This is the shared reference for the intSignal REST API. Product resources (such as SOC cases) follow every convention here.
Requests
- Base URL:
https://api.intsignal.com/v1 - HTTPS only; JSON request and response bodies
- Send
Authorization: Bearer <token>on every request - Send
Content-Type: application/jsononPOST/PATCH
Pagination
List endpoints return a page of data plus a next_cursor. Pass it back as
cursor to get the next page; a null next_cursor means the last page.
curl "https://api.intsignal.com/v1/devices?limit=100" \
-H "Authorization: Bearer $INTSIGNAL_TOKEN"
{ "data": [ /* … */ ], "next_cursor": "eyJvIjoxMDB9" }
Filtering & sorting
Most list endpoints accept resource-specific filters plus:
| Param | Description |
|---|---|
since | Only records updated at/after an ISO 8601 timestamp |
limit | Page size (default 50, max 200) |
cursor | Pagination cursor |
order | asc or desc by updated time (default desc) |
Errors
Errors use standard HTTP status codes and a consistent body:
{
"error": {
"code": "invalid_scope",
"message": "Token is missing required scope: soc:write",
"request_id": "req_2c9a1f"
}
}
| Status | Meaning |
|---|---|
400 | Malformed request |
401 | Missing/invalid token |
403 | Valid token, insufficient scope |
404 | Resource not found |
409 | Conflict (e.g., duplicate) |
429 | Rate limited — see Rate limits |
5xx | Server error — safe to retry with backoff |
Always log the request_id; it lets support trace a specific call.
Shared resources
| Resource | Endpoint | Scope |
|---|---|---|
| Ping / health | GET /ping | any |
| Organization | GET /org | org:read |
| Devices | GET /devices | devices:read |
| SOC cases | GET /soc/cases | soc:read |
| Webhooks | GET/POST /webhooks | webhooks:write |
Tip
Prefer webhooks over polling list endpoints on a tight loop — you will hit rate limits and add latency. Webhooks push changes as they happen.
