= 300

Sync interval in seconds (minimum 300). Defaults to 300 if not specified.

Responses

Request samples

Content type
application/json
{
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "service_account_key": "eyJ0eXBlIjoic2VydmljZV9hY2NvdW50Ii...",
  • "customer_id": "C01234567",
  • "sync_interval": 300
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "customer_id": "C01234567",
  • "sync_interval": 300,
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Get All Google IDP Integrations

Retrieves all Google Workspace IDP integrations for the authenticated account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Google IDP Integration

Retrieves a Google IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Google IDP integration.

Responses

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "customer_id": "C01234567",
  • "sync_interval": 300,
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Update Google IDP Integration

Updates an existing Google Workspace IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Google IDP integration.

Request Body schema: application/json
required
enabled
boolean

Whether the integration is enabled

group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

service_account_key
string

Base64-encoded Google service account key

customer_id
string

Customer ID from Google Workspace Account Settings

sync_interval
integer >= 300

Sync interval in seconds (minimum 300)

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "service_account_key": "string",
  • "customer_id": "string",
  • "sync_interval": 300
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "customer_id": "C01234567",
  • "sync_interval": 300,
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Delete Google IDP Integration

Deletes a Google IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Google IDP integration.

Responses

Response samples

Content type
application/json
{ }

Sync Google IDP Integration

Triggers a manual synchronization for a Google IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Google IDP integration.

Responses

Response samples

Content type
application/json
{
  • "result": "ok"
}

Get Google Integration Sync Logs

Retrieves synchronization logs for a Google IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Google IDP integration.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

IDP Azure Integrations

Manage Azure AD identity provider integrations for user and group sync.

Create Azure IDP Integration

Creates a new Azure AD IDP integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

client_secret
required
string

Base64-encoded Azure AD client secret

client_id
required
string

Azure AD application (client) ID

tenant_id
required
string

Azure AD tenant ID

sync_interval
integer >= 300

Sync interval in seconds (minimum 300). Defaults to 300 if not specified.

host
required
string
Enum: "microsoft.com" "microsoft.us"

Azure host domain for the Graph API

Responses

Request samples

Content type
application/json
{
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "client_secret": "c2VjcmV0...",
  • "client_id": "12345678-1234-1234-1234-123456789012",
  • "tenant_id": "87654321-4321-4321-4321-210987654321",
  • "sync_interval": 300,
  • "host": "microsoft.com"
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "client_id": "12345678-1234-1234-1234-123456789012",
  • "tenant_id": "87654321-4321-4321-4321-210987654321",
  • "sync_interval": 300,
  • "host": "microsoft.com",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Get All Azure IDP Integrations

Retrieves all Azure AD IDP integrations for the authenticated account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Azure IDP Integration

Retrieves an Azure IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Azure IDP integration.

Responses

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "client_id": "12345678-1234-1234-1234-123456789012",
  • "tenant_id": "87654321-4321-4321-4321-210987654321",
  • "sync_interval": 300,
  • "host": "microsoft.com",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Update Azure IDP Integration

Updates an existing Azure AD IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Azure IDP integration.

Request Body schema: application/json
required
enabled
boolean

Whether the integration is enabled

group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

client_secret
string

Base64-encoded Azure AD client secret

client_id
string

Azure AD application (client) ID

tenant_id
string

Azure AD tenant ID

sync_interval
integer >= 300

Sync interval in seconds (minimum 300)

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "client_secret": "string",
  • "client_id": "string",
  • "tenant_id": "string",
  • "sync_interval": 300
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "client_id": "12345678-1234-1234-1234-123456789012",
  • "tenant_id": "87654321-4321-4321-4321-210987654321",
  • "sync_interval": 300,
  • "host": "microsoft.com",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Delete Azure IDP Integration

Deletes an Azure IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Azure IDP integration.

Responses

Response samples

Content type
application/json
{ }

Sync Azure IDP Integration

Triggers a manual synchronization for an Azure IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Azure IDP integration.

Responses

Response samples

Content type
application/json
{
  • "result": "ok"
}

Get Azure Integration Sync Logs

Retrieves synchronization logs for an Azure IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Azure IDP integration.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

IDP Okta SCIM Integrations

Manage Okta SCIM identity provider integrations for user and group sync.

Create Okta SCIM IDP Integration

Creates a new Okta SCIM IDP integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

connection_name
required
string

The Okta enterprise connection name on Auth0

Responses

Request samples

Content type
application/json
{
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "connection_name": "my-okta-connection"
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Get All Okta SCIM IDP Integrations

Retrieves all Okta SCIM IDP integrations for the authenticated account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Okta SCIM IDP Integration

Retrieves an Okta SCIM IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Okta SCIM IDP integration.

Responses

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Update Okta SCIM IDP Integration

Updates an existing Okta SCIM IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Okta SCIM IDP integration.

Request Body schema: application/json
required
enabled
boolean

Whether the integration is enabled

group_prefixes
Array of strings

List of start_with string patterns for groups to sync

user_group_prefixes
Array of strings

List of start_with string patterns for groups which users to sync

connector_id
string

DEX connector ID for embedded IDP setups

Responses

Request samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string"
}

Response samples

Content type
application/json
{
  • "enabled": true,
  • "group_prefixes": [
    ],
  • "user_group_prefixes": [
    ],
  • "connector_id": "string",
  • "id": 1,
  • "auth_token": "nbs_abc***********************************",
  • "last_synced_at": "2023-05-15T10:30:00Z"
}

Delete Okta SCIM IDP Integration

Deletes an Okta SCIM IDP integration by ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Okta SCIM IDP integration.

Responses

Response samples

Content type
application/json
{ }

Regenerate Okta SCIM Token

Regenerates the SCIM API token for an Okta SCIM IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Okta SCIM IDP integration.

Responses

Response samples

Content type
application/json
{
  • "auth_token": "nbs_F3f0d..."
}

Get Okta SCIM Integration Sync Logs

Retrieves synchronization logs for an Okta SCIM IDP integration.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer <int64>
Example: 1

The unique identifier of the Okta SCIM IDP integration.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

EDR Intune Integrations

Manage Microsoft Intune EDR integrations.

Create EDR Intune Integration

Creates a new EDR Intune integration for the authenticated account.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
client_id
required
string

The Azure application client id

tenant_id
required
string

The Azure tenant id

secret
required
string

The Azure application client secret

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours.

enabled
boolean
Default: true

Indicates whether the integration is enabled

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "tenant_id": "string",
  • "secret": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "client_id": "acc_abcdef123456",
  • "tenant_id": "acc_abcdef123456",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true
}

Get EDR Intune Integration

Retrieves a specific EDR Intune integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "client_id": "acc_abcdef123456",
  • "tenant_id": "acc_abcdef123456",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true
}

Update EDR Intune Integration

Updates an existing EDR Intune Integration. The request body structure is EDRIntuneRequest.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
client_id
required
string

The Azure application client id

tenant_id
required
string

The Azure tenant id

secret
required
string

The Azure application client secret

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours.

enabled
boolean
Default: true

Indicates whether the integration is enabled

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "tenant_id": "string",
  • "secret": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "client_id": "acc_abcdef123456",
  • "tenant_id": "acc_abcdef123456",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true
}

Delete EDR Intune Integration

Deletes an EDR Intune Integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{ }

EDR SentinelOne Integrations

Manage SentinelOne EDR integrations.

Create EDR SentinelOne Integration

Creates a new EDR SentinelOne integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_token
required
string

SentinelOne API token

api_url
required
string

The Base URL of SentinelOne API

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours.

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (SentinelOneMatchAttributes)

Attribute conditions to match when approving agents

Responses

Request samples

Content type
application/json
{
  • "api_token": "string",
  • "api_url": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "api_url": "string",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "match_attributes": {
    },
  • "enabled": true
}

Get EDR SentinelOne Integration

Retrieves a specific EDR SentinelOne integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "api_url": "string",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "match_attributes": {
    },
  • "enabled": true
}

Update EDR SentinelOne Integration

Updates an existing EDR SentinelOne Integration.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_token
required
string

SentinelOne API token

api_url
required
string

The Base URL of SentinelOne API

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours.

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (SentinelOneMatchAttributes)

Attribute conditions to match when approving agents

Responses

Request samples

Content type
application/json
{
  • "api_token": "string",
  • "api_url": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "api_url": "string",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "match_attributes": {
    },
  • "enabled": true
}

Delete EDR SentinelOne Integration

Deletes an EDR SentinelOne Integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{ }

EDR Falcon Integrations

Manage CrowdStrike Falcon EDR integrations.

Create EDR Falcon Integration

Creates a new EDR Falcon integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
client_id
required
string

CrowdStrike API client ID

secret
required
string

CrowdStrike API client secret

cloud_id
required
string

CrowdStrike cloud identifier (e.g., "us-1", "us-2", "eu-1")

groups
required
Array of strings

The Groups this integration applies to

zta_score_threshold
required
integer [ 0 .. 100 ]

The minimum Zero Trust Assessment score required for agent approval (0-100)

enabled
boolean
Default: true

Indicates whether the integration is enabled

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "secret": "string",
  • "cloud_id": "string",
  • "groups": [
    ],
  • "zta_score_threshold": 75,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "cloud_id": "string",
  • "groups": [
    ],
  • "zta_score_threshold": 0,
  • "enabled": true
}

Get EDR Falcon Integration

Retrieves a specific EDR Falcon integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "cloud_id": "string",
  • "groups": [
    ],
  • "zta_score_threshold": 0,
  • "enabled": true
}

Update EDR Falcon Integration

Updates an existing EDR Falcon Integration.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
client_id
required
string

CrowdStrike API client ID

secret
required
string

CrowdStrike API client secret

cloud_id
required
string

CrowdStrike cloud identifier (e.g., "us-1", "us-2", "eu-1")

groups
required
Array of strings

The Groups this integration applies to

zta_score_threshold
required
integer [ 0 .. 100 ]

The minimum Zero Trust Assessment score required for agent approval (0-100)

enabled
boolean
Default: true

Indicates whether the integration is enabled

Responses

Request samples

Content type
application/json
{
  • "client_id": "string",
  • "secret": "string",
  • "cloud_id": "string",
  • "groups": [
    ],
  • "zta_score_threshold": 75,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "cloud_id": "string",
  • "groups": [
    ],
  • "zta_score_threshold": 0,
  • "enabled": true
}

Delete EDR Falcon Integration

Deletes an existing EDR Falcon Integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "message": "couldn't parse JSON request"
}

EDR Huntress Integrations

Manage Huntress EDR integrations.

Create EDR Huntress Integration

Creates a new EDR Huntress integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_key
required
string

Huntress API key

api_secret
required
string

Huntress API secret

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (HuntressMatchAttributes)

Attribute conditions to match when approving agents

Responses

Request samples

Content type
application/json
{
  • "api_key": "string",
  • "api_secret": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Get EDR Huntress Integration

Retrieves a specific EDR Huntress integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Update EDR Huntress Integration

Updates an existing EDR Huntress Integration.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_key
required
string

Huntress API key

api_secret
required
string

Huntress API secret

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (HuntressMatchAttributes)

Attribute conditions to match when approving agents

Responses

Request samples

Content type
application/json
{
  • "api_key": "string",
  • "api_secret": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Delete EDR Huntress Integration

Deletes an EDR Huntress Integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{ }

EDR FleetDM Integrations

Manage FleetDM EDR integrations.

Create EDR FleetDM Integration

Creates a new EDR FleetDM integration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_url
required
string

FleetDM server URL

api_token
required
string

FleetDM API token

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (FleetDMMatchAttributes)

Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly

Responses

Request samples

Content type
application/json
{
  • "api_url": "string",
  • "api_token": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "api_url": "string",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Get EDR FleetDM Integration

Retrieves a specific EDR FleetDM integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "api_url": "string",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Update EDR FleetDM Integration

Updates an existing EDR FleetDM Integration.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
api_url
required
string

FleetDM server URL

api_token
required
string

FleetDM API token

groups
required
Array of strings

The Groups this integrations applies to

last_synced_interval
required
integer >= 24

The devices last sync requirement interval in hours. Minimum value is 24 hours

enabled
boolean
Default: true

Indicates whether the integration is enabled

required
object (FleetDMMatchAttributes)

Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly

Responses

Request samples

Content type
application/json
{
  • "api_url": "string",
  • "api_token": "string",
  • "groups": [
    ],
  • "last_synced_interval": 24,
  • "enabled": true,
  • "match_attributes": {
    }
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "ch8i4ug6lnn4g9hqv7l0",
  • "api_url": "string",
  • "last_synced_at": "2023-05-15T10:30:00Z",
  • "created_by": "string",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "groups": [
    ],
  • "last_synced_interval": 0,
  • "enabled": true,
  • "match_attributes": {
    }
}

Delete EDR FleetDM Integration

Deletes an EDR FleetDM Integration by its ID.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{ }

EDR Peers

Manage EDR compliance bypass for peers.

Bypass compliance for a non-compliant peer

Allows an admin to bypass EDR compliance checks for a specific peer. The peer will remain bypassed until the admin revokes it OR the device becomes naturally compliant in the EDR system.

Authorizations:
BearerAuthTokenAuth
path Parameters
peer-id
required
string

The unique identifier of the peer

Responses

Response samples

Content type
application/json
{
  • "peer_id": "chacbco6lnnbn6cg5s91"
}

Revoke compliance bypass for a peer

Removes the compliance bypass, subjecting the peer to normal EDR validation.

Authorizations:
BearerAuthTokenAuth
path Parameters
peer-id
required
string

The unique identifier of the peer

Responses

Response samples

Content type
application/json
{
  • "message": "couldn't parse JSON request"
}

List all bypassed peers

Returns all peers that have compliance bypassed by an admin.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Event Streaming Integrations

Manage event streaming integrations.

Create Event Streaming Integration

Creates a new event streaming integration for the authenticated account. The request body should conform to CreateIntegrationRequest. Note: Based on the provided Go code, the enabled field from the request is part of the CreateIntegrationRequest struct, but the backend manager.CreateIntegration function signature shown does not directly use this enabled field. The actual behavior for enabled during creation should be confirmed (e.g., it might have a server-side default or be handled by other logic).

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
platform
required
string
Enum: "datadog" "s3" "firehose" "generic_http"

The event streaming platform to integrate with (e.g., "datadog", "s3", "firehose"). This field is used for creation. For updates (PUT), this field, if sent, is ignored by the backend.

required
object

Platform-specific configuration as key-value pairs. For creation, all necessary credentials and settings must be provided. For updates, provide the fields to change or the entire new configuration.

enabled
required
boolean

Specifies whether the integration is enabled. During creation (POST), this value is sent by the client, but the provided backend manager function CreateIntegration does not appear to use it directly, so its effect on creation should be verified. During updates (PUT), this field is used to enable or disable the integration.

Responses

Request samples

Content type
application/json
{
  • "platform": "s3",
  • "config": {
    },
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "enabled": true,
  • "platform": "datadog",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "config": {
    }
}

List Event Streaming Integrations

Retrieves all event streaming integrations for the authenticated account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Event Streaming Integration

Retrieves a specific event streaming integration by its ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer
Example: 123

The unique numeric identifier of the event streaming integration.

Responses

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "enabled": true,
  • "platform": "datadog",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "config": {
    }
}

Update Event Streaming Integration

Updates an existing event streaming integration. The request body structure is CreateIntegrationRequest. However, for updates:

  • The platform field, if provided in the body, is ignored by the backend manager function, as the platform of an existing integration is typically immutable.
  • The enabled and config fields from the request body are used to update the integration.
Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer
Example: 123

The unique numeric identifier of the event streaming integration.

Request Body schema: application/json
required
platform
required
string
Enum: "datadog" "s3" "firehose" "generic_http"

The event streaming platform to integrate with (e.g., "datadog", "s3", "firehose"). This field is used for creation. For updates (PUT), this field, if sent, is ignored by the backend.

required
object

Platform-specific configuration as key-value pairs. For creation, all necessary credentials and settings must be provided. For updates, provide the fields to change or the entire new configuration.

enabled
required
boolean

Specifies whether the integration is enabled. During creation (POST), this value is sent by the client, but the provided backend manager function CreateIntegration does not appear to use it directly, so its effect on creation should be verified. During updates (PUT), this field is used to enable or disable the integration.

Responses

Request samples

Content type
application/json
{
  • "platform": "s3",
  • "config": {
    },
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": 123,
  • "account_id": "acc_abcdef123456",
  • "enabled": true,
  • "platform": "datadog",
  • "created_at": "2023-05-15T10:30:00Z",
  • "updated_at": "2023-05-16T11:45:00Z",
  • "config": {
    }
}

Delete Event Streaming Integration

Deletes an event streaming integration by its ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
id
required
integer
Example: 123

The unique numeric identifier of the event streaming integration.

Responses

Response samples

Content type
application/json
{ }

Notifications

Manage notification channels for account event alerts.

List Notification Event Types

Returns a map of all supported activity event type codes to their human-readable descriptions. Use these codes when configuring event_types on notification channels.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "user.join": "User joined"
}

List Notification Channels

Retrieves all notification channels configured for the authenticated account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create Notification Channel

Creates a new notification channel for the authenticated account. Supported channel types are email and webhook.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
type
required
string (NotificationChannelType)
Enum: "email" "webhook"

The type of notification channel.

EmailTarget (object) or WebhookTarget (object)

Channel-specific target configuration. The shape depends on the type field:

  • email: requires an EmailTarget object
  • webhook: requires a WebhookTarget object
event_types
required
Array of strings (NotificationEventType)

List of activity event type codes this channel subscribes to.

enabled
required
boolean

Whether this notification channel is active.

Responses

Request samples

Content type
application/json
{
  • "type": "email",
  • "target": {
    },
  • "event_types": [
    ],
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "type": "email",
  • "target": {
    },
  • "event_types": [
    ],
  • "enabled": true
}

Get Notification Channel

Retrieves a specific notification channel by its ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
channelId
required
string
Example: ch8i4ug6lnn4g9hqv7m0

The unique identifier of the notification channel.

Responses

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "type": "email",
  • "target": {
    },
  • "event_types": [
    ],
  • "enabled": true
}

Update Notification Channel

Updates an existing notification channel.

Authorizations:
BearerAuthTokenAuth
path Parameters
channelId
required
string
Example: ch8i4ug6lnn4g9hqv7m0

The unique identifier of the notification channel.

Request Body schema: application/json
required
type
required
string (NotificationChannelType)
Enum: "email" "webhook"

The type of notification channel.

EmailTarget (object) or WebhookTarget (object)

Channel-specific target configuration. The shape depends on the type field:

  • email: requires an EmailTarget object
  • webhook: requires a WebhookTarget object
event_types
required
Array of strings (NotificationEventType)

List of activity event type codes this channel subscribes to.

enabled
required
boolean

Whether this notification channel is active.

Responses

Request samples

Content type
application/json
{
  • "type": "email",
  • "target": {
    },
  • "event_types": [
    ],
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": "ch8i4ug6lnn4g9hqv7m0",
  • "type": "email",
  • "target": {
    },
  • "event_types": [
    ],
  • "enabled": true
}

Delete Notification Channel

Deletes a notification channel by its ID.

Authorizations:
BearerAuthTokenAuth
path Parameters
channelId
required
string
Example: ch8i4ug6lnn4g9hqv7m0

The unique identifier of the notification channel.

Responses

Response samples

Content type
application/json
{ }

Networks

List all Networks

Returns a list of all networks

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Network

Creates a Network

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New Network request

name
required
string

Network name

description
string

Network description

Responses

Request samples

Content type
application/json
{
  • "name": "Remote Network 1",
  • "description": "A remote network that needs to be accessed"
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "routers": [
    ],
  • "routing_peers_count": 2,
  • "resources": [
    ],
  • "policies": [
    ],
  • "name": "Remote Network 1",
  • "description": "A remote network that needs to be accessed"
}

Retrieve a Network

Get information about a Network

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Responses

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "routers": [
    ],
  • "routing_peers_count": 2,
  • "resources": [
    ],
  • "policies": [
    ],
  • "name": "Remote Network 1",
  • "description": "A remote network that needs to be accessed"
}

Update a Network

Update/Replace a Network

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Request Body schema: application/json

Update Network request

name
required
string

Network name

description
string

Network description

Responses

Request samples

Content type
application/json
{
  • "name": "Remote Network 1",
  • "description": "A remote network that needs to be accessed"
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "routers": [
    ],
  • "routing_peers_count": 2,
  • "resources": [
    ],
  • "policies": [
    ],
  • "name": "Remote Network 1",
  • "description": "A remote network that needs to be accessed"
}

Delete a Network

Delete a network

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Responses

List all Network Resources

Returns a list of all resources in a network

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Network Resource

Creates a Network Resource

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Request Body schema: application/json

New Network Resource request

name
required
string

Network resource name

description
string

Network resource description

address
required
string

Network resource address (either a direct host like 1.1.1.1 or 1.1.1.1/32, or a subnet like 192.168.178.0/24, or domains like example.com and *.example.com)

enabled
required
boolean

Network resource status

groups
required
Array of strings

Group IDs containing the resource

Responses

Request samples

Content type
application/json
{
  • "name": "Remote Resource 1",
  • "description": "A remote resource inside network 1",
  • "address": "1.1.1.1",
  • "enabled": true,
  • "groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "type": "host",
  • "groups": [
    ],
  • "name": "Remote Resource 1",
  • "description": "A remote resource inside network 1",
  • "address": "1.1.1.1",
  • "enabled": true
}

Retrieve a Network Resource

Get information about a Network Resource

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

resourceId
required
string

The unique identifier of a network resource

Responses

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "type": "host",
  • "groups": [
    ],
  • "name": "Remote Resource 1",
  • "description": "A remote resource inside network 1",
  • "address": "1.1.1.1",
  • "enabled": true
}

Update a Network Resource

Update a Network Resource

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

resourceId
required
string

The unique identifier of a resource

Request Body schema: application/json

Update Network Resource request

name
required
string

Network resource name

description
string

Network resource description

address
required
string

Network resource address (either a direct host like 1.1.1.1 or 1.1.1.1/32, or a subnet like 192.168.178.0/24, or domains like example.com and *.example.com)

enabled
required
boolean

Network resource status

groups
required
Array of strings

Group IDs containing the resource

Responses

Request samples

Content type
application/json
{
  • "name": "Remote Resource 1",
  • "description": "A remote resource inside network 1",
  • "address": "1.1.1.1",
  • "enabled": true,
  • "groups": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "type": "host",
  • "groups": [
    ],
  • "name": "Remote Resource 1",
  • "description": "A remote resource inside network 1",
  • "address": "1.1.1.1",
  • "enabled": true
}

Delete a Network Resource

Delete a network resource

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

resourceId
required
string

The unique identifier of a network resource

Responses

List all Network Routers

Returns a list of all routers in a network

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Network Router

Creates a Network Router

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

Request Body schema: application/json

New Network Router request

peer
string

Peer Identifier associated with route. This property can not be set together with peer_groups

peer_groups
Array of strings

Peers Group Identifier associated with route. This property can not be set together with peer

metric
required
integer [ 1 .. 9999 ]

Route metric number. Lowest number has higher priority

masquerade
required
boolean

Indicate if peer should masquerade traffic to this route's prefix

enabled
required
boolean

Network router status

Responses

Request samples

Content type
application/json
{
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "enabled": true
}

Retrieve a Network Router

Get information about a Network Router

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

routerId
required
string

The unique identifier of a router

Responses

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "enabled": true
}

Update a Network Router

Update a Network Router

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

routerId
required
string

The unique identifier of a router

Request Body schema: application/json

Update Network Router request

peer
string

Peer Identifier associated with route. This property can not be set together with peer_groups

peer_groups
Array of strings

Peers Group Identifier associated with route. This property can not be set together with peer

metric
required
integer [ 1 .. 9999 ]

Route metric number. Lowest number has higher priority

masquerade
required
boolean

Indicate if peer should masquerade traffic to this route's prefix

enabled
required
boolean

Network router status

Responses

Request samples

Content type
application/json
{
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "enabled": true
}

Response samples

Content type
application/json
{
  • "id": "chacdk86lnnboviihd7g",
  • "peer": "chacbco6lnnbn6cg5s91",
  • "peer_groups": [
    ],
  • "metric": 9999,
  • "masquerade": true,
  • "enabled": true
}

Delete a Network Router

Delete a network router

Authorizations:
BearerAuthTokenAuth
path Parameters
networkId
required
string

The unique identifier of a network

routerId
required
string

The unique identifier of a router

Responses

List all Network Routers

Returns a list of all routers in a network

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Geo Locations

List all country codes

Get list of all country in 2-letter ISO 3166-1 alpha-2 codes

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • "DE"
]

List all city names by country

Get a list of all English city names for a given country code

Authorizations:
BearerAuthTokenAuth
path Parameters
required
object (Country)

Describe country geographical location information

Responses

Response samples

Content type
application/json
{
  • "geoname_id": 2950158,
  • "city_name": "Berlin"
}

Self-Hosted Proxies

List Proxy Tokens

Returns all proxy access tokens for the account

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Proxy Token

Generate an account-scoped proxy access token for self-hosted proxy registration

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
name
required
string

Human-readable token name

expires_in
integer >= 0

Token expiration in seconds (0 = never expires)

Responses

Request samples

Content type
application/json
{
  • "name": "my-proxy-token",
  • "expires_in": 0
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "created_at": "2019-08-24T14:15:22Z",
  • "last_used": "2019-08-24T14:15:22Z",
  • "revoked": true,
  • "plain_token": "nbx_abc123..."
}

Revoke a Proxy Token

Revoke an account-scoped proxy access token

Authorizations:
BearerAuthTokenAuth
path Parameters
tokenId
required
string

The unique identifier of the proxy token

Responses

Agent Network

Provision a managed Agent Network gateway

Starts provisioning of a NexusLink-managed Agent Network gateway for the account, allocating its endpoint under the managed zone on the first call. Idempotent — answers 202 when this call started (or, after a failure, restarted) provisioning and 200 when a deployment already exists, reporting current state either way. Returns 409 when the account already has an Agent Network endpoint that managed provisioning does not own, and 503 when endpoint allocation is temporarily exhausted.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": "d1m3kebd9pcs0c1pnu7g",
  • "state": "ready",
  • "endpoint": "brave-otter.gateway.nexuslink2.com",
  • "region": "us-east",
  • "message": "string"
}

Retrieve managed Agent Network gateway status

Reports the account's managed gateway deployment and its derived state. Returns 404 when the account has no managed deployment.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "id": "d1m3kebd9pcs0c1pnu7g",
  • "state": "ready",
  • "endpoint": "brave-otter.gateway.nexuslink2.com",
  • "region": "us-east",
  • "message": "string"
}

List Agent Network access logs

Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).

Authorizations:
BearerAuthTokenAuth
query Parameters
page
integer >= 1
Default: 1

Page number for pagination (1-indexed).

page_size
integer [ 1 .. 100 ]
Default: 50

Number of items per page (max 100).

sort_by
string
Default: "timestamp"
Enum: "timestamp" "model" "provider" "status_code" "duration" "cost_usd" "total_tokens" "user_id" "decision"

Field to sort by.

sort_order
string
Default: "desc"
Enum: "asc" "desc"

Sort order (ascending or descending).

search
string

General search across log ID, host, path, model, and user email/name.

user_id
string

Filter by authenticated user ID.

session_id
string

Filter to a single conversation / coding session id (groups all requests of one session).

group_id
Array of strings

Filter by authorising group id. Repeat for multiple (matches any).

provider_id
Array of strings

Filter by resolved provider id. Repeat for multiple (matches any).

model
Array of strings

Filter by model. Repeat for multiple (matches any).

decision
string

Filter by policy decision (e.g. allow, deny).

path
string

Filter by request path prefix (matches entries whose path starts with this value).

start_date
string <date-time>

Filter by timestamp >= start_date (RFC3339 format).

end_date
string <date-time>

Filter by timestamp <= end_date (RFC3339 format).

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "page": 1,
  • "page_size": 50,
  • "total_records": 523,
  • "total_pages": 11
}

List Agent Network access logs grouped by session

Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).

Authorizations:
BearerAuthTokenAuth
query Parameters
page
integer >= 1
Default: 1

Page number for pagination (1-indexed).

page_size
integer [ 1 .. 100 ]
Default: 50

Number of sessions per page (max 100).

sort_by
string
Default: "timestamp"
Enum: "timestamp" "started_at" "cost_usd" "total_tokens" "duration" "request_count" "status_code" "user_id" "decision"

Session-level field to sort by. "timestamp" is the session's last activity, "started_at" its first.

sort_order
string
Default: "desc"
Enum: "asc" "desc"

Sort order (ascending or descending).

search
string

General search across log ID, host, path, model, and user email/name.

user_id
string

Filter by authenticated user ID.

session_id
string

Filter to a single conversation / coding session id.

group_id
Array of strings

Filter by authorising group id. Repeat for multiple (matches any).

provider_id
Array of strings

Filter by resolved provider id. Repeat for multiple (matches any).

model
Array of strings

Filter by model. Repeat for multiple (matches any).

decision
string

Filter by policy decision (e.g. allow, deny).

path
string

Filter by request path prefix (matches entries whose path starts with this value).

start_date
string <date-time>

Filter by timestamp >= start_date (RFC3339 format).

end_date
string <date-time>

Filter by timestamp <= end_date (RFC3339 format).

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "page": 1,
  • "page_size": 50,
  • "total_records": 124,
  • "total_pages": 3
}

Agent Network usage overview

Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection). Callers without the account-wide grant are not denied - the response is scoped to their own usage (any user_id or group_id filter is overridden).

Authorizations:
BearerAuthTokenAuth
query Parameters
granularity
string
Default: "day"
Enum: "day" "week" "month"

Time bucket width. Defaults to day.

start_date
string <date-time>

Filter by timestamp >= start_date (RFC3339 format).

end_date
string <date-time>

Filter by timestamp <= end_date (RFC3339 format).

user_id
string

Filter by user ID.

session_id
string

Filter to a single conversation / coding session id.

group_id
Array of strings

Filter by authorising group id. Repeat for multiple (matches any).

provider_id
Array of strings

Filter by resolved provider id. Repeat for multiple (matches any).

model
Array of strings

Filter by model. Repeat for multiple (matches any).

Responses

Response samples

Content type
application/json
[
  • {
    }
]

List Agent Network consumption counters

Returns every per-(dimension, window) consumption counter recorded for the account, ordered window-newest-first. Empty list when nothing has been consumed yet.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Retrieve the caller's Agent Network agent config

Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "configured": true,
  • "endpoint": "https://calm-otter.proxy.example.com",
  • "providers": [
    ]
}

Retrieve Agent Network settings

Returns the per-account Agent Network gateway settings (endpoint, proxy address, collection toggles). Before the account is bootstrapped via POST, the response carries the default values with an empty endpoint and proxy address.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
{
  • "endpoint": "brave-otter.eu.proxy.nexuslink2.com",
  • "proxy_address": "eu.proxy.nexuslink2.com",
  • "dedicated": false,
  • "enable_log_collection": false,
  • "enable_prompt_collection": false,
  • "redact_pii": false,
  • "access_log_retention_days": 30,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Bootstrap Agent Network settings

Creates the per-account Agent Network settings row and allocates the account's endpoint. Exactly one of proxy_address (labeled endpoint under that cluster; the server allocates the label) and endpoint (self-addressed dedicated endpoint, claimed verbatim) must be provided. The endpoint and proxy address are immutable once assigned. Returns 409 when the account already has a settings row.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required

Settings bootstrap request

proxy_address
string

Cluster address to allocate a labeled endpoint beneath. Mutually exclusive with endpoint.

endpoint
string

Hostname to claim as the account's self-addressed (dedicated) endpoint. Mutually exclusive with proxy_address. Rejected when another account already holds it.

enable_log_collection
boolean

Whether per-request access-log entries are collected for this account's agent-network traffic. Defaults to true.

enable_prompt_collection
boolean

Master switch for request/response prompt capture. Defaults to false.

redact_pii
boolean

Whether captured prompts have PII redacted. Defaults to false.

access_log_retention_days
integer

Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Defaults to 30.

Responses

Request samples

Content type
application/json
{
  • "proxy_address": "eu.proxy.nexuslink2.com",
  • "endpoint": "brave-otter.gateway.example.com",
  • "enable_log_collection": true,
  • "enable_prompt_collection": false,
  • "redact_pii": false,
  • "access_log_retention_days": 30
}

Response samples

Content type
application/json
{
  • "endpoint": "brave-otter.eu.proxy.nexuslink2.com",
  • "proxy_address": "eu.proxy.nexuslink2.com",
  • "dedicated": false,
  • "enable_log_collection": false,
  • "enable_prompt_collection": false,
  • "redact_pii": false,
  • "access_log_retention_days": 30,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Update Agent Network settings

Updates the account-level Agent Network settings; the request carries every field, replacing the mutable ones (collection toggles and retention). Returns 404 when the account has no settings row yet — bootstrap it with POST first. The endpoint and proxy address are assigned at bootstrap and immutable; the request must carry them unchanged, and a request carrying different values is rejected.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

Settings update request

endpoint
required
string

The account's gateway endpoint hostname. Immutable — must match the assigned value; a different value is rejected.

proxy_address
required
string

Declared cluster address of the proxy serving this account's gateway. Immutable — must match the assigned value; a different value is rejected.

enable_log_collection
required
boolean

Whether per-request access-log entries are collected for this account's agent-network traffic.

enable_prompt_collection
required
boolean

Master switch for request/response prompt capture.

redact_pii
required
boolean

Whether captured prompts have PII redacted.

access_log_retention_days
required
integer

Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.

Responses

Request samples

Content type
application/json
{
  • "endpoint": "brave-otter.eu.proxy.nexuslink2.com",
  • "proxy_address": "eu.proxy.nexuslink2.com",
  • "enable_log_collection": true,
  • "enable_prompt_collection": true,
  • "redact_pii": true,
  • "access_log_retention_days": 30
}

Response samples

Content type
application/json
{
  • "endpoint": "brave-otter.eu.proxy.nexuslink2.com",
  • "proxy_address": "eu.proxy.nexuslink2.com",
  • "dedicated": false,
  • "enable_log_collection": false,
  • "enable_prompt_collection": false,
  • "redact_pii": false,
  • "access_log_retention_days": 30,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Delete Agent Network settings

Deletes the account's Agent Network settings row, releasing the endpoint. Guarded — the delete is refused with 412 while any Agent Network provider exists for the account or while a proxy is actively serving the endpoint. Bootstrapping again after a delete allocates a new endpoint; the released hostname is not reserved.

Authorizations:
BearerAuthTokenAuth

Responses

List all Agent Network budget rules

Returns all account-level budget rules.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Agent Network budget rule

Creates a new account-level budget rule.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New budget rule request

name
required
string

Display name for the budget rule.

enabled
boolean

Whether the rule is enforced. Defaults to true on create.

target_groups
Array of strings

NexusLink group ids the rule binds. Empty plus empty target_users means account-wide.

target_users
Array of strings

NexusLink user ids the rule binds directly.

required
object (AgentNetworkPolicyLimits)

Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.

Responses

Request samples

Content type
application/json
{
  • "name": "Org monthly ceiling",
  • "enabled": true,
  • "target_groups": [
    ],
  • "target_users": [ ],
  • "limits": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainbud_d1m3kebd9pcs0c1pnu7g",
  • "name": "Org monthly ceiling",
  • "enabled": true,
  • "target_groups": [
    ],
  • "target_users": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Retrieve an Agent Network budget rule

Get a specific account-level budget rule.

Authorizations:
BearerAuthTokenAuth
path Parameters
ruleId
required
string

The unique identifier of a budget rule

Responses

Response samples

Content type
application/json
{
  • "id": "ainbud_d1m3kebd9pcs0c1pnu7g",
  • "name": "Org monthly ceiling",
  • "enabled": true,
  • "target_groups": [
    ],
  • "target_users": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Update an Agent Network budget rule

Updates an existing account-level budget rule.

Authorizations:
BearerAuthTokenAuth
path Parameters
ruleId
required
string

The unique identifier of a budget rule

Request Body schema: application/json

Budget rule update request

name
required
string

Display name for the budget rule.

enabled
boolean

Whether the rule is enforced. Defaults to true on create.

target_groups
Array of strings

NexusLink group ids the rule binds. Empty plus empty target_users means account-wide.

target_users
Array of strings

NexusLink user ids the rule binds directly.

required
object (AgentNetworkPolicyLimits)

Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.

Responses

Request samples

Content type
application/json
{
  • "name": "Org monthly ceiling",
  • "enabled": true,
  • "target_groups": [
    ],
  • "target_users": [ ],
  • "limits": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainbud_d1m3kebd9pcs0c1pnu7g",
  • "name": "Org monthly ceiling",
  • "enabled": true,
  • "target_groups": [
    ],
  • "target_users": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Delete an Agent Network budget rule

Deletes an account-level budget rule.

Authorizations:
BearerAuthTokenAuth
path Parameters
ruleId
required
string

The unique identifier of a budget rule

Responses

Response samples

Content type
application/json
{ }

List Agent Network catalog providers

Returns the static catalog of supported Agent Network providers (OpenAI, Anthropic, …) along with their default upstream host, auth header template, brand color, and known models.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Discover the models a provider credential can reach

Asks the vendor which models the supplied credential can actually use, so the provider form can offer a live list instead of only the static catalog. The endpoint, auth header and response shape are taken from the catalog entry, never from the request.

Supply either an api_key together with the upstream_url being configured (before the provider is saved), or a provider_id of an existing record to reuse its stored credential.

Returns 422 for a catalog provider that has no listing endpoint (most gateways); the caller should fall back to the catalog's own model list. A model whose price the shipped table does not know is returned with pricing_known false, and the operator must set rates for it.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json
required
catalog_provider_id
required
string

Catalog provider to query (AgentNetworkCatalogProvider.id). Determines the listing endpoint, the auth header and the response shape.

upstream_url
string

The upstream being configured. Used to reach vendors that serve their listing from the same host as inference, and to read back the region for those whose host embeds one. Sent alongside provider_id, it overrides the stored upstream, so an edit can be listed against the URL on the form before it is saved.

api_key
string

Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.

provider_id
string

Existing Agent Network provider record to query with. Its stored credential is used, and its upstream unless upstream_url overrides it, so the form can refresh the list without the client holding the key.

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{
  • "models": [
    ]
}

List all Agent Network Providers

Returns a list of all Agent Network AI providers configured for the account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Agent Network Provider

Connects a new Agent Network AI provider for the account.

The credential is checked against the vendor's model listing before the provider is stored, so a record the vendor will not accept is refused rather than saved. A rejected credential, a listing endpoint that does not resolve or answer, a vendor outage, and a timeout all block the write and return 422.

What that proves about the upstream URL is narrower than the URL itself. Only its host is used: the listing is requested over HTTPS at the path the catalog entry declares, so a configured scheme or path is neither used nor validated here. Where the catalog entry has a listing host of its own — Bedrock, whose listing comes from the control plane — even the host is only resolved, never contacted, so a public host that does not answer is still stored.

Only what cannot be checked at all is exempt and stored unverified: a catalog provider with no listing endpoint, one with no host to derive a listing from, an upstream resolving to a private address the management service will not dial, and a provider configured to skip TLS verification.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New provider request

provider_id
required
string

Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).

name
required
string

Display name for the provider.

upstream_url
required
string

Full upstream URL (with scheme) that NexusLink forwards traffic to.

api_key
string

Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).

Array of objects (AgentNetworkProviderModel)

Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.

object

Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.

identity_header_user_id
string

Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.

identity_header_groups
string

Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as identity_header_user_id.

enabled
boolean

Whether the provider is enabled. Defaults to true on create.

skip_tls_verification
boolean

Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.

metadata_disabled
boolean

Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).

Responses

Request samples

Content type
application/json
{
  • "provider_id": "openai_api",
  • "name": "OpenAI API",
  • "upstream_url": "https://api.openai.com",
  • "api_key": "sk-...",
  • "models": [
    ],
  • "extra_values": {
    },
  • "identity_header_user_id": "x-bf-dim-nexuslink_user_id",
  • "identity_header_groups": "x-bf-dim-nexuslink_groups",
  • "enabled": true,
  • "skip_tls_verification": false,
  • "metadata_disabled": false
}

Response samples

Content type
application/json
{
  • "id": "ainp_d1m3kebd9pcs0c1pnu7g",
  • "provider_id": "openai_api",
  • "name": "OpenAI API",
  • "upstream_url": "https://api.openai.com",
  • "models": [
    ],
  • "extra_values": {
    },
  • "identity_header_user_id": "x-bf-dim-nexuslink_user_id",
  • "identity_header_groups": "x-bf-dim-nexuslink_groups",
  • "enabled": true,
  • "skip_tls_verification": false,
  • "metadata_disabled": false,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Retrieve an Agent Network Provider

Get information about a specific Agent Network AI provider.

Authorizations:
BearerAuthTokenAuth
path Parameters
providerId
required
string

The unique identifier of an Agent Network provider

Responses

Response samples

Content type
application/json
{
  • "id": "ainp_d1m3kebd9pcs0c1pnu7g",
  • "provider_id": "openai_api",
  • "name": "OpenAI API",
  • "upstream_url": "https://api.openai.com",
  • "models": [
    ],
  • "extra_values": {
    },
  • "identity_header_user_id": "x-bf-dim-nexuslink_user_id",
  • "identity_header_groups": "x-bf-dim-nexuslink_groups",
  • "enabled": true,
  • "skip_tls_verification": false,
  • "metadata_disabled": false,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Update an Agent Network Provider

Update an existing Agent Network AI provider.

When the upstream URL, the API key or the catalog provider changes, the record is checked against the vendor before the change is stored, and a refusal returns 422 without replacing what was there. Switching TLS verification back on is the fourth trigger: a provider exempt from the check was stored unverified, so the edit that ends the exemption is the first opportunity to check it. Where one of the four does fire, an update that omits the API key is checked against the stored one. Edits touching none of them — a rename, model rows, price edits — are stored without a check, as are the cases the create description lists as unverifiable.

Authorizations:
BearerAuthTokenAuth
path Parameters
providerId
required
string

The unique identifier of an Agent Network provider

Request Body schema: application/json

Provider update request

provider_id
required
string

Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).

name
required
string

Display name for the provider.

upstream_url
required
string

Full upstream URL (with scheme) that NexusLink forwards traffic to.

api_key
string

Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).

Array of objects (AgentNetworkProviderModel)

Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.

object

Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.

identity_header_user_id
string

Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.

identity_header_groups
string

Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as identity_header_user_id.

enabled
boolean

Whether the provider is enabled. Defaults to true on create.

skip_tls_verification
boolean

Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.

metadata_disabled
boolean

Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).

Responses

Request samples

Content type
application/json
{
  • "provider_id": "openai_api",
  • "name": "OpenAI API",
  • "upstream_url": "https://api.openai.com",
  • "api_key": "sk-...",
  • "models": [
    ],
  • "extra_values": {
    },
  • "identity_header_user_id": "x-bf-dim-nexuslink_user_id",
  • "identity_header_groups": "x-bf-dim-nexuslink_groups",
  • "enabled": true,
  • "skip_tls_verification": false,
  • "metadata_disabled": false
}

Response samples

Content type
application/json
{
  • "id": "ainp_d1m3kebd9pcs0c1pnu7g",
  • "provider_id": "openai_api",
  • "name": "OpenAI API",
  • "upstream_url": "https://api.openai.com",
  • "models": [
    ],
  • "extra_values": {
    },
  • "identity_header_user_id": "x-bf-dim-nexuslink_user_id",
  • "identity_header_groups": "x-bf-dim-nexuslink_groups",
  • "enabled": true,
  • "skip_tls_verification": false,
  • "metadata_disabled": false,
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Delete an Agent Network Provider

Delete an existing Agent Network AI provider.

Authorizations:
BearerAuthTokenAuth
path Parameters
providerId
required
string

The unique identifier of an Agent Network provider

Responses

List all Agent Network Policies

Returns a list of all Agent Network policies for the account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Agent Network Policy

Creates a new Agent Network policy binding source groups to destination providers, optionally enforced by guardrails.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New policy request

name
required
string

Display name for the policy.

description
string

Optional human-readable description.

enabled
boolean

Whether the policy is enabled. Defaults to true on create.

source_groups
required
Array of strings non-empty

NexusLink group ids whose members are allowed to call the destination providers.

destination_provider_ids
required
Array of strings non-empty

Agent Network provider ids the source groups can reach.

guardrail_ids
Array of strings

Agent Network guardrail ids to attach to this policy.

object (AgentNetworkPolicyLimits)

Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.

Responses

Request samples

Content type
application/json
{
  • "name": "Engineering → OpenAI",
  • "description": "Engineers can call OpenAI under production guardrails.",
  • "enabled": true,
  • "source_groups": [
    ],
  • "destination_provider_ids": [
    ],
  • "guardrail_ids": [ ],
  • "limits": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainpol_d1m3kebd9pcs0c1pnu7g",
  • "name": "Engineering → OpenAI",
  • "description": "Engineers can call OpenAI under production guardrails.",
  • "enabled": true,
  • "source_groups": [
    ],
  • "destination_provider_ids": [
    ],
  • "guardrail_ids": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Retrieve an Agent Network Policy

Get information about a specific Agent Network policy.

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of an Agent Network policy

Responses

Response samples

Content type
application/json
{
  • "id": "ainpol_d1m3kebd9pcs0c1pnu7g",
  • "name": "Engineering → OpenAI",
  • "description": "Engineers can call OpenAI under production guardrails.",
  • "enabled": true,
  • "source_groups": [
    ],
  • "destination_provider_ids": [
    ],
  • "guardrail_ids": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Update an Agent Network Policy

Update an existing Agent Network policy.

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of an Agent Network policy

Request Body schema: application/json

Policy update request

name
required
string

Display name for the policy.

description
string

Optional human-readable description.

enabled
boolean

Whether the policy is enabled. Defaults to true on create.

source_groups
required
Array of strings non-empty

NexusLink group ids whose members are allowed to call the destination providers.

destination_provider_ids
required
Array of strings non-empty

Agent Network provider ids the source groups can reach.

guardrail_ids
Array of strings

Agent Network guardrail ids to attach to this policy.

object (AgentNetworkPolicyLimits)

Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.

Responses

Request samples

Content type
application/json
{
  • "name": "Engineering → OpenAI",
  • "description": "Engineers can call OpenAI under production guardrails.",
  • "enabled": true,
  • "source_groups": [
    ],
  • "destination_provider_ids": [
    ],
  • "guardrail_ids": [ ],
  • "limits": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainpol_d1m3kebd9pcs0c1pnu7g",
  • "name": "Engineering → OpenAI",
  • "description": "Engineers can call OpenAI under production guardrails.",
  • "enabled": true,
  • "source_groups": [
    ],
  • "destination_provider_ids": [
    ],
  • "guardrail_ids": [ ],
  • "limits": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Delete an Agent Network Policy

Delete an existing Agent Network policy.

Authorizations:
BearerAuthTokenAuth
path Parameters
policyId
required
string

The unique identifier of an Agent Network policy

Responses

List all Agent Network Guardrails

Returns a list of all Agent Network guardrails for the account.

Authorizations:
BearerAuthTokenAuth

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Agent Network Guardrail

Creates a new Agent Network guardrail that can be attached to one or more policies.

Authorizations:
BearerAuthTokenAuth
Request Body schema: application/json

New guardrail request

name
required
string

Display name for the guardrail.

description
string

Optional human-readable description.

required
object (AgentNetworkGuardrailChecks)

Guardrail check parameters. Each entry has an enabled flag plus per-check configuration; disabled entries are inert.

Responses

Request samples

Content type
application/json
{
  • "name": "Strict — Production",
  • "description": "Tight model allowlist, PII redaction, hard monthly budget.",
  • "checks": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainguard_d1m3kebd9pcs0c1pnu7g",
  • "name": "Strict — Production",
  • "description": "Tight model allowlist, PII redaction, hard monthly budget.",
  • "checks": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Retrieve an Agent Network Guardrail

Get information about a specific Agent Network guardrail.

Authorizations:
BearerAuthTokenAuth
path Parameters
guardrailId
required
string

The unique identifier of an Agent Network guardrail

Responses

Response samples

Content type
application/json
{
  • "id": "ainguard_d1m3kebd9pcs0c1pnu7g",
  • "name": "Strict — Production",
  • "description": "Tight model allowlist, PII redaction, hard monthly budget.",
  • "checks": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Update an Agent Network Guardrail

Update an existing Agent Network guardrail.

Authorizations:
BearerAuthTokenAuth
path Parameters
guardrailId
required
string

The unique identifier of an Agent Network guardrail

Request Body schema: application/json

Guardrail update request

name
required
string

Display name for the guardrail.

description
string

Optional human-readable description.

required
object (AgentNetworkGuardrailChecks)

Guardrail check parameters. Each entry has an enabled flag plus per-check configuration; disabled entries are inert.

Responses

Request samples

Content type
application/json
{
  • "name": "Strict — Production",
  • "description": "Tight model allowlist, PII redaction, hard monthly budget.",
  • "checks": {
    }
}

Response samples

Content type
application/json
{
  • "id": "ainguard_d1m3kebd9pcs0c1pnu7g",
  • "name": "Strict — Production",
  • "description": "Tight model allowlist, PII redaction, hard monthly budget.",
  • "checks": {
    },
  • "created_at": "2026-04-26T10:30:00Z",
  • "updated_at": "2026-04-26T10:30:00Z"
}

Delete an Agent Network Guardrail

Delete an existing Agent Network guardrail.

Authorizations:
BearerAuthTokenAuth
path Parameters
guardrailId
required
string

The unique identifier of an Agent Network guardrail

Responses