Beta module namespace
security
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
18 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/security/anomalies | security:anomaly:read | Bearer token | Computes the tenant's prioritized anomalies on demand: the permitted-vs-observed drift (consumed via the store, not recomputed), egress/exfil-relevant drift labeled from the resource, and the correlated/high security findings (incl. the joined anti_evasion mark). |
| get | /v1/m/security/cases | security:case:read | Bearer token | Lists the tenant's forensic cases. |
| post | /v1/m/security/cases | security:case:write | Bearer token | Opens an incident case, snapshotting the ledger integrity at the moment of opening (so a later tamper is detectable against the open-time state). |
| get | /v1/m/security/cases/{id} | security:case:read | Bearer token | Returns one case. |
| patch | /v1/m/security/cases/{id} | security:case:write | Bearer token | Updates a case's lifecycle (status/severity/summary), self-audited. |
| get | /v1/m/security/cases/{id}/export | security:case:read | Bearer token | Exports a case's relevant ledger events in a SIEM format (every format audit.Formats() lists), re-verifiable offline. |
| get | /v1/m/security/cases/{id}/links | security:case:read | Bearer token | Lists a case's chain of custody. |
| post | /v1/m/security/cases/{id}/links | security:case:write | Bearer token | Appends one immutable chain-of-custody link attaching a finding / ledger sequence / anomaly / note to a case. |
| get | /v1/m/security/cases/{id}/timeline | security:case:read | Bearer token | Reconstructs a case's timeline from the append-only ledger and VERIFIES the chain and (where a checkpoint key is wired) the signed checkpoints, then enriches it with attribution (identity), least-privilege drift and data lineage. |
| get | /v1/m/security/enforcement | security:finding:read | Bearer token | Returns the tenant's inline-enforcement posture (all classes). |
| put | /v1/m/security/enforcement | security:enforcement:admin | Bearer token | Sets the inline-enforcement posture for a guardrail class. |
| get | /v1/m/security/findings | security:finding:read | Bearer token | Lists the tenant's findings, filterable by kind/severity/ status/source. |
| get | /v1/m/security/findings/export | security:finding:read | Bearer token | Exports a complete filtered snapshot. |
| get | /v1/m/security/findings/{id} | security:finding:read | Bearer token | Returns one finding. |
| patch | /v1/m/security/findings/{id} | security:finding:write | Bearer token | Updates a finding's triage state (open/triaged/resolved/ dismissed). |
| post | /v1/m/security/guardrails/inspect | security:guardrail:write | Bearer token | Runs the guardrails over a submitted piece of agent text. |
| get | /v1/m/security/integrity/verify | security:integrity:read | Bearer token | security module route (requires security:integrity:read) |
| get | /v1/m/security/safety-posture | security:finding:read | Bearer token | Aggregates the tenant's provider safety-posture findings (the OpenAI Moderation / AWS Bedrock Guardrails / Azure RAI read-first posture) into a per-provider-surface roll-up. |