Using the REST API and scoped API keys

If you manage MxGuard programmatically — for example as part of onboarding new customers or wiring detections into a SIEM — use the REST API rather than the console.

What the API covers: domain management, allow/block rules, verdict lookup and quarantine actions (release/delete).

Authentication: each request carries an API key. Keys have scoped permissions, so you can create a read-only key for a monitoring script and a separate, more privileged key for provisioning. Treat keys as secrets and rotate them periodically.

Beyond the API: - The native Prometheus endpoint exposes per-domain verdict counters, ML latency histograms, Claude call counts and queue depth for your monitoring stack. - Optional per-verdict outbound webhooks push detections into a SIEM or SOAR platform as they happen. - The audit log is exportable as JSON or CSV for compliance evidence.

All administrative actions taken via the API are recorded in the same audit log as console actions.