API REFERENCE

Infronest REST API

Every Infronest module is backed by a REST API scoped to your workspace. The API is described by a live OpenAPI 3 schema generated from the running backend, so the endpoint groups below are the real ones — not a hand-written wish list.

Book a demo

Read the docs

# Base URL

https://<workspace>.infronest.com/api/

# Authentication

Authorization: Bearer <access_token>

POST /api/auth/login/

{ "username": "you@company.com", "password": "••••••••" }

200 OK

{

  "access":  "eyJhbGciOiJIUzI1NiIs…",

  "refresh": "eyJhbGciOiJIUzI1NiIs…",

  "user": {

    "id": 42,

    "email": "you@company.com",

    "role": "SUPER_ADMIN",

    "role_display": "Super Admin",

    "department": "IT",

    "permissions": [ … ]

}

}

Endpoint

Base URL

Each tenant is served from its own workspace subdomain, and the API lives directly under it:

Workspace: Replace <workspace> with your workspace slug (the one derived from your company name at sign-up).
JSON: All requests and responses are JSON.
Interactive docs: The schema itself is served by drf-spectacular and rendered as interactive Swagger UI and ReDoc inside the app for administrators at /api/docs/ and /api/redoc/.

Access

Authentication

Infronest uses JSON Web Tokens (SimpleJWT). Exchange your workspace credentials for an access and a refresh token, then send the access token as a bearer header on every call:

Tokens: Access tokens are short-lived (60 minutes by default); refresh tokens last up to 7 days and are rotated on use.
Login: A successful login returns both tokens plus the signed-in user’s profile:
Two-factor: When a user has two-factor authentication enabled, the login response withholds the tokens and returns totp_required: true with a short-lived pre-auth token; the caller completes the second factor before receiving JWTs.
Refresh and revoke: Refresh with POST /api/auth/refresh/, check a token with POST /api/auth/verify/, and revoke a session (blacklisting the refresh token) with POST /api/auth/logout/.
Device agents: Browser sessions can also run in httpOnly-cookie mode, and device agents authenticate with their own enrollment token (Authorization: DeviceToken <token>) — the schema advertises all of these security schemes.

How it behaves

Conventions

Resource-oriented: Most resources are standard collections: GET to list, POST to create, GET /{id}/ to retrieve, PATCH/PUT to update, DELETE to remove — with custom actions like /{id}/acknowledge/ or /{id}/launch/ hung off the resource.
Pagination: List endpoints are paginated (page number, 50 items per page by default) and wrap results as { count, next, previous, results }. Pass ?page=N to page through.
Tenant isolation: Every response is scoped to the organization of the authenticated caller. There is no cross-tenant access — you only ever see your own workspace’s data.
Caching: Some GET responses are cached briefly server-side for performance; writes return fresh data.

Surface area

Endpoint groups

The API spans roughly forty modules and over a thousand routes. Below are the primary top-level groups with a couple of real endpoints each; the modules your workspace can call depend on your plan.

Group	Base path	Description	Endpoints
Authentication	/api/auth/	Obtain, refresh, verify, and revoke JWTs; self-serve workspace registration.	POST /api/auth/login/ POST /api/auth/refresh/ POST /api/auth/verify/ POST /api/auth/logout/
MDM — Device Management	/api/mdm/	Enrolled fleet, policies, alerts, and per-OS agent downloads across Windows, macOS, Linux, and Android.	GET /api/mdm/devices/ GET /api/mdm/policies/ POST /api/mdm/alerts/{id}/acknowledge/ GET /api/mdm/agent/download/{os_type}/
Patch Management	/api/patch-management/	Patch posture dashboard, deployment rings, and deployment lifecycle.	GET /api/patch-management/dashboard/ GET /api/patch-management/deployments/ POST /api/patch-management/deployments/{id}/cancel/
VAPT — Security Testing	/api/vapt/	Vulnerability assessment, analyst triage queue, bug-bounty programs, and threat intel.	GET /api/vapt/bugbounty/programs/ GET /api/vapt/analyst/queue/
IT Assets	/api/it-assets/	Asset inventory with assignment, bulk import/export, and acknowledgment workflows.	GET /api/it-assets/assets/ POST /api/it-assets/assets/bulk-import/
ITSM	/api/itsm/	ITIL service management — change requests, service catalog, and approvals.	GET /api/itsm/changes/ GET /api/itsm/catalog/
Tickets	/api/tickets/	Helpdesk tickets with comments, attachments, and per-ticket audit logs.	GET /api/tickets/ POST /api/tickets/{id}/add_comment/
Security & 2FA	/api/security/	Two-factor enrollment, backup codes, and the counter-attack / security monitoring system.	GET /api/security/2fa/status/ POST /api/security/2fa/enable/
RMM	/api/rmm/	Remote monitoring & management — network discovery and agent inventory ingest.	GET /api/rmm/discovered/ POST /api/rmm/agent/inventory/
Firewall	/api/firewall/	Firewall alerts, blocked IPs, and dashboard telemetry.	GET /api/firewall/blocked-ips/ POST /api/firewall/blocked-ips/{id}/unblock/
Phishing Simulation	/api/phishing/	Security-awareness campaigns, target assignments, and campaign lifecycle.	GET /api/phishing/campaigns/ POST /api/phishing/campaigns/{id}/launch/
Compliance (DPDP)	/api/compliance/	Data-subject requests, consent records, and breach incidents.	GET /api/compliance/dsr/ GET /api/compliance/consent-records/
Network Telemetry	/api/network-telemetry/	Metric ingest, incidents, and automated response playbooks.	GET /api/network-telemetry/playbooks/ POST /api/network-telemetry/playbooks/{id}/execute/
Reports	/api/reports/	Server-generated PDF reports — executive summary, assets, audit logs, and more.	GET /api/reports/executive-summary/ GET /api/reports/assets/
SSO	/api/sso/	Enterprise SAML and OIDC provider configuration, plus SCIM token management.	GET /api/sso/oidc/providers/ GET /api/sso/admin/saml/
Audit Trail	/api/audit-trail/	Tamper-evident audit history, asset change logs, and correlation alerts (with SIEM export).	GET /api/audit-trail/asset-history/ GET /api/audit-trail/correlation-alerts/

Putting it together

Example call

List the first page of tickets in your workspace with a bearer token:

curl https://<workspace>.infronest.com/api/tickets/ \

  -H "Authorization: Bearer <access_token>"

200 OK

{

  "count": 128,

  "next": "https://<workspace>.infronest.com/api/tickets/?page=2",

  "previous": null,

  "results": [ { "id": 1, "subject": "…", "status": "open", … } ]

}

New to the platform? Start with the documentation for workspace setup, roles, and module configuration.

Planning an integration?

We’ll walk your team through auth and the endpoints you need.

Book a demo

Read the docs