me0nline/LOGAR

Fork 0

Table of Contents

API Reference

1. Authentication & Security
2. Forwarder Enrollment API

POST /api/client/enroll

3. Client & Seat Management API

GET /api/clients
POST /api/client/revoke
POST /api/client/approve
POST /api/client/delete
GET /api/client/export

4. Hermes AI & Log Telemetry API

GET /api/hermes/report
GET /api/hermes/all

5. Licensing & Sub-CA Management API

GET /api/ca/csr
POST /api/license/update
POST /api/license/sync

6. Authentication & Health API

POST /api/auth/login
POST /api/auth/logout
GET /health

API Reference

The LOGAR Server Hub exposes a comprehensive REST API on default port 8443 for edge enrollment, client seat management, Hermes AI log ingestion, and WebUI administration.

1. Authentication & Security

Administrator Endpoints: Require either an authenticated session cookie (established via /login or /api/auth/login) or an Authorization: Bearer <ADMIN_TOKEN> header.
Hermes Endpoints: Configurable for open access or Bearer token authentication via Authorization: Bearer <HERMES_TOKEN>.
Brute-Force Rate Limiting: All authentication and enrollment endpoints enforce in-memory IP rate limiting.
Sanitization: Dynamic WebUI rendering applies full html.escape sanitization against Stored XSS.

2. Forwarder Enrollment API

`POST /api/client/enroll`

Enrolls a new edge client or proactively renews an existing client's certificate.

Request Body:

{
  "client_id": "db-prod-01.corp.internal",
  "hostname": "db-prod-01",
  "os": "linux",
  "enrollment_secret": "SECURE_SHARED_SECRET"
}

Success Response (200 OK):

{
  "ca_cert": "-----BEGIN CERTIFICATE-----\nMIID...",
  "client_cert": "-----BEGIN CERTIFICATE-----\nMIID...",
  "client_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIE..."
}

Error Responses:

403 Forbidden: Invalid enrollment secret or seat quota exceeded.
429 Too Many Requests: Rate limit exceeded.

3. Client & Seat Management API

`GET /api/clients`

Returns seat quota status and registered client telemetry (Requires Admin Auth).

Response (200 OK):

{
  "active_seats": 2,
  "max_seats": 25,
  "clients": [
    {
      "client_id": "db-prod-01.corp.internal",
      "hostname": "db-prod-01",
      "os_type": "linux",
      "cert_fingerprint": "7D5B660B08...",
      "status": "active",
      "first_seen": "2026-09-26 10:00:00",
      "last_seen": "2026-09-26 12:45:00",
      "last_seen_relative": "15m ago"
    }
  ]
}

`POST /api/client/revoke`

Revokes an edge client's seat license (Requires Admin Auth).

Request Body:

{
  "client_id": "db-prod-01.corp.internal"
}

`POST /api/client/approve`

Reactivates a revoked edge client (Requires Admin Auth).

Request Body:

{
  "client_id": "db-prod-01.corp.internal"
}

`POST /api/client/delete`

Permanently removes a forwarder record from SQLite (Requires Admin Auth).

Request Body:

{
  "client_id": "db-prod-01.corp.internal"
}

`GET /api/client/export`

Generates a downloadable client_config.json profile pre-configured for edge deployment (Requires Admin Auth).

4. Hermes AI & Log Telemetry API

`GET /api/hermes/report`

Returns all verified anomalies within the active 12-hour evaluation window with full temporal metadata.

Response (200 OK):

[
  {
    "fingerprint": "corp.internal:db-prod-01.corp.internal:PostgresConnectionLimitExceeded",
    "site": "corp.internal",
    "server": "db-prod-01.corp.internal",
    "signature": "PostgresConnectionLimitExceeded",
    "severity": "WARNING",
    "message": "Maximum client connections reached (100/100)",
    "os_type": "linux",
    "first_seen": "2026-09-26T08:00:00+00:00",
    "last_seen": "2026-09-26T12:00:00+00:00",
    "consecutive_runs": 5,
    "evaluation_window": "12h",
    "verified": true,
    "status": "VERIFIED"
  }
]

`GET /api/hermes/all`

Diagnostic endpoint listing all raw tracked issues in SQLite (Requires Admin Auth).

5. Licensing & Sub-CA Management API

`GET /api/ca/csr`

Returns the current Subordinate CA Certificate Signing Request in PEM format.

`POST /api/license/update`

Imports a signed Subordinate CA certificate (ca.crt) or activated .lic bundle (Requires Admin Auth).

`POST /api/license/sync`

Triggers an immediate background synchronization over WebSocket with the Master Authority (wss://logar.eibl.tech/ws/license) (Requires Admin Auth).

6. Authentication & Health API

`POST /api/auth/login`

Authenticates administrator credentials and establishes session cookie.

Request Body:

{
  "username": "admin",
  "password": "YOUR_ADMIN_PASSWORD"
}

`POST /api/auth/logout`

Destroys the active administrator session cookie.

`GET /health`

Returns hub health, encryption fingerprint, active listener ports, and mTLS status.