API reference · Security Suite

Where the network APIs deal in sites and links, the Security Suite API is about endpoints and identities: it exposes your device inventory and health, the detections raised on them, and the response actions you can take — including pulling a compromised machine off the network. Use it to feed protection state into a CMDB, a SIEM, or your own dashboards, or to wire isolation into an automated runbook. The same device, detection, and identity data drives the Suite's own posture scoring and cross-system analytics, so an external dashboard and the Portal never disagree about what is covered. Authentication, pagination, and error handling follow the platform conventions in the Developers space.

Base URL & auth

Base URL:  https://api.intsignal.com/security-suite/v1
Auth:      Authorization: Bearer <API_KEY>

Endpoint data and response actions are sensitive, so scope keys tightly: create an API key with edr:read for read-only integrations and add edr:write only where the integration genuinely needs to act (isolate, release). Keep write-scoped keys server-side.

Devices

Method & path	Purpose
`GET /devices`	List devices with health, policy group, and encryption status.
`GET /devices/{id}`	Device detail and recent activity.
`POST /devices/{id}/isolate`	Isolate a device from the network.
`POST /devices/{id}/release`	Release a device from isolation.

curl -X POST https://api.intsignal.com/security-suite/v1/devices/dev_123/isolate \
  -H "Authorization: Bearer $API_KEY"

Detections

Method & path	Purpose
`GET /detections`	Page through detections; filter by severity, device, or time.
`GET /detections/{id}`	Full detail, including the activity timeline.

Webhooks

Subscribe in Settings → Webhooks to react in real time:

detection.created — a new detection (with severity and device).
device.isolated / device.released
device.unhealthy — an endpoint stopped reporting.
identity.risk — a risky sign-in or takeover signal.

Payloads are signed; verify them per webhooks.

Guard write scopes

edr:write can isolate production machines. Scope keys tightly, keep them server-side, and prefer separate keys for read-only integrations. See authentication.