Operations API
The Operations API exposes the statistics and audit data behind the Dashboard and Analytics screens. This page also points you to the remaining API areas not covered by their own page.
Base path: /api/v1/operations. All requests require authentication.
Statistics
| Method | Path | Purpose | Permission |
|---|---|---|---|
| GET | /operations/statistics | Overall operations statistics | authenticated |
| GET | /operations/statistics/incidents | Incident statistics | incident:read |
| GET | /operations/statistics/cmdb | CMDB statistics | authenticated |
| GET | /operations/statistics/tech | Technology statistics | authenticated |
| GET | /operations/statistics/analytics | Analytics data | authenticated |
| GET | /operations/statistics/finops | Cost/usage (FINOPS) | authenticated |
| GET | /operations/statistics/agents | AI agent statistics | authenticated |
| GET | /operations/statistics/management | Management overview | authenticated |
These power the KPIs and charts you see in the app, useful if you want to feed CloudPeek metrics into your own dashboards.
Audit
| Method | Path | Purpose | Permission |
|---|---|---|---|
| GET | /operations/audit/{resource} | Audit records for a resource type | audit_log:read |
| GET | /operations/audit/{resource}/{id} | Audit records for a specific resource | audit_log:read |
The audit endpoints return the attributed, timestamped trail of actions, the API behind the Audit Logs screen.
Other API areas
CloudPeek's API is broad. Beyond the resources with their own reference pages, these areas exist (all under /api/v1, all requiring authentication and their noted permissions):
| Area | Base path | What it covers |
|---|---|---|
| Users | /users | Manage users and their per-tenant roles (user:*) |
| Tenants | /tenants | Create and edit tenants (tenants:*) |
| Tenant settings | /tenants/settings | LLM provider config, OTEL export (tenant_settings:*) |
| Admin config | /admin/config | Platform/tenant default configuration |
| Alert sources | /incidents/sources | Configure tools as alert sources (incident_source:*) |
| Alert silencing | /incidents/silencing | Silencing rules and triage cooldowns |
| Threat hunting | /threat-hunting | Leads, runs and hunt rules (threat_hunting:*) |
| Remediation | /remediation-plans, /approval-requests | Remediation plans and approvals |
| Client integrations | /client-integrations | Slack/webhook sinks (client_integration:*) |
| Webhooks | /webhooks | Inbound/outbound webhooks (the public receive endpoint uses signature auth) |
| OAuth (tools) | /oauth, /oauth-apps | OAuth onboarding for tools and external apps |
| Seeds | /seeds | Upload/diff/apply seed manifests (seed:*) |
| Eval | /eval | Evaluation runs (eval:*) |
| Changelog | /changelog | Product changelog (public) |
| Health | /health | Liveness check (public) |
For the exact request/response shapes of any of these, browse the live OpenAPI/Swagger docs for your deployment (GET /docs).
A note on public endpoints
A few endpoints are intentionally unauthenticated: GET /api/v1/health, GET /api/v1/changelog, the OIDC discovery/login endpoints under /api/v1/auth/* (see Authentication), the inbound webhook receiver (which uses signature verification instead of a bearer token), and the Slack integration callbacks.
Related
- API Overview: conventions, errors, pagination.
- Authentication: tokens, tenants and permissions.
- Dashboard & Admin & Settings: the UIs these statistics back.