Send security events
POST/api/ingest/security-events
Send normalised security events from your own tooling (EDR exports, an API gateway, an MCP gateway). At most 500 events and 256 KB per request, and 600 events per minute per token.
The token is bound to a telemetry source when you create it (mcp_gateway, api_gateway, otel, imported, infrastructure, sensor or test_fixture). Events are idempotent on (tenant, source, event_uid).
Events that fail validation are returned in rejected with a reason and are not stored. Events that validated but failed processing are parked in a dead-letter queue and retried automatically; dead_lettered counts them.
Request
Responses
- 202
- 401
- 413
- 422
- 429
- 503
Accepted.
The token is missing, malformed, unknown or revoked. Repeated failures for one token prefix are rate limited (30 a minute).
The body is larger than the endpoint limit. The size is checked before authentication and again while streaming.
The body is not valid JSON, is empty, has too many events or uses an unsupported schema_version.
The per-token rate limit was exceeded. Wait Retry-After seconds.
Response Headers
Seconds to wait before retrying.
The rate limiter or storage is temporarily unavailable. Retry after Retry-After seconds. The call is safe to repeat.
Response Headers
Seconds to wait before retrying.