API

REST at /api/v1. Default bind 127.0.0.1:9410.

Authenticate with a bearer token. Operators and customers each get tokens from the GUI (customers: scoped read or mitigate). Login is rate-limited. Browser sessions use CSRF protection.

Live updates: SSE at /api/v1/events.

Prometheus: /metrics (collector packets and flows, decode errors, unknown exporters, tracked hosts, active attacks, BGP announces, withdraws, rejections, peer state).

OpenAPI

The OpenAPI spec ships in the bundle at docs/openapi/v1.yaml.