API Reference
Base URL, the two authentication modes, rate limiting, and a grouped map of the backend's controller areas.
This page is an organized map of the ArmorIQ backend's API surface - not an exhaustive endpoint list. Use it to find which area owns a capability, then follow the linked docs (or the in-app Swagger UI) for full request and response detail.
Base URL
The backend has no global route prefix - every path below is served exactly as written, with no /api or /v1 prefix. It listens on port 8080 by default (overridable with the PORT environment variable). Outside production, interactive Swagger docs are available at /api-docs.
Authentication
ArmorIQ has two authentication modes, and most controllers use exactly one:
| Mode | Header | Used for |
|---|---|---|
| JWT Bearer | Authorization: Bearer <jwt> | Dashboard and user-facing calls - organization, user, dashboard, audit logs, notifications, and most policy and IAP dashboard routes |
| API key | x-api-key: <key> (also accepted as Authorization: Bearer <key>) | SDK, agent, and plugin calls - delegation, observability ingest, token-usage ingest, and most IAP sdk/* routes |
A small number of routes accept either - for example, some policy-drafting endpoints the ArmorClaude plugin calls with its own API key instead of a full dashboard session. Plan and route activation endpoints stay JWT-only even where a sibling read endpoint accepts either. A separate ProxyAuthGuard covers proxy-only paths (obligation lookups, internal MCP routing) used by ArmorIQ's own enforcement proxy, not by SDKs or the dashboard directly.
Rate limiting
There is no global rate limit - most endpoints are unthrottled. Two named throttle buckets are configured and applied only where a route opts in:
| Bucket | Limit | Applied to |
|---|---|---|
auth | 5-10 requests/minute (varies by route) | Login, OTP verification/resend, forgot-password |
delegation | 30-60 requests/minute (varies by route) | Delegation create/approve/reject |
Controller areas
| Area | Purpose | Representative endpoints |
|---|---|---|
| /auth | Sign-up, sign-in, OAuth, sessions, password recovery | POST /auth/register, POST /auth/login, GET /auth/google/callback, POST /auth/refresh, GET /auth/me |
| /organization | Org CRUD, members, invites, roles, SSO/identity-provider setup | POST /organization, GET /organization/:orgId/members, POST /organization/:orgId/members/invite, PATCH /organization/:orgId/members/:userId/role |
| /api-keys | Create, list, revoke, and provision SDK API keys | POST /api-keys, GET /api-keys, POST /api-keys/:apiKeyId/revoke, POST /api-keys/provision |
| /policies | Policy CRUD, activation, member and client rule bindings, AI-assisted drafting, YAML import/export | POST /policies, POST /policies/:policyId/activate, POST /policies/check-access, GET /policies/yaml/export/:policyId |
| /iap | Intent plan enforcement, plans, audit, Merkle proofs, trust chain, agent kill switch | POST /iap/sdk/enforce, GET /iap/plan/:planId, GET /iap/plan/:planId/merkle-tree, POST /iap/agent/:agentId/kill, POST /iap/trust/delegate |
| /delegation | Human-in-the-loop approval for tool calls that exceed an agent's policy limit | POST /delegation/request, GET /delegation/poll, POST /delegation/approve, POST /delegation/reject |
| /observability | Ingest and query traces, sessions, and token/cost analytics | POST /observability/spans, GET /organization/:orgId/observability/sessions, GET /organization/:orgId/observability/analytics/summary |
| /mcp | MCP server registration, health, telemetry, vulnerabilities, certificates | POST /mcp/register, GET /mcp/servers, POST /mcp/servers/:mcpId/scan, GET /mcp/certificates |
| /agent | Agent registration and status | POST /agent/register, GET /agent/agents, POST /agent/agents/:agentId/status |
| /pap | Read-only view of pre-flight plan-refinement decisions | GET /pap/decisions, GET /pap/stats/overview, GET /pap/policy/snapshot |
Other areas
A few controllers exist outside the ten areas above and are documented alongside their feature rather than repeated here: /certificate (issue, check, revoke, rotate), audit-log (see Audit Logs), dashboard and admin/dashboard (product usage metrics), user, notification, search, checkout/billing, referral, blog, proxy-enforcement (the enforcement proxy's own token and OAuth flows), access-requests (waitlist capture), aiqraph (see AIQraph), and armorclaw (see ArmorClaw).
Endpoint lists here are representative, not exhaustive. Each linked page documents the routes relevant to that feature in more depth; for the complete route set, use the in-app Swagger UI at /api-docs.
Product Preferences
Enable or disable optional ArmorIQ products in your sidebar - OPA Engine, ArmorClaw, ArmorHealth, and ArmorPay.
Glossary
Definitions of every ArmorIQ-specific term: IAP, CSRG, MCP, OPA, ArmorClaw, AIQraph, intent token, and more. The single vocabulary reference for humans and AI agents.