Security
Inbound-security config plane. All /v1/security/* routes are platform-admin gated (Bearer SECURITY_ADMIN_TOKEN; fail-CLOSED when unset). The IP-allowlist is a shared Redis Set (I4 shared-contract, NOT a shared DB) with additive-trust, fail-CLOSED semantics. WAF-rule persistence (waf_rules) and the SIEM DLQ (siem_dlq) are §29.5-protected operator-gated migrations — not created by this service.
- Group: Governance & platform
- Contract:
contracts/security/v1/openapi.yaml - Public access: none — internal-only capability. It is NOT exposed on the public API gateway (
https://api.vagarylabs.com); it is reachable only inside the fleet (container/tailnet) by first-party callers. There is no customer-facing endpoint to call. - Auth (internal):
adminBearerfirst-party bearer
Endpoints
| Method | Path | Summary |
|---|---|---|
GET | /health | liveness (open) |
GET | /metrics | Prometheus text — includes siem_dlq_depth_total gauge (open) |
GET | /v1/security/ip-allowlist/{organization_id} | list the per-org IP-allowlist Set members |
POST | /v1/security/ip-allowlist/{organization_id} | add IP/CIDR entries (additive-trust; max 100/request; SADD) |
DELETE | /v1/security/ip-allowlist/{organization_id} | remove IP/CIDR entries (SREM; removing the last member disables the per-org gate) |
GET | /v1/security/waf/rules | list WAF rules (default + custom) |
POST | /v1/security/waf/rules | add a custom WAF rule (regex patterns, priority) |
PUT | /v1/security/waf/rules/{name} | update a WAF rule |
DELETE | /v1/security/waf/rules/{name} | delete a custom WAF rule (default rules are not deletable) |
PUT | /v1/security/siem/config | set SIEM provider + endpoint (creds are env-only, never in the body) |
POST | /v1/security/events | ingest a security event → PII-scrub → format → SSRF-validate endpoint → egress to SIEM |
Schemas
No inline component schemas in this contract.
Generated by scripts/gen-capability-docs.py from contracts/security/v1/openapi.yaml — the contract IS the source of truth; edit the contract, not this page.