# Overview

# API

Everything the Admin Console does is an API — the console is just a client.

## Authentication

Create an **API credential** in the console (**API Credentials** in the left nav): you get a client ID/secret for the OAuth 2.0 **client_credentials** grant. Each credential carries explicit **scopes**, an optional IP allow-list, and an expiry; every use is attributable in the audit log.

```bash
curl -X POST https://<your-console-host>/api/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=... -d client_secret=... -d scope="audit:read"
```

## Typical uses

- Pull audit events into your own tooling (or use the SIEM export).
- Manage policy (MCP rules, detector actions) from infrastructure-as-code.
- Automate provider-key rotation.

## Conventions

JSON in/out; standard HTTP statuses; errors carry a human-readable message. Credentials are revocable instantly from the console.