Skip to main content

​
Base URL

All management API endpoints are under /api/v1/.

​
Authentication

The management API accepts two kinds of credentials:
  • Session cookie. What the dashboard uses. The session must have an active organization.
  • API key. Send Authorization: Bearer ig_.... Create keys in Settings → API Keys.
If a session is present it is used first. Otherwise the API key is checked.

​
API keys act as their creator

An API key does not have its own permissions. It acts with the current role and per-member overrides of the person who created it. If that person’s role changes, the key’s access changes with it. If that person leaves the organization, the key stops working and returns 401. See Roles and permissions.

​
Errors

Validation errors are not uniform across routes. Check the status and body shape per endpoint. Rate limits, body size limits, and the full error format are in Limits and errors.

​
Public routes

These routes need no session. Some still need a key in the request body or header. Other routes not covered on this page (/api/v1/billing/webhook, /api/v1/admin/ops/*, /api/v1/ingest/*) are for Igris’s own infrastructure or log-ingestion integrations. They are not part of the client management API.

​
Response format

Single resources and action results come back wrapped in data. Example bodies below show the full envelope. Action results such as { "deleted": true } are also inside data:
List endpoints add a meta object:
meta.nextCursor is present on cursor-paginated lists (audit events, incidents). Audit events also add meta.archive when the from/to range overlaps archived data.

​
Pagination

Most lists use limit and offset:
Cursors. Audit events and incidents return meta.nextCursor when the page is full. Pass it back as cursor to get the next page. When a page is not full, nextCursor is null and there is nothing more to fetch. Incidents ignore offset.
Cursors are time-based and have limits. Audit events filter on timestamp < cursor, so they only page correctly with the default sort=ts&dir=desc. Incidents are sorted by status, then severity, then lastSeen, but the cursor filters on lastSeen alone, so paging through a mixed list can skip rows. For a complete export of incidents, page within a single status (and severity) filter.

​
Other endpoints

These routes exist but are not documented in detail here. Each shows the permission it requires. For permission names and which roles hold them, see Roles and permissions.