REST API

Base URL: https://api.monsys.ai/api/v1. Authenticatie:

• Agents: Authorization: Bearer <agent-token>
• Dashboard / CLI: signed session cookie of API-key

Agent endpoints

Methode	Pad	Doel
POST	/ingest	Batch metrics/heartbeat/inventory/alerts. Vereist X-Monsys-Signature zodra signing_pubkey gepind is — zie Agent payload signing
POST	/agents/register	Idempotent agent-registratie + TOFU-pin van signing_pubkey
POST	/agents/:id/heartbeat	Live status
GET	/ws/agents/:id	WebSocket voor emergency-token push + console RPC

Dashboard endpoints

Agents & telemetrie

Methode	Pad
GET	/agents
GET	/agents/:id
GET	/agents/:id/metrics?from&to&interval
GET	/agents/:id/inventory
GET	/agents/:id/processes
DELETE	/agents/:id
GET	/alerts
PATCH	/alerts/:id/resolve

Asset Intelligence (Sessie 12)

Methode	Pad
GET	/agents/:id/governance
PUT	/agents/:id/governance
GET	/agents/:id/inventory/containers
GET	/agents/:id/inventory/systemd
GET	/agents/:id/inventory/users
GET	/agents/:id/inventory/sudo
GET	/agents/:id/inventory/ssh-keys
GET	/agents/:id/inventory/backups
GET	/compliance?framework=&agent_id=&status=
POST	/compliance/run
GET	/compliance/export/:tool (trustos/vanta/cyberday/generic)

Cloud Asset Discovery

Methode	Pad
GET	/cloud/accounts
POST	/cloud/accounts (live credential-validatie)
DELETE	/cloud/accounts/:id
POST	/cloud/accounts/:id/discover (trigger directe run)
GET	/cloud/resources?account_id=&type=&has_agent=&is_public=
GET	/cloud/resources/:id
GET	/cloud/resources/:id/install (agent install commands)
GET	/cloud/summary
GET	/cloud/findings?severity=&status=
GET	/cloud/runs?account_id=

Ondersteunde providers: aws, azure, gcp, hetzner, proxmox, digitalocean, scaleway, ovh, ionos. Vereist CLOUD_ENCRYPTION_KEY (32 bytes hex) op de hub voor at-rest credential-encryptie.

Topology & diagrams

Methode	Pad
GET	/topology/nodes · POST · PATCH /:id · DELETE /:id
GET	/topology/edges · POST · DELETE /:id
GET	/topology/zones · POST
GET	/topology/detected[?unmatched=1]
POST	/topology/detected/:id/promote
GET	/topology/snapshots · POST
GET	/topology/export/mermaid
GET	/diagrams · POST /generate · GET /templates
POST	/diagrams/from-template/:id
GET	/diagrams/:id · PUT · DELETE
POST	/diagrams/:id/share · unshare
GET	/diagrams/share/:token (publiek, geen auth)

Audit-grade hardening

Methode	Pad
POST	/agents/:id/rotate-token (admin/owner)
POST	/agents/:id/rotate-signing-key (admin/owner)
GET	/integrity-anomalies?include_resolved=0|1
PATCH	/integrity-anomalies/:id/resolve

Emergency console (Sessie 6b)

Methode	Pad
POST	/agents/:id/console/start (admin/owner + TOTP)
GET	/console/sessions
GET	/console/sessions/:id/recording (asciicast v2)
DELETE	/console/sessions/:id (admin terminate)
GET	/ws/console/:session_id (browser → hub WebSocket)

Auth / session

Methode	Pad
POST	/auth/login
POST	/auth/totp/challenge
POST	/auth/totp/setup / /verify / /disable
POST	/auth/forgot-password · /reset-password
POST	/auth/accept-invite · /invitations

Overig

Methode	Pad
POST	/agents/:id/emergency
GET	/blast-radius/:id
GET	/inventory/cves
GET	/ai/explain?log=…&agent_id=…&lang=nl
GET	/security (honeypots / DNA / silent agents)
GET	/webhooks · POST · DELETE

Health & metrics

GET /api/v1/health → { "status": "ok" } GET /metrics → Prometheus exposition.

Rate limits

Endpoint	Limiet
/ingest	60 / minuut / agent
/agents/:id/emergency	5 / uur / user
/agents/:id/console/start	5 / uur / user
/agents/:id/rotate-token	10 / uur / user
/agents/:id/rotate-signing-key	10 / uur / user
/auth/login	10 / minuut / IP
/auth/forgot-password	5 / uur / IP
/auth/totp/challenge	10 / minuut / IP
/compliance/run	10 / uur / user
/invitations POST	20 / uur / tenant
Andere user-endpoints	1000 / minuut / IP

Audit log

Iedere veiligheidsgevoelige actie schrijft een rij naar audit_log. Events die je in een audit kunt verwachten:

event_type	Trigger
agent_token_rotated	POST /agents/:id/rotate-token
agent_signing_key_cleared	POST /agents/:id/rotate-signing-key
console_session_started / _ended / _terminated_by_admin	Emergency console
agent_version_seen	IntegrityCheckWorker checkpoint