API Reference
Base URL: https://api.xlnszia.com/api/v1. The API is versioned — all endpoints below are prefixed with /api/v1. The application
at https://app.xlnszia.com calls it directly (cross-origin, CORS-enabled), and WebSockets
connect to wss://api.xlnszia.com/api/v1/ws. The unversioned https://api.xlnszia.com/api/health endpoint is kept for health checks.
Authenticate with the Authorization: Bearer <token> header (JWT from login or a personal
access token).
Health
| Method | Path | Description |
|---|
| GET | /api/health | Health check (unversioned) |
Authentication
| Method | Path | Description |
|---|
| GET | /api/v1/auth/options | Login options + SSO configured flag |
| POST | /api/v1/auth/login | Login with email + password (OAuth2 form), returns JWT |
| GET | /api/v1/auth/me | Current user + permissions |
| POST | /api/v1/auth/change-password | Change own password |
| GET | /api/v1/auth/sso/login | Redirect to the IdP (SAML AuthnRequest) |
| POST | /api/v1/auth/sso/acs | SAML ACS: consume response, SSO login |
| GET/PUT | /api/v1/sso/settings | SSO settings + login options |
| CRUD | /api/v1/sso/mappings | SAML role mappings |
Dashboard & tests
| Method | Path | Description |
|---|
| GET | /api/v1/dashboard/stats | Dashboard statistics |
| CRUD | /api/v1/tests | Test CRUD (SSL / DNS) |
| GET | /api/v1/tests/{id}/checks | Check history |
| POST | /api/v1/tests/{id}/check | Trigger a manual check |
Alerts & events
| Method | Path | Description |
|---|
| CRUD | /api/v1/alerts/rules | Configured alert rules |
| GET/PUT | /api/v1/alerts | Fired alerts: list / acknowledge / resolve |
| GET | /api/v1/alerts/count | Open / unread alert counts (navbar badge) |
| GET | /api/v1/events | Event stream (filters: type, severity, alert_triggered, test) |
| GET | /api/v1/audit | Audit trail (filters: action, user) |
Administration
| Method | Path | Description |
|---|
| CRUD | /api/v1/users | User CRUD |
| CRUD | /api/v1/teams | Team CRUD |
| CRUD | /api/v1/environments | Environment CRUD |
| GET | /api/v1/roles/permissions | Permission catalog |
| CRUD | /api/v1/roles | Role CRUD |
| CRUD | /api/v1/tokens | Personal access tokens |
Governance, integrations & secrets
| Method | Path | Description |
|---|
| GET | /api/v1/governance/usage | Plan + current usage |
| GET | /api/v1/governance/plans | Available plans |
| PUT | /api/v1/governance/plan | Change the workspace plan |
| CRUD | /api/v1/integrations | Integrations |
| GET | /api/v1/integrations/types | Integration type catalog |
| CRUD | /api/v1/secrets | Key Vault secrets |
WebSocket
| Endpoint | Description |
|---|
wss://api.xlnszia.com/api/v1/ws?token=<jwt> | Real-time event stream (heartbeat, subscribe / unsubscribe) |
Messages are JSON; the server filters events by the authenticated user's role and team.
