Management API
Base URL https://control.securd.com/api/v1. Every request carries X-Tenant-UUID. API keys (sk_ prefix) authenticate the IOC push endpoint with the lists:write scope; all other endpoints accept a JWT from the login endpoint. Responses are wrapped in a data object; list responses include meta.
Configuration and reference code for Management API
Authenticate
# 1. Get a JWT (15 minute access token; refresh cookie is set)
curl -s https://control.securd.com/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"..."}' | jq -r .access_token
# 2. Every call after that
export TOKEN=... # from step 1
export TENANT=... # company UUID from the console
curl -s https://control.securd.com/api/v1/gateway/policies \
-H "Authorization: Bearer $TOKEN" \
-H "X-Tenant-UUID: $TENANT"
Create a policy and bind a site
The first-seen baseline and the lists belong to the policy. A site is an egress IP bound to a policy; a virtual site is a DoH address bound to a policy. Create the policy first, then the site that uses it.
# Policy with the Greywall enabled and a 1 hour hold on first-seen names
curl -s https://control.securd.com/api/v1/gateway/policies \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{
"name": "research-agent",
"default": "allow",
"greylist": { "mode": "enabled", "holdtime": 3600 },
"category": { "mode": "deny", "deny": ["<doh-providers category id>"] }
}'
# Static site (public egress IP of the VPC) bound to that policy
curl -s https://control.securd.com/api/v1/gateway/sites \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{ "name": "research-vpc", "ipaddress": "203.0.113.10", "policy_guid": "<policy guid>" }'
Approve a held hostname
An approval is an allow list entry on the policy. A bulk endpoint accepts up to 10,000 entries in one request.
curl -s https://control.securd.com/api/v1/gateway/list-entries/$ALLOW_LIST_UUID/entries \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{ "value": "api.smith.langchain.com", "source": "manual", "source_ref": "ops ticket 4412" }'
Push IOCs from a SOAR (API key)
This endpoint accepts API key authentication. Entries with expires_in are removed automatically when they expire.
# Push IOCs into a block list with an API key (scope: lists:write)
# Max 1,000 entries per request. 100 requests per minute per key.
curl -s https://control.securd.com/api/v1/gateway/push/$LIST_UUID/entries \
-H "Authorization: Bearer sk_..." \
-H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{
"entries": [
{ "value": "exfil-data.click", "confidence": 95, "expires_in": 86400,
"source_ref": "SOAR-4412", "note": "seen in agent egress alert" }
]
}'
Publish and roll back
Configuration changes are published to the resolvers. Publishes are debounced per compartment and recorded in the change log. Rollback restores a previous snapshot.
curl -s -X POST https://control.securd.com/api/v1/gateway/config/publish \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT"
# Change log: who changed what, when, and which publish carried it
curl -s https://control.securd.com/api/v1/gateway/audit/changelog \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT"
# Roll back to a previous publish
curl -s -X POST https://control.securd.com/api/v1/gateway/config/rollback/$PUBLISH_ID \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT"
Pull logs
Paginated and filterable by action. Syslog forwarding is the method for continuous ingestion; the API supports ad hoc retrieval and scheduled exports.
curl -s "https://control.securd.com/api/v1/gateway/dashboard/logs?tf=now-1h&action=greywall&per_page=500" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT"
# Export in CEF for your SIEM
curl -s "https://control.securd.com/api/v1/gateway/dashboard/logs/export?format=cef&start=now-1d/d" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" -o securd.cef
Scopes
sites:read, sites:write, policies:read, policies:write, lists:read, lists:write, dashboard:read, config:publish, config:rollback, feeds:read, feeds:write, devices:read, changelog:read. The key value is displayed once at creation. Rotation is performed by creating a new key and deleting the previous one.
Related pages
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the recorded destinations with your team.