<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: Building Security Data API Layer
subdomain: security-data-engineering
type: api-reference
---

# Building Security Data API Layer — API Reference

> API reference for design and implement secure API layers for accessing, querying, and managing security data across SIEM, SOAR, and threat intelligence platforms.

## Base URL

```
https://api.cipher.security/v1
```

## Authentication

All endpoints require Bearer token authentication:

```
Authorization: Bearer <token>
```

## Endpoints

### `POST /api/v1/query`

Execute a unified query across security data backends

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `GET /api/v1/schema`

Retrieve API schema and available data sources

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `GET /api/v1/audit`

Get API access audit trail

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `POST /api/v1/tokens`

Generate or rotate API access tokens

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

### `GET /api/v1/health`

Check API layer health and backend connectivity

**Parameters:**

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | string | varies | Resource identifier |

**Response:**

```json
{
  "status": "success",
  "data": {},
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "request_id": "req-abc123"
  }
}
```

---

## Error Handling

All errors follow a consistent format:

```json
{
  "status": "error",
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Descriptive error message",
    "details": {}
  }
}
```

## Rate Limiting

API requests are rate-limited to 100 requests per minute per token. Rate limit headers are included in all responses:

- `X-RateLimit-Limit`: Maximum requests per window
- `X-RateLimit-Remaining`: Remaining requests in current window
- `X-RateLimit-Reset`: Unix timestamp when the window resets
