Everything intSignal does in the Portal is available programmatically. The developer platform is a single REST API with consistent authentication, pagination, and error handling across products — plus webhooks for real-time events and an MCP server so AI tools can work with your data and these docs directly. The resources it exposes are the ones your products already produce — the cases and detections from the SIEM detection, investigation, and response platform, device health, and network telemetry.
Base URL
https://api.intsignal.com/v1
All requests are HTTPS and return JSON. Timestamps are ISO 8601 (UTC).
Start here
Create an API key
In the Portal, go to Settings → API keys and create a key scoped to only what your integration needs. Store it as a secret. See Authentication.
Make your first request
Call a read endpoint with your token to confirm access:
curl https://api.intsignal.com/v1/ping \
-H "Authorization: Bearer $INTSIGNAL_TOKEN"
Subscribe to events
Register a webhook so your systems react to changes (new SOC cases, device status) without polling.
Conventions
- Auth: bearer tokens, scoped per key. See Authentication.
- Pagination: cursor-based via
cursor+next_cursor. - Errors: standard HTTP status codes plus a JSON body with
error.codeanderror.message. - Rate limits: communicated in response headers. See Rate limits.
- Versioning: the version is in the path (
/v1). Breaking changes ship under a new version; additive changes do not.
Reference
- Quickstart — your first call in a few minutes
- Authentication
- API reference
- Code examples — curl, JavaScript, Python
- Integration recipes
- Webhooks
- MCP server & AI access
- Rate limits
Note
Product-specific endpoints live with their product — for example, the Managed SOC API. They all use the auth and conventions described here.