Skip to main content

REST API

The REST API is the HTTP interface behind the web application. Nearly every call or action made by the web interface can be replicated against it: search, behavior retrieval, user administration, and configuration. This page is the endpoint reference — request shape, response shape, and worked examples — and the index to the per-endpoint pages that follow it.

Endpoint and host​

The API is served from the same host as the web interface. Take the hostname from your browser's address bar when signed in to the portal, and append /api/{api-name}:

https://<your-instance-hostname>/api/{api-name}

On a current standard deployment that is:

https://<companyname>.app.ingext.io/api/{api-name}

Older and custom deployments are reached at a different hostname — cloud.fluencysecurity.com, app.fluencyplatform.com or a regional form — and the rule does not change: use the host you sign in at. See Fluency Web Interface for the URL formats.

The worked examples on this page date from December 2023 and use a test.cloud.fluencysecurity.com host. Substitute your own; only the hostname differs.

Request and response conventions​

The conventions every endpoint on this page shares.

HTTP method and content type​

All calls shown are POST with Content-Type: application/json, including calls that only read.

The kargs envelope​

Request bodies wrap their arguments in a kargs object — {"kargs":{...}} — and an empty argument set is sent as {"kargs":{}}.

The verdict / response envelope​

Responses wrap their payload in a response object alongside a verdict field, which reads "OK" on success.

Authentication header​

Calls carry a Fluencytoken header holding either an API token or a sessionToken.

Authentication endpoints​

auth/login​

An authentication / login test can be used to check the validity of the Endpoint / Credential configuration. The username/password is the same as those used for the Fluency interface.

Note: This step is not necessary if using the Fluency API Token for authentication.

cURL example​

curl -X POST "https://test.cloud.fluencysecurity.com/api/auth/login" -H "Content-Type: application/json" -d '{"kargs":{"username":"admin@fluencysecurity.com","password":"password"}}'

Response​

{
   "verdict":"OK",
   "response":{
      "sessionToken":"b23d7dd2-c388-4257-7d04-61704b76a3a8",
      "publicKey":"AELXKtPN",
      "userName":"Admin",
      "createdOn":"0001-01-01T00:00:00Z",
      "roles":[
         "admin"
      ],
      "status":"succeed",
      "fullName":"Fluency Admin",
      "rights":"admin",
      "email":"admin@fluencysecurity.com",
      "organization":"fluencysecurity.com",
      "name":"admin@fluencysecurity.com",
      "preference":{
         "timezone":{
            "value":"America/New_York",
            "policy":"Server"
         }
      },
      "timezone":"America/New_York",
      "profile":null
   }
}

Note: The sessionToken in the response can be used like the permanent API Token in following calls.

Administration endpoints​

auth/userList — list users​

The auth/userList API call lists the current users of the Fluency interface.

Note the "Fluencytoken:" value specified in the POST Header: (If using the API Token, use that instead of the sessionToken from the above authentication call.)

-H "Fluencytoken: b23d7bd2-c388-4257-7d05-61704b76a3a8"

cURL example​

curl -X POST "https://test.cloud.fluencysecurity.com/api/auth/userList" -H "Fluencytoken: b23d7bd2-c388-4257-7d05-61704b76a3a8" -H  "Content-Type: application/json" -d '{"kargs":{}}'

Response​

{
   "verdict":"OK",
   "response":{
      "users":[
         {
            "username":"admin@security.do",
            "email":"admin@security.do",
            "firstName":"admin",
            "lastName":"admin",
            "organization":"SecurityDo",
            "rights":"admin",
            "restricted":false,
            "disabled":true,
            "lastLogin":"2021-08-06T20:22:53.810894154Z",
            "passwordDate":"0001-01-01T00:00:00Z",
            "preference":{
               "timezone":{
                  "value":"Etc/GMT",
                  "policy":"GMT"
               }
            },
            "roles":[
               "admin"
            ],
            "dataPolicies":null,
            "APIPolicies":null,
            "profile":null
         }
      ]
   }
}

Note the roles, dataPolicies, and APIPolicies fields on each user — these are what constrain an API caller acting as that identity.

Search endpoints​

Each search endpoint has its own page with the full request and response schema. This section is the index.

get_index_zoom_histogram_lv3 — event search​

Searches and retrieves events from the data lake. The same API used by the Data Lake → Events Search page. Full reference: Event Search.

behavior_summary_search — behavior summary search​

Searches and retrieves behavior summaries. The same API used by the SIEM → Behavior Summary page. Full reference: Behavior Summary Search.

fsm_behavior_search — behavior timeline search​

Searches and retrieves behavior events. The same API used by the SIEM → Behavior Timeline page. Full reference: Behavior Timeline Search.

Discovering endpoints​

Additional Examples​

For more complete examples, and to see the Fluency API in action, enable the
Debug Console / Web Developer Tools on the Browser when using the Fluency
interface. The web requests captured in the console/tools should show the exact
behavior of the API.

This remains the most reliable way to find an undocumented call.