HTTP API
Antemure exposes three HTTP surfaces built on axum: the per-endpoint daemon API (18900), the fleet hub API (18901), and the SOAR internal API (18902, reached through the hub). Reads are generally open on the daemon; mutations require a token; the hub enforces full RBAC.
Daemon API (:18900)
Per-endpoint REST + a WebSocket. Representative endpoints:
| Method | Path | Purpose |
|---|---|---|
| GET | /api/health, /api/summary | liveness; node rollup (counts, open incidents, risk tier, MTTD) |
| GET | /api/model, /api/model/entity/:id | entity graph and single entity |
| GET | /api/events, /api/incidents, /api/incidents/:id/investigation | events, incidents, full evidence trail |
| GET | /api/reasoning/latest, /api/activity, /api/timeline | latest verdict; live activity; DFIR timeline |
| POST | /api/incidents/:id/rerun, /api/incidents/:id/ignore | re-run / ignore an incident token |
| GET/POST | /api/pending, /api/pending/:id/{approve,deny,ignore,retry} | approval queue + decisions token |
| POST | /api/dispatch | operator/hub dispatches an allowlisted action (optional SOAR command signature) token |
| POST | /api/simulate | stage the safe test incident token |
| GET | /api/hunt?q=, /api/data/config, /api/spend, /api/license, /api/audit, /api/metrics | IOC search; config (masked); spend; license; audit; metrics |
| POST | /admission, /mutate | Kubernetes validating/mutating webhooks (TLS) |
| GET | /ws | WebSocket push of per-cycle reasoning results |
Daemon authentication
Reads are open; mutating requests (POST/PUT/DELETE) require Authorization: Bearer <token> or X-Antemure-Token: <token> matching AURA_NODE_API_TOKEN when set. With no token the daemon fails open for LAN/dev — except a node that is configured-but-not-yet-enrolled refuses all mutations. The admission/mutate webhooks are exempt (secured by their own TLS + caBundle). Bind the daemon to 127.0.0.1 via AURA_BIND_ADDR if only the local hub relay needs it.
Hub API (:18901)
All under /api/…, grouped: fleet/* (incidents, nodes, config, autonomy, hunt, respond, telemetry, deploy, remediation), endpoints/* (per-node inspect/console/approvals/archive), analyst/* (the AI copilot, SSE streaming), integrations/*, alerts/*, kg* (knowledge graph), vault, admin/* and settings/*, updates/*, enroll*, and auth/* + sso/*. SOAR is proxied at /api/soar/*; the node reverse relay terminates at /api/relay/connect.
The SRE / reliability surface lives under the same fleet/* group: fleet/slos, fleet/alerts, fleet/correlation-alerts, fleet/collectors, fleet/schedules, fleet/webhooks, fleet/health, fleet/k8s, fleet/postmortems, plus the inbound-webhook fire endpoint POST /api/webhooks/:token (path-token auth) and the telemetry rule engine alerts/rules (+ :id/preview) and alerts/events.
Auth & RBAC: browser sessions carry a signed cookie whose role is checked against a method+path matrix; enrolled daemons present the node token as a bearer to reach device-only routes (fleet config pull, relay, heartbeat); internal service-to-service routes are gated by per-purpose shared secrets. Public routes: /api/enroll, /api/health, /api/signup, /auth/*. In open mode (no SSO) all routes are allowed. Full model in Tokens, Auth & RBAC.
SOAR internal API (:18902, via the hub)
Mounted under /api/soar/*: health, capabilities, playbooks (CRUD, :id/draft[.yaml], import, :id/validate, :id/publish, version autonomy), triggers (+ PATCH mode), autonomy (+ pause), events (ingest), and runs (:id, :id/cancel, :id/approvals/:step/decision). Backed by Postgres and Temporal. Reached only through the hub proxy, which injects the proxy secret and tenant.
MCP
The MCP server (POST /mcp on 18902) wraps the hub API as tools for AI agents under the same RBAC — see the MCP tools list.