Developer Docs

Authentication

Browser users sign in at /auth. Machine callers use scoped API keys from account settings.

curl -X POST "https://app.aiflowos.com/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"your-password"}'

API Keys

Create, view and revoke API keys in Settings. Keys are returned once and stored as salted hashes.

curl "https://app.aiflowos.com/api/v1/alerts" \
  -H "X-API-Key: afos_live_your_key"

Signed Webhooks

Create a webhook in Integrations. Each integration has a unique tokenized URL and HMAC SHA-256 signing secret.

BODY='{"external_id":"alert-1001","title":"Suspicious login","description":"Multiple failed logins followed by success","severity":"high","source":"siem","data":{"host":"app-01"}}'
SIGNATURE=$(printf "%s" "$BODY" | openssl dgst -sha256 -hmac "webhook_secret" -hex | sed 's/^.* //')
curl -X POST "https://app.aiflowos.com/api/v1/webhooks/generic/{webhook_token}" \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -d "$BODY"

Domain Verification

Add a domain in Integrations, publish the generated aiflowos-verify=... TXT record, then click Verify. The API checks live DNS before marking the domain verified.

Status

Health checks are available at https://app.aiflowos.com/api/v1/status. The production-like staging backend does not expose interactive FastAPI Swagger docs.