API

Everything the dashboard shows, as JSON – with your own keys and permissions.

The API serves the same data as the dashboard. It is meant for your own reports, status pages, automation and integration with existing tools.

Authentication #

Create a key under Settings → API. Pass it as a bearer token:

curl -H "Authorization: Bearer n64_your_key" \
     https://app.node64.de/api/v1/me

The key is shown once. We store only its hash.

Every key gets exactly the permissions you select:

Permission	Allows
`account:read`	read account and user data
`devices:read`	read devices, groups and uploads
`devices:write`	edit devices, create groups, delete devices
`findings:read`	read findings
`alerts:read`	read alerts and rules

A key for a status page needs findings:read – nothing more.

Method	Path	Purpose
`GET`	`/api/v1/me`	account, user, plan
`GET`	`/api/v1/devices`	all devices
`GET`	`/api/v1/devices/{id}`	one device with details
`PATCH`	`/api/v1/devices/{id}`	change a device (name, group, role)
`DELETE`	`/api/v1/devices/{id}`	remove a device
`GET`	`/api/v1/groups`	device groups
`POST`	`/api/v1/groups`	create a group
`GET`	`/api/v1/findings`	findings, filterable
`GET`	`/api/v1/uploads`	upload history
`GET`	`/api/v1/alerts`	triggered alerts
`GET`	`/api/v1/openapi.json`	the specification

All open findings at "high" and above:

curl -H "Authorization: Bearer $KEY" \
     "https://app.node64.de/api/v1/findings?severity=high&status=open"

When each device last reported:

curl -s -H "Authorization: Bearer $KEY" \
     https://app.node64.de/api/v1/devices | jq '.data[] | {name, last_seen_at, agent_version}'

There is no score – not in the API either. Why, is under Understanding findings.

{
  "data": [ ... ],
  "meta": { "count": 12 }
}

Errors come with a matching status code and a body:

{ "error": "forbidden", "message": "Missing scope: findings:read" }

Read and manage, not control. There is no endpoint that runs anything on a device – for the same reason the agent has no command channel.
Rate limit per key. Hitting a limit returns 429; wait a moment.
Versioned. /api/v1/ stays stable; breaking changes get /api/v2/.

The full specification lives at /api/v1/openapi.json and imports into any API client.