API And Webhooks

The Bitaic API and webhook layer lets engineering, operations, and automation teams retrieve monitoring data, manage monitored resources, configure alert behavior, export operational data, and deliver real-time events into internal systems.

When To Use API Versus Webhooks

Authentication And Authorization

• API requests use a Bitaic API token in the Authorization: Bearer <token> header.
• API tokens are created and rotated from Bitaic App settings by users with permission to manage API access.
• Requests are authorized against the calling user, workspace, organization, and role-based permissions.
• Administrative API activity is part of the Bitaic audit trail so teams can review configuration and access changes.

Base URL And Versioning

Resource Model

Endpoint Reference

Request And Response Shape

API responses use a predictable envelope so applications can log a request ID, handle pagination, and parse the returned resource payload.

GET /v1/alerts?state=open&severity=critical HTTP/1.1
Host: api.bitaic.com
Authorization: Bearer <token>
Accept: application/json

{
  "data": [
    {
      "id": "alert_01J5Z8P2A9W8H2XP0J4K3V7B8C",
      "severity": "critical",
      "state": "open",
      "summary": "Endpoint response time exceeded threshold",
      "target_id": "target_01J5Z8M4Q9K7P6N2H1W8R5T3A1",
      "opened_at": "2026-08-18T14:30:00Z"
    }
  ],
  "pagination": {
    "next_cursor": "cursor_eyJwYWdlIjoyfQ"
  },
  "request_id": "req_01J5Z8T6N9QVH6CY7W0Z6QG1F2"
}

Pagination, Filtering, And Limits

• List endpoints support cursor pagination with a next_cursor value when more records are available.
• Common filters include state, severity, target_id, type, from, and to.
• Metric and event queries should use bounded time windows so exports and dashboards stay responsive.
• API clients should handle 429 responses by honoring Retry-After and retrying with backoff.
• Retried writes should use an idempotency key when the client cannot safely determine whether the first request completed.

Errors And Recovery

{
  "error": {
    "code": "invalid_request",
    "message": "The severity filter must be one of info, warning, critical.",
    "field": "severity"
  },
  "request_id": "req_01J5Z8W6YF5QA20NHJ9FE7J7VQ"
}

Webhook Events

Webhook Payload And Security

Webhook deliveries use HTTPS, include a unique event ID, and provide the event name, delivery timestamp, workspace context, and related resource payload. Receivers should verify the signature before processing the event.

POST /bitaic/webhooks HTTP/1.1
Host: automation.example.com
Content-Type: application/json
X-Bitaic-Event: alert.created
X-Bitaic-Delivery: whd_01J5Z91CBA9W37F68JTE7W8JEV
X-Bitaic-Timestamp: 2026-08-18T14:30:00Z
X-Bitaic-Signature: sha256=<signature>

{
  "event_id": "evt_01J5Z91CBA9W37F68JTE7W8JEV",
  "event_type": "alert.created",
  "created_at": "2026-08-18T14:30:00Z",
  "workspace_id": "workspace_01J5Z82DB7YV6PRPK6K4WSGJ5X",
  "data": {
    "alert": {
      "id": "alert_01J5Z8P2A9W8H2XP0J4K3V7B8C",
      "severity": "critical",
      "state": "open",
      "summary": "Endpoint response time exceeded threshold",
      "target_id": "target_01J5Z8M4Q9K7P6N2H1W8R5T3A1"
    }
  }
}

• Validate X-Bitaic-Signature with the webhook signing secret before accepting the payload.
• Reject stale deliveries by checking X-Bitaic-Timestamp.
• Treat event_id and X-Bitaic-Delivery as idempotency values to prevent duplicate processing.
• Respond with a 2xx status after successful processing.
• Bitaic retries failed deliveries for temporary errors and records delivery attempts for troubleshooting.

Data Export

API exports support operational reporting, compliance review, backup, and downstream analytics. Export requests should include the product area, target scope, time window, and desired output format.

POST /v1/exports HTTP/1.1
Host: api.bitaic.com
Authorization: Bearer <token>
Content-Type: application/json

{
  "resource": "alerts",
  "format": "csv",
  "from": "2026-08-01T00:00:00Z",
  "to": "2026-08-18T23:59:59Z"
}

Security Notes

• Use least-privilege tokens for automation and rotate them on a regular schedule.
• Separate read-only reporting tokens from tokens that can create, update, or delete configuration.
• Restrict webhook receivers to HTTPS endpoints controlled by your organization.
• Log request_id, event_id, and delivery IDs in downstream systems for support and audit review.
• Avoid forwarding secrets, credentials, or unnecessary sensitive details through webhook payloads or exports.

Related Workflows

• Integrations for Slack, Microsoft Teams, email, PagerDuty, and custom webhook routing.
• Endpoint Monitoring for endpoint availability, response time, and uptime states.
• Health Monitoring for CPU, memory, disk, disk I/O, and agent status metrics.
• Windows Event Monitoring for event log signals and event-driven alerting.
• Audit for reviewing administrative and security-relevant activity.