API Reference

Base URL: https://flowtriq.com · All endpoints return JSON · All timestamps are UTC ISO 8601

Deploy API

Register Node

POST/api/deploy

Register a new node using a workspace deploy token. Returns the node's API key and UUID. See Mass Deployment for the full guide and one-liner deploy command.

Header	Value
Authorization*	`Bearer YOUR_DEPLOY_TOKEN`
Content-Type	`application/json`

Body Parameter	Required	Description
name	Yes	Display name for the node
ip	Yes	Public IP address of the server
location	No	Region or datacenter label
os	No	Operating system identifier
interface	No	Network interface to monitor (default: eth0)

// cURL
curl -X POST https://flowtriq.com/api/deploy \
  -H "Authorization: Bearer YOUR_DEPLOY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"web-prod-1","ip":"203.0.113.10"}'

// Response 200
{
  "ok": true,
  "node_uuid": "a1b2c3d4-...",
  "api_key": "64-char-hex-api-key",
  "name": "web-prod-1",
  "ip": "203.0.113.10"
}

HTTP	Error	Meaning
401	Invalid deploy token	Token is wrong, revoked, or missing
400	Node name / IP required	Missing required fields
402	Payment failed	No active subscription or payment issue
409	Duplicate name	A node with that name already exists

REST API v1

The REST API provides programmatic access to your workspace data. Use it to build integrations, embed Flowtriq into hosting panels, MSP tools, and NOC platforms.

Base URL: https://flowtriq.com/api/v1 · Auth: Authorization: Bearer YOUR_DEPLOY_TOKEN

Generate a deploy token in Dashboard → Settings → Workspace. The same token is used for the Deploy API and the REST API.

List Nodes

GET/api/v1/nodes

Returns all active nodes in your workspace. Supports pagination and status filtering.

Query Parameter	Default	Description
limit	50	Results per page (1-100)
offset	0	Pagination offset
status		Filter: `online`, `offline`, `attack`, `elevated`

// cURL
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://flowtriq.com/api/v1/nodes

// Response 200
{
  "ok": true,
  "nodes": [{
    "uuid": "a1b2c3d4-...",
    "name": "web-prod-1",
    "ip": "203.0.113.10",
    "status": "online",
    "last_pps": 4521,
    "active_incidents": 0,
    "priority": "normal"
  }],
  "total": 12,
  "limit": 50,
  "offset": 0
}

Get Node

GET/api/v1/nodes/{uuid}

Returns detailed info for a single node, including baseline traffic stats and protocol breakdown.

// cURL
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://flowtriq.com/api/v1/nodes/a1b2c3d4-...

// Response includes baseline data
{
  "ok": true,
  "node": {
    "uuid": "a1b2c3d4-...",
    "baseline": {
      "avg_pps": 3200,
      "p95_pps": 8500,
      "protocols": { "tcp": 72.3, "udp": 25.1 }
    }
  }
}

Create Node

POST/api/v1/nodes

Creates a new node. Same functionality as POST /api/deploy but returns the full node object.

Body	Required	Description
name	Yes	Display name (max 100 chars)
ip	Yes	Public IPv4 or IPv6 address
location	No	Datacenter / region label
os	No	Operating system
interface	No	Network interface (default: eth0)
priority	No	`production`, `staging`, `development`

Update Node

PATCH/api/v1/nodes/{uuid}

Update node properties. Only include the fields you want to change.

// cURL
curl -X PATCH -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"location":"US-East","priority":"high"}' \
  https://flowtriq.com/api/v1/nodes/a1b2c3d4-...

Delete Node

DELETE/api/v1/nodes/{uuid}

Soft-deletes a node. The node is deactivated and stops appearing in your dashboard. This cannot be undone via the API.

List Incidents

GET/api/v1/incidents

Returns incidents across all nodes. Supports filtering by status, severity, and node.

Query Parameter	Default	Description
limit	50	Results per page (1-100)
offset	0	Pagination offset
status		Filter: `active`, `resolved`, `false_positive`
severity		Filter: `critical`, `high`, `medium`, `low`
node		Filter by node UUID

// Response 200
{
  "ok": true,
  "incidents": [{
    "uuid": "d4e5f6a7-...",
    "node": { "uuid": "a1b2...", "name": "web-prod-1" },
    "family": "udp_flood",
    "severity": "critical",
    "peak_pps": 2450000,
    "duration_sec": 342
  }],
  "total": 47
}

Get Incident

GET/api/v1/incidents/{uuid}

Returns full incident detail including protocol breakdown, geographic origin data, and AI summary.

List Notification Channels

GET/api/v1/channels

Returns all notification channels configured in your workspace.

Create Notification Channel

POST/api/v1/channels

Body	Required	Description
name	Yes	Channel display name
type	Yes	`discord`, `slack`, `email`, `sms`, `pagerduty`, `opsgenie`, `webhook`, `teams`, `telegram`, `grafana`, `datadog`, `prometheus`
config	Yes	Type-specific configuration object (e.g. `{"webhook_url":"..."}`)

// Create a Discord channel
curl -X POST -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Alerts","type":"discord","config":{"webhook_url":"https://discord.com/api/webhooks/..."}}' \
  https://flowtriq.com/api/v1/channels

Delete Notification Channel

DELETE/api/v1/channels/{id}

Permanently deletes a notification channel.

Workspace Info

GET/api/v1/workspace

Returns workspace metadata including plan, node count, and subscription status.

Analytics Summary

GET/api/v1/analytics/summary

Returns aggregated incident analytics for the specified time range.

Query Parameter	Default	Description
range	30d	Time range: `7d`, `30d`, `90d`, `365d`

Status Overview

GET/api/v1/status

Quick health check of all your nodes, ideal for building status pages or NOC dashboards.

// Response 200
{
  "ok": true,
  "overall": "operational",
  "nodes_total": 12,
  "nodes_online": 12,
  "under_attack": 0,
  "nodes": [{
    "uuid": "a1b2c3d4-...",
    "name": "web-prod-1",
    "status": "online",
    "pps": 4521,
    "active_incidents": 0
  }]
}

Agent API

The agent API at https://flowtriq.com/api/v1/agent/* is used by ftagent to send metrics, report incidents, upload PCAPs, and receive configuration. See Agent API Reference for full endpoint documentation.

This API is not intended for direct use; the ftagent handles all communication automatically once configured.

Health Check

GET/api/health

Returns system health status. No authentication required.

// cURL
curl https://flowtriq.com/api/health

// Response 200
{ "status": "ok" }

Dashboard APIs

The dashboard uses session-authenticated API endpoints at /api/dash/* for live metrics, PCAP management, workspace operations, and more. These endpoints require an active dashboard session and are not intended for external use.