API authentication and conventions

The AegisOne API is a REST interface over HTTPS, returning JSON. Every endpoint used by the console is part of the same API surface, which means anything you can do in the browser you can also do programmatically.

Requests authenticate with a bearer token in the Authorization header. Send JSON bodies with an explicit content type; the API will not guess.

export AEGISONE_HOST="https://<your-console-host>"
export AEGISONE_TOKEN="<your token>"

curl "$AEGISONE_HOST/api/clients" \
  -H "Authorization: Bearer $AEGISONE_TOKEN" \
  -H "Accept: application/json"

Treat API tokens as credentials of the same weight as an operator password, because they carry the same reach. Store them in whatever secret store your automation already uses, never in a repository, and rotate them when the person or system they were issued for changes.

Endpoints are grouped by resource under /api — clients, sites, assets, tickets, patches, compliance, reconciliation and so on. Agent-directed operations sit under /api/agent/{id}/, which is a useful distinction to internalise: those calls dispatch an instruction to a machine and have real-world effects, while the rest read or modify platform records.

Because agent-directed calls act on live machines, build a confirmation step into any script that issues them in bulk. The failure mode of a badly scoped read is a large response; the failure mode of a badly scoped patch install is a difficult afternoon.

Timestamps are returned in ISO 8601. Identifiers are opaque strings — do not parse them, infer ordering from them, or assume a format that happens to hold today.