Skip to main content
For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.
The versioned interface exposes the security graph, detection state, normalized events, Alerts, Incidents, rules, and collector submission path. The deployed Lookout instance remains authoritative.

​
Base URL

Local development uses:
Production deployments should expose Lookout only through private TLS or an authenticated TLS reverse proxy. Replace https://lookout.example.com in generated examples with your deployment URL.

​
Request format

  • Send JSON request bodies with Content-Type: application/json.
  • Standard request bodies are limited to 1 MiB.
  • Signed collector envelopes allow up to 5 MiB of transport JSON for the bounded 4 MiB signed format.
  • Times use ISO 8601 strings.
  • Successful ingestion and collector submission return 202 Accepted.
  • Errors return a JSON object with an error string and may include validation issues.

​
Authentication

All /api/v1 operations require an authorized principal, except collector enrollment handled by the installation workflow. GET /health is intentionally unauthenticated and exposes aggregate state only.
See authentication and roles for permission mapping and token handling.

​
Ingestion choices

Normalized events

Submit events already conforming to Lookout’s common envelope.

Raw records

Use a built-in normalizer for Zeek, syslog, OpenTelemetry, Tailscale, or Linux journal records.
Signed collectors are the production path for continuous endpoint evidence. Their envelopes add replay protection, sequence enforcement, identity binding, and durable retry.

​
Compatibility

Only /api/v1 is the versioned backend contract. The legacy /api/snapshot route serves the temporary browser fixture and is not supported for integrations. Lookout records every authenticated versioned request in its audit journal and emits a normalized access event for approval-aware detection.