> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP interface overview

> Integrate with Lookout's versioned local HTTP interface.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

The versioned interface exposes the security graph, detection state, normalized events, Alerts, Incidents, rules, and collector submission path. The deployed Lookout instance remains authoritative.

## Base URL

Local development uses:

```text theme={null}
http://127.0.0.1:4173
```

Production deployments should expose Lookout only through private TLS or an authenticated TLS reverse proxy. Replace `https://lookout.example.com` in generated examples with your deployment URL.

## Request format

* Send JSON request bodies with `Content-Type: application/json`.
* Standard request bodies are limited to 1 MiB.
* Signed collector envelopes allow up to 5 MiB of transport JSON for the bounded 4 MiB signed format.
* Times use ISO 8601 strings.
* Successful ingestion and collector submission return `202 Accepted`.
* Errors return a JSON object with an `error` string and may include validation `issues`.

## Authentication

All `/api/v1` operations require an authorized principal, except collector enrollment handled by the installation workflow. `GET /health` is intentionally unauthenticated and exposes aggregate state only.

```sh theme={null}
curl --fail --silent \
  --header "Authorization: Bearer $LOOKOUT_API_TOKEN" \
  https://lookout.example.com/api/v1/detection-plan
```

See [authentication and roles](/reference/authentication) for permission mapping and token handling.

## Ingestion choices

<CardGroup cols={2}>
  <Card title="Normalized events" icon="list">
    Submit events already conforming to Lookout's common envelope.
  </Card>

  <Card title="Raw records" icon="file-code">
    Use a built-in normalizer for Zeek, syslog, OpenTelemetry, Tailscale, or Linux journal records.
  </Card>
</CardGroup>

Signed collectors are the production path for continuous endpoint evidence. Their envelopes add replay protection, sequence enforcement, identity binding, and durable retry.

## Compatibility

Only `/api/v1` is the versioned backend contract. The legacy `/api/snapshot` route serves the temporary browser fixture and is not supported for integrations.

Lookout records every authenticated versioned request in its audit journal and emits a normalized access event for approval-aware detection.