The backend exposes local REST APIs under /api. Interactive OpenAPI documentation is available at /docs when the backend is running.
The desktop sidecar also exposes GET /health at the service root so the Tauri main process can verify that the dynamically assigned backend port is ready.
Returns the local backend health status.
Returns normalized alert list items from the current alert source. The local source includes the canonical examples plus deterministic expanded samples.
Returns one normalized alert with raw payload and entities.
Payload:
{"alert_id": "alert_bruteforce_001"}Creates an investigation in created state.
Starts the deterministic orchestrator in the background.
Returns the current investigation state, severity, category, MITRE techniques, and error summary if failed.
Returns the append-only investigation timeline.
Lists approval records for an investigation.
Payload:
{"decision": "approved", "comment": "Verified malicious source."}Records a human decision. The API does not execute real response actions.
Returns or creates the Markdown incident report for a completed investigation.
Returns editable runtime configuration. Sensitive values return value: null plus configured.
Payload:
{
"items": {
"im_provider": "feishu",
"feishu_webhook_url": "https://open.feishu.cn/open-apis/bot/v2/hook/..."
}
}Updates allowed local settings, reloads runtime dependencies, and returns the same masked response shape.
Returns editable and sensitive key metadata.
Filters local JSONL security telemetry. Supported filters:
alert_idhostusernamesrc_ipevent_typeseveritystart_timeend_timelimit
Returns health state, alert metrics, investigation counts, pending approvals, recent timeline items, and high-risk alerts.
Returns backend, database, LLM, and notification-channel status.
Reads local service logs when logs/app.log exists. Missing files return an empty list.
Returns provider status for DingTalk, Feishu, or WeCom.
Attempts to send a robot notification when enabled and configured.
Receives DingTalk interactive card decisions, validates callback signature headers, and records the approval decision.
Runs the baseline deterministic evaluation suite.
Returns one evaluation run result.