Base URL: https://api.monsys.ai/api/v1. Authentication:
- Agents:
Authorization: Bearer <agent-token>
- Dashboard / CLI: signed session cookie or API-key
| Method |
Path |
Purpose |
| POST |
/ingest |
Batch metrics/heartbeat/inventory/alerts. Required X-Monsys-Signature when signing_pubkey is pinned — see Agent payload signing |
| POST |
/agents/register |
Idempotent agent registration + TOFU-pin of signing_pubkey |
| POST |
/agents/:id/heartbeat |
Live status |
| GET |
/ws/agents/:id |
WebSocket for emergency-token push + console RPC |
| Method |
Path |
| GET |
/agents |
| GET |
/agents/:id |
| GET |
/agents/:id/metrics?from&to&interval |
| GET |
/agents/:id/inventory |
| GET |
/agents/:id/processes |
| DELETE |
/agents/:id |
| GET |
/alerts |
| PATCH |
/alerts/:id/resolve |
| Method |
Path |
| GET |
/agents/:id/governance |
| PUT |
/agents/:id/governance |
| GET |
/agents/:id/inventory/containers |
| GET |
/agents/:id/inventory/systemd |
| GET |
/agents/:id/inventory/users |
| GET |
/agents/:id/inventory/sudo |
| GET |
/agents/:id/inventory/ssh-keys |
| GET |
/agents/:id/inventory/backups |
| GET |
/compliance?framework=&agent_id=&status= |
| POST |
/compliance/run |
| GET |
/compliance/export/:tool (trustos/vanta/cyberday/generic) |
| Method |
Path |
| GET |
/cloud/accounts |
| POST |
/cloud/accounts (live credential validation) |
| DELETE |
/cloud/accounts/:id |
| POST |
/cloud/accounts/:id/discover (trigger direct run) |
| GET |
/cloud/resources?account_id=&type=&has_agent=&is_public= |
| GET |
/cloud/resources/:id |
| GET |
/cloud/resources/:id/install (agent install commands) |
| GET |
/cloud/summary |
| GET |
/cloud/findings?severity=&status= |
| GET |
/cloud/runs?account_id= |
Supported providers: aws, azure, gcp, hetzner, proxmox,
digitalocean, scaleway, ovh, ionos. Requires CLOUD_ENCRYPTION_KEY
(32 bytes hex) on the hub for at-rest credential encryption.
| Method |
Path |
| GET |
/topology/nodes · POST · PATCH /:id · DELETE /:id |
| GET |
/topology/edges · POST · DELETE /:id |
| GET |
/topology/zones · POST |
| GET |
/topology/detected[?unmatched=1] |
| POST |
/topology/detected/:id/promote |
| GET |
/topology/snapshots · POST |
| GET |
/topology/export/mermaid |
| GET |
/diagrams · POST /generate · GET /templates |
| POST |
/diagrams/from-template/:id |
| GET |
/diagrams/:id · PUT · DELETE |
| POST |
/diagrams/:id/share · unshare |
| GET |
/diagrams/share/:token (public, no auth) |
| Method |
Path |
| POST |
/agents/:id/rotate-token (admin/owner) |
| POST |
/agents/:id/rotate-signing-key (admin/owner) |
| GET |
/integrity-anomalies?include_resolved=0|1 |
| PATCH |
/integrity-anomalies/:id/resolve |
| Method |
Path |
| POST |
/agents/:id/console/start (admin/owner + TOTP) |
| GET |
/console/sessions |
| GET |
/console/sessions/:id/recording (asciicast v2) |
| DELETE |
/console/sessions/:id (admin terminate) |
| GET |
/ws/console/:session_id (browser → hub WebSocket) |
| Method |
Path |
| POST |
/auth/login |
| POST |
/auth/totp/challenge |
| POST |
/auth/totp/setup / /verify / /disable |
| POST |
/auth/forgot-password · /reset-password |
| POST |
/auth/accept-invite · /invitations |
| Method |
Path |
| POST |
/agents/:id/emergency |
| GET |
/blast-radius/:id |
| GET |
/inventory/cves |
| GET |
/ai/explain?log=…&agent_id=…&lang=en |
| GET |
/security (honeypots / DNA / silent agents) |
| GET |
/webhooks · POST · DELETE |
GET /api/v1/health → { "status": "ok" }
GET /metrics → Prometheus exposition.
| Endpoint |
Limit |
/ingest |
60 / minute / agent |
/agents/:id/emergency |
5 / hour / user |
/agents/:id/console/start |
5 / hour / user |
/agents/:id/rotate-token |
10 / hour / user |
/agents/:id/rotate-signing-key |
10 / hour / user |
/auth/login |
10 / minute / IP |
/auth/forgot-password |
5 / hour / IP |
/auth/totp/challenge |
10 / minute / IP |
/compliance/run |
10 / hour / user |
/invitations POST |
20 / hour / tenant |
| Other user-endpoints |
1000 / minute / IP |
Every security-sensitive action writes a row to audit_log. Events
that you can expect in an audit:
event_type |
Trigger |
agent_token_rotated |
POST /agents/:id/rotate-token |
agent_signing_key_cleared |
POST /agents/:id/rotate-signing-key |
console_session_started / _ended / _terminated_by_admin |
Emergency console |
agent_version_seen |
IntegrityCheckWorker checkpoint |
