Foresight (digital twin), Sentinel (self-healing), Collective Defense (fleet intel), and unauthorized-change detection. Auto-generated from the platform OpenAPI schema so it matches the running API.
REST API for this feature — 49 operations across 32 resource paths, auto-generated from the platform's live OpenAPI schema (drf-spectacular).
Base URL
https://<your-versus-host>/api· AuthAuthorization: Bearer <JWT>(fromPOST /api/auth/token/) · 📄 Download the OpenAPI spec for Postman/Insomnia/Swagger · see the API overview for pagination, filtering, and errors.
GET /api/baselines/List baselines
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
device_group | query | no | integer | |
ordering | query | no | string | Which field to use when ordering the results. |
search | query | no | string | A search term. |
Responses: 200 → CustomerBaseline[]
POST /api/baselines/Create baseline
Request body (application/json): CustomerBaselineRequest
Responses: 201 → CustomerBaseline
GET /api/baselines/for_group/{group_id}/Get or upsert the first baseline associated with a device group.
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
group_id | path | yes | string |
Responses: 200 → CustomerBaseline
PUT /api/baselines/for_group/{group_id}/Get or upsert the first baseline associated with a device group.
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
group_id | path | yes | string |
Request body (application/json): CustomerBaselineRequest
Responses: 200 → CustomerBaseline
PATCH /api/baselines/for_group/{group_id}/Get or upsert the first baseline associated with a device group.
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
group_id | path | yes | string |
Request body (application/json): PatchedCustomerBaselineRequest
Responses: 200 → CustomerBaseline
GET /api/baselines/{id}/Retrieve baseline
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this customer baseline. |
Responses: 200 → CustomerBaseline
PUT /api/baselines/{id}/Update baseline
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this customer baseline. |
Request body (application/json): CustomerBaselineRequest
Responses: 200 → CustomerBaseline
PATCH /api/baselines/{id}/Update baseline
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this customer baseline. |
Request body (application/json): PatchedCustomerBaselineRequest
Responses: 200 → CustomerBaseline
DELETE /api/baselines/{id}/Delete baseline
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this customer baseline. |
Responses: 204
GET /api/fleet-intel/advisories/GET /api/fleet-intel/advisories/ — fleet CVE/threat advisories matched to
Responses: 200
POST /api/fleet-intel/advisories/GET /api/fleet-intel/advisories/ — fleet CVE/threat advisories matched to
Responses: 200
GET /api/fleet-intel/benchmark/GET /api/fleet-intel/benchmark/ — k-anonymized posture vs the fleet.
Responses: 200
GET /api/fleet-intel/forecast/GET /api/fleet-intel/forecast/ — predictive risk forecast: the symptoms
Responses: 200
GET /api/fleet-intel/playbooks/GET /api/fleet-intel/playbooks/?symptom=<class> — vetted fleet-proven playbooks.
Responses: 200
POST /api/fleet-intel/playbooks/GET /api/fleet-intel/playbooks/?symptom=<class> — vetted fleet-proven playbooks.
Responses: 200
GET /api/fleet-intel/policy/GET/PUT /api/fleet-intel/policy/ — the tenant's opt-in (ships opt-OUT).
Responses: 200
PUT /api/fleet-intel/policy/GET/PUT /api/fleet-intel/policy/ — the tenant's opt-in (ships opt-OUT).
Responses: 200
POST /api/foresight/gated-run/POST /api/foresight/gated-run/ {workflow_def_id, dry_run?}
Responses: 200
GET /api/foresight/health/GET /api/foresight/health/ — current intent health + rolling SLA (read-only)
Responses: 200
POST /api/foresight/health/GET /api/foresight/health/ — current intent health + rolling SLA (read-only)
Responses: 200
GET /api/foresight/intents/GET/POST /api/foresight/intents/ — declared reachability intents.
Responses: 200
POST /api/foresight/intents/GET/POST /api/foresight/intents/ — declared reachability intents.
Responses: 200
GET /api/foresight/reachability/GET /api/foresight/reachability/?src=<ip>&dst=<ip>
Responses: 200
POST /api/foresight/simulate/POST /api/foresight/simulate/ {change_kind, devices:[names] | workflow_def_id}
Responses: 200
GET /api/foresight/twin/GET /api/foresight/twin/ → latest assembled twin summary
Responses: 200
POST /api/foresight/twin/GET /api/foresight/twin/ → latest assembled twin summary
Responses: 200
GET /api/selfheal/bundles/Manual export (spec §6.3): create assembles+signs a bundle, inspect
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
ordering | query | no | string | Which field to use when ordering the results. |
page | query | no | integer | A page number within the paginated result set. |
page_size | query | no | integer | Number of results to return per page. |
search | query | no | string | A search term. |
Responses: 200 → PaginatedSupportBundleList
POST /api/selfheal/bundles/Manual export (spec §6.3): create assembles+signs a bundle, inspect
Request body (application/json): SupportBundleRequest
Responses: 201 → SupportBundle
GET /api/selfheal/bundles/{id}/Manual export (spec §6.3): create assembles+signs a bundle, inspect
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | string | A UUID string identifying this support bundle. |
Responses: 200 → SupportBundle
GET /api/selfheal/bundles/{id}/download/Manual export (spec §6.3): create assembles+signs a bundle, inspect
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | string | A UUID string identifying this support bundle. |
Responses: 200 → SupportBundle
GET /api/selfheal/bundles/{id}/inspect/Bundle Inspector (spec §6.3) — the manifest is already
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | string | A UUID string identifying this support bundle. |
Responses: 200 → SupportBundle
POST /api/selfheal/bundles/{id}/transmit/Manual export (spec §6.3): create assembles+signs a bundle, inspect
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | string | A UUID string identifying this support bundle. |
Request body (application/json): SupportBundleRequest
Responses: 200 → SupportBundle
GET /api/selfheal/issues/spec §10-equivalent: GET /selfheal/issues — everything Sentinel has
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
issue_class | query | no | string | * crash - Crash / Fatal |
ordering | query | no | string | Which field to use when ordering the results. |
page | query | no | integer | A page number within the paginated result set. |
page_size | query | no | integer | Number of results to return per page. |
search | query | no | string | A search term. |
severity | query | no | string | * critical - Critical |
status | query | no | string | * open - Open |
Responses: 200 → PaginatedDetectedIssueList
GET /api/selfheal/issues/{fingerprint}/spec §10-equivalent: GET /selfheal/issues — everything Sentinel has
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
fingerprint | path | yes | string | A unique value identifying this detected issue. |
Responses: 200 → DetectedIssue
GET /api/sentinel/fixes/GET /api/sentinel/fixes/ — fix proposals + their rollout status. Admin only.
Responses: 200
POST /api/sentinel/fixes/{id}/{action}/POST /api/sentinel/fixes/<id>/<approve|reject>/ — govern the rollout.
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
action | path | yes | string | |
id | path | yes | integer |
Responses: 200
GET /api/sentinel/glitches/GET /api/sentinel/glitches/ — operator dashboard of detected glitches.
Responses: 200
POST /api/sentinel/glitches/{id}/diagnose/POST /api/sentinel/glitches/<id>/diagnose/ — AI root-cause-in-code diagnosis
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer |
Responses: 200
POST /api/sentinel/glitches/{id}/propose-fix/POST /api/sentinel/glitches/<id>/propose-fix/ — generate a candidate code fix
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer |
Responses: 200
POST /api/sentinel/report/POST /api/sentinel/report/ — beacon: a tenant instance or the frontend reports
Responses: 200
GET /api/unauthorized-changes/List unauthorized changes
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
device | query | no | integer | |
object_type | query | no | string | |
ordering | query | no | string | Which field to use when ordering the results. |
page | query | no | integer | A page number within the paginated result set. |
page_size | query | no | integer | Number of results to return per page. |
search | query | no | string | A search term. |
status | query | no | string | * investigating - Investigating |
Responses: 200 → PaginatedUnauthorizedChangeList
POST /api/unauthorized-changes/Create unauthorized change
Request body (application/json): UnauthorizedChangeRequest
Responses: 201 → UnauthorizedChange
POST /api/unauthorized-changes/run-detection/Manually trigger unauthorized change detection for a device.
Request body (application/json): UnauthorizedChangeRequest
Responses: 200 → UnauthorizedChange
GET /api/unauthorized-changes/{id}/Retrieve unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Responses: 200 → UnauthorizedChange
PUT /api/unauthorized-changes/{id}/Update unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Request body (application/json): UnauthorizedChangeRequest
Responses: 200 → UnauthorizedChange
PATCH /api/unauthorized-changes/{id}/Update unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Request body (application/json): PatchedUnauthorizedChangeRequest
Responses: 200 → UnauthorizedChange
DELETE /api/unauthorized-changes/{id}/Delete unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Responses: 204
POST /api/unauthorized-changes/{id}/acknowledge/Acknowledge: unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Request body (application/json): UnauthorizedChangeRequest
Responses: 200 → UnauthorizedChange
POST /api/unauthorized-changes/{id}/mark_false_positive/Mark false positive: unauthorized change
| Parameter | In | Required | Type | Description |
|---|---|---|---|---|
id | path | yes | integer | A unique integer value identifying this unauthorized change. |
Request body (application/json): UnauthorizedChangeRequest
Responses: 200 → UnauthorizedChange
Auto-generated from drf-spectacular OpenAPI. Endpoint descriptions come from viewset docstrings/serializers; enriching those improves this page on the next generation.