Developers · Public API

Build on the platform. Every capability is an endpoint.

One versioned REST API across all three modules, Platform, Intelligence and Mission Control. Provision sites, write zero-trust policy, query Lucy, drive incidents, stream events. Self-serve, fully documented, no black boxes.

Get an API key → Jump to reference

Base URL

https://api.open-systems.com/v1

Auth

Authorization: Bearer <token>

Install CLI

brew install open-ch/tap/os

Reference

Overview

The Open Systems API is a resource-oriented REST API. It uses predictable, plural-noun URLs, accepts and returns JSON, authenticates with bearer tokens, and uses standard HTTP verbs and status codes. Every product capability you can drive in the portal is available here, and our own AI agents and partners use the exact same API.

At a glance

Protocol

HTTPS only · TLS 1.3 · JSON request & response bodies

Base URL

https://api.open-systems.com/v1 · EU region: https://eu.api.open-systems.com/v1

Versioning

URI-versioned (/v1) · breaking changes ship as a new major version

Spec

OpenAPI 3.1, machine-readable at /v1/openapi.json

Formats

application/json · timestamps in RFC 3339 / ISO 8601 UTC

Getting started

Authentication

Authenticate every request with a bearer token. Use long-lived API keys for back-end integrations, or the OAuth 2.0 client-credentials flow for machine-to-machine access with short-lived tokens and scoped permissions.

POST/oauth/tokenExchange client credentials for an access token

Request

# client-credentials grant
curl -X POST https://api.open-systems.com/v1/oauth/token \
 -d "grant_type=client_credentials" \
 -d "client_id=$OS_CLIENT_ID" \
 -d "client_secret=$OS_CLIENT_SECRET" \
 -d "scope=platform:write intelligence:read"

Response · 200

{
 "access_token": "os_at_9f3c…",
 "token_type": "Bearer",
 "expires_in": 3600,
 "scope": "platform:write intelligence:read"
}

Scopes

Platform

platform:readplatform:write

Intelligence

intelligence:readintelligence:invoke

Mission Control

mc:readmc:write

Events

events:readwebhooks:manage

Getting started

Conventions

Consistent rules across every resource: cursor pagination, idempotency for writes, rate limits surfaced in headers, and standard error envelopes.

Rules

Pagination

Cursor-based, ?limit=50&cursor=…; response carries next_cursor

Idempotency

Send Idempotency-Key on POST to safely retry

Rate limits

X-RateLimit-Limit · X-RateLimit-Remaining · Retry-After on 429

Filtering

Query params, e.g. ?status=active&region=eu-central

Errors

JSON envelope with error.code, error.message, request_id

Platform API · Module 01

Sites

Sites are the edges of your network, branches, data centers and clouds. Provision, configure and decommission them programmatically; everything an appliance used to do, as an API object.

GET/sitesList all sites

Request

curl https://api.open-systems.com/v1/sites \
 -H "Authorization: Bearer $TOKEN"

Response · 200

{
 "data": [{
  "id": "site_DE04",
  "name": "berlin-04",
  "region": "eu-central",
  "status": "active",
  "ztna": true
 }],
 "next_cursor": null
}

POST/sitesProvision a new site

Body parameters

namerequired	string
regionrequired	string
ztna	boolean
bandwidth_mbps	integer
ha	boolean

Request

curl -X POST …/v1/sites \
 -H "Authorization: Bearer $TOKEN" \
 -d '{ "name": "berlin-04",
    "region": "eu-central",
    "ztna": true, "ha": true }'

DELETE/sites/{id}Decommission a site

Platform API · Module 01

Tunnels & connectivity

Manage encrypted overlays between sites, clouds and the global backbone. Tunnels are application-aware and self-healing.

POST/tunnelsCreate an encrypted tunnel

Body parameters

fromrequired	site_id
torequired	site_id
protocol	ipsec \| wireguard
routing	bgp \| static

Response · 201

{
 "id": "tun_8821",
 "protocol": "wireguard",
 "state": "up",
 "mtu": 1420
}

Platform API · Module 01

Policies · ZTNA

Zero-trust access as code. Apply declarative policy from YAML/JSON or your CI pipeline; Lucy validates and flags shadowed or conflicting rules before they go live.

PUT/policies/{name}Create or replace a policy (idempotent)

Request

curl -X PUT …/v1/policies/zero-trust \
 -H "Authorization: Bearer $TOKEN" \
 -H "Idempotency-Key: 4f1a…" \
 --data-binary @zero-trust.json

Response · 200

{
 "name": "zero-trust",
 "revision": 2291,
 "rules": 142,
 "conflicts": 0,
 "validated_by": "lucy"
}

POST/policies/{name}/rollbackInstantly roll back to a prior revision

Platform API · Module 01

Web security · SWG / CASB DLP on roadmap

Programmatically manage inline inspection and cloud-app controls across every user and location. DLP endpoints are on the roadmap.

GET/web/categoriesList URL / app categories

POST/dlp/rulesCreate a data-loss-prevention rule

Body parameters

classifierrequired	pattern \| fingerprint \| ml
action	log \| block \| quarantine
channels	array<string>

Response · 201

{
 "id": "dlp_4410",
 "classifier": "ml",
 "action": "block",
 "enabled": true
}

Intelligence API · Module 02

Copilot

Ask the platform in natural language. The Copilot endpoint answers operational and security questions with grounded context from 35 years of operational data, and can return structured actions for you to approve.

POST/intelligence/copilot/queryAsk a question, get a grounded answer

Request

curl -X POST …/v1/intelligence/copilot/query \
 -H "Authorization: Bearer $TOKEN" \
 -d '{ "prompt": "Why is latency high
    to site berlin-04?" }'

Response · 200

{
 "answer": "BGP flap on upstream…",
 "confidence": 0.91,
 "citations": ["evt_77…"],
 "suggested_action": {
  "type": "reroute",
  "requires_approval": true
 }
}

Intelligence API · Module 02

Agents

Autonomous agents execute multi-step operations inside human-in-the-loop approval boundaries. Launch a run, inspect every step, approve gated actions.

POST/intelligence/agents/runsStart an agent run

Body parameters

taskrequired	string
scope	site_id \| global
autonomy	propose \| act_with_approval

Response · 202

{
 "run_id": "run_5d2a",
 "state": "running",
 "replicates": "L3-workflow"
}

POST/intelligence/agents/runs/{id}/approveApprove a gated (HITL) action

Intelligence API · Module 02

Investigations

Automated root-cause investigations, mapped to MITRE ATT&CK and your historical baselines.

GET/intelligence/investigations/{id}Retrieve an investigation & its evidence

Mission Control API · Module 03

Incidents

Drive the human-backed layer programmatically. Create incidents, track Level-3 ownership, and read expert-led resolution timelines.

POST/mc/incidentsRaise an incident to Mission Control

Body parameters

severityrequired	sev1 \| sev2 \| sev3
summaryrequired	string
site_id	string

Response · 201

{
 "id": "inc_48217",
 "severity": "sev1",
 "owner": "L3-engineer",
 "ack_eta_sec": 900
}

GET/mc/incidents/{id}/timelineFull, immutable resolution timeline

Mission Control API · Module 03

Change requests

Submit and track change requests handled by Level-3 engineers, every action attributable and logged.

POST/mc/change-requestsOpen a change request

Platform-wide

Events & webhooks

Subscribe to real-time events, site state, policy changes, agent actions, incidents. Deliveries are signed with HMAC-SHA256 so you can verify authenticity.

POST/webhooksRegister a webhook endpoint

Request

curl -X POST …/v1/webhooks \
 -H "Authorization: Bearer $TOKEN" \
 -d '{ "url": "https://acme.com/hook",
    "events": ["incident.created",
         "agent.action.gated"] }'

Delivery headers

OS-Event: incident.created
OS-Delivery: dlv_91a2
OS-Signature: sha256=4c1f…

Platform-wide

Observability

Stream logs, metrics and audit events into your own stack. Native exporters keep your SIEM and data lake in sync.

Export targets & formats

Formats

JSONsyslogCEFOpenTelemetry

SIEM

SplunkMicrosoft SentinelQRadar, bi-directional

Audit

Immutable, tamper-evident; every admin & agent action via GET /audit/events

Platform-wide

SDKs & tooling

Use the language and workflow you already know. First-class SDKs, a Terraform provider for infrastructure-as-code, and a single-binary CLI.

Terraform

Declarative sites, tunnels & policy.

registry.terraform.io/open-systems

SDKs

Idiomatic clients, typed models.

PythonGoTypeScriptJava

CLI

Scriptable single binary.

os sites listos policy apply

Reference

Errors & status codes

Every error returns a consistent JSON envelope with a stable error.code, a human-readable message and a request_id for support.

4xxError envelopeSame shape for every failure

Example · 422

{
 "error": {
  "code": "validation_failed",
  "message": "region is required",
  "field": "region"
 },
 "request_id": "req_2f9c…"
}

Common codes

200 OK

201 Created

202 Accepted

400 Bad request

401 Unauthorized

403 Forbidden

404 Not found

409 Conflict

422 Validation

429 Rate limited

Start building today.

Grab an API key, install the CLI, and provision your first site in minutes.

Get API access →Explore the platform