Base URL
Authentication
All requests must include theX-API-Key header with a valid key.
Roles
| Role | Description | Permissions |
|---|---|---|
viewer | Read-only | GET on all endpoints |
operator | Operator | GET + POST (acknowledge, approve, reject) |
admin | Administrator | Full access (GET, POST, PUT, DELETE) |
Rate Limiting
| Plan | Limit | Window |
|---|---|---|
| Default | 100 req | per minute |
| Operator | 500 req | per minute |
| Admin | 1000 req | per minute |
Response Format
All responses follow a Kubernetes-like pattern:Error Codes
| Code | Description |
|---|---|
400 | Bad request — missing or malformed parameters |
401 | Unauthenticated — X-API-Key missing or invalid |
403 | Forbidden — insufficient role for the operation |
404 | Resource not found |
409 | Conflict — resource already exists or invalid state for the operation |
429 | Rate limit exceeded |
500 | Internal server error |
Pagination
Endpoints that return lists support pagination via query parameters:page— Page number (default: 1)pageSize— Items per page (default: 20, maximum: 100)
Versioning
The API uses path-based versioning (/api/v1/). Future versions will be added as /api/v2/ while maintaining backward compatibility with v1.