API for integrations

Built for SIEM, ticketing and cloud.

5 supported frameworks:GDPR, ISO 27001, SOC 2, NIS 2, DORA

Scheduled·

PCI-DSS
·
HIPAA
· not counted in the 5.

API preview.This page describes Tekmerion's planned REST API — planned endpoints, authentication scheme and request/response shapes for future integration with Splunk, Elastic, Microsoft Sentinel, Jira, Linear, AWS, Azure and GCP (integration targets, not available integrations today). All requests authenticate with Bearer tokens — the result samples are illustrative and show the agreed shape. For an activation roadmap, express interest.

API previewNot yet available in production

This page is a non-normative previewof Tekmerion's planned REST API. The base URL shown here (https://api.tekmerion.example/v1) is an illustrative placeholder — it does not map to a live production endpoint and does not accept requests at this time. Production access to the API is not yet generally available.

Webhooks: the webhooks subsystem is not yet available. No webhook is sent by Tekmerion today — the POST /v1/webhooks card only describes the planned interface.

For early access and activation when the closed beta opens, express interest.

01Preview
Authentication
Bearer token per tenant — scoped permissions, rotation in planning

Every request authenticates with a single header: Authorization: Bearer <token>. Tokens are issued per tenant and carry scopes that define which actions are allowed — we recommend a separate token per integration so revocation can be targeted. Token rotation with a 24-hour overlapping window is described here as planned behaviour; the production implementation is not yet generally available.

Available scopes

  • alerts:read

    List and detail of alerts

  • evidence:read

    Read evidence and presigned URLs

  • frameworks:read

    List frameworks and controls

  • assessments:write

    Submit self-assessments

  • remediations:write

    Create and approve actions

  • webhooks:write

    Register and manage subscriptions

Sample request — retrieve high-severity alerts from the last 24 hours:

GET /v1/alerts?severity=high&since=…curl
curl -X GET "https://api.tekmerion.example/v1/alerts?severity=high&since=2026-08-12T00:00:00Z" \
  -H "Authorization: Bearer ${TEKMERION_TOKEN}" \
  -H "X-Tekmerion-API-Version: 2026-08-01"

Authentication errors return 401 Unauthorized with body { "error": "invalid_token" }. Wrong scope returns 403 Forbidden.

02Preview
Base URL
Stable namespace per version — all resources live under the same prefix
Illustrative base URL · not yet livehttps
https://api.tekmerion.example/v1

TLS

TLS in transit from the infrastructure edge (Polsia platform) — exact TLS versions and cipher suites are set at platform level.

Content-Type

All requests and responses are JSON (UTF-8) — the default is application/json.

Datacenter

Polsia managed platform infrastructure — the specific infrastructure region is not exposed in the application code. Details are provided on request.

Status codes

Standard HTTP — 200/201 for success, 4xx for client errors, 5xx for server errors. Every error includes request_id.

03Preview
Versioning
Pin by date — in planning, not yet active

Each client can pin to a specific version by sending the header X-Tekmerion-API-Version: <yyyy-mm-dd>. The server returns the same header on every response so you can verify you are being served by the version you expected. If the pin is not recognized, the response is 400 Bad Request with an explicit reference to the closest available date.

Request / response pinhttp
# Request
GET /v1/alerts HTTP/1.1
Host: api.tekmerion.example
Authorization: Bearer <token>
X-Tekmerion-API-Version: 2026-08-01

# Response
HTTP/1.1 200 OK
Content-Type: application/json
X-Tekmerion-API-Version: 2026-08-01
X-Request-Id: req_aB12cD34

We recommend pinning in every integration and only upgrading after testing the new version in staging. Non-breaking changes (adding fields, new endpoints) happen within the same pin.

04

Endpoint reference

Eight endpoints for reading alerts and evidence, creating remediations and assessment submissions, navigating compliance frameworks and registering webhooks. Each card includes the request parameters and a sample response.

GET/v1/alertsPreview
List alerts with filters by compliance framework, severity and time range — pagination via an opaque cursor. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
severityquerystringnolow | medium | high | critical — multiple values comma-separated.
frameworkquerystringnoFramework code (GDPR, ISO27001, SOC2, NIS2, DORA — the 5 supported). PCI-DSS and HIPAA are referenced here as planned framework codes but are not yet available in production.
sincequeryISO 8601 datetimenoLower bound — alerts after the given timestamp.
untilqueryISO 8601 datetimenoUpper bound — alerts before the given timestamp.
cursorquerystringnoOpaque cursor from a previous page — empty for the first page.
limitqueryintegernoMaximum number of results (1–100, default 25).
AuthorizationheaderBearer <token>yesAPI token with scope alerts:read.

Sample response

The samples below are illustrative — real production URLs are not yet available.

GET /v1/alerts → 200 OK (illustrative)json
{
  "data": [
    {
      "id": "al_8H3aX7",
      "framework": "GDPR",
      "control": "Art.32",
      "severity": "high",
      "status": "open",
      "asset": "db-prod-eu-1",
      "remediation_id": "rm_4bY2z9",
      "created_at": "2026-08-13T09:42:11Z"
    },
    {
      "id": "al_8H3aX8",
      "framework": "ISO27001",
      "control": "A.8.9",
      "severity": "medium",
      "status": "open",
      "asset": "storage-backups-1",
      "remediation_id": null,
      "created_at": "2026-08-13T08:11:02Z"
    }
  ],
  "pagination": {
    "next_cursor": "eyJsYXN0X2lkIjoiYWxfOEgzYVg4In0=",
    "has_more": true
  }
}
GET/v1/evidence/{id}Preview
Retrieve a specific piece of evidence from the audit log — hash, timestamp, framework and a short-lived signed URL for the file. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
idpathstringyesEvidence identifier (e.g. ev_5kP9mQ).
AuthorizationheaderBearer <token>yesAPI token with scope evidence:read.

Sample response

The samples below are illustrative — real production URLs are not yet available.

GET /v1/evidence/{id} → 200 OK (illustrative)json
{
  "id": "ev_5kP9mQ",
  "framework": "GDPR",
  "control": "Art.30",
  "asset": "customer-data-export-2026Q2.zip",
  "hash": {
    "algorithm": "SHA-256",
    "value": "9a1f5b3c7d8e2f4a6b8c0d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a"
  },
  "size_bytes": 1834921,
  "signed_url": "https://cdn.tekmerion.example/evidence/...?X-Sig=...",
  "signed_url_expires_at": "2026-08-14T12:30:00Z",
  "uploader": {
    "id": "usr_92Lx",
    "email": "auditor@example.com"
  },
  "metadata": {
    "locale": "en",
    "source": "manual-upload",
    "tags": [
      "gdpr",
      "records-of-processing"
    ]
  },
  "created_at": "2026-08-10T14:22:08Z"
}
POST/v1/remediationsPreview
Create a remediation request — links to an alert and requests approval before execution. Approval is done via POST /v1/remediations/{id}/approve (a separate sub-resource). · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
alert_idbodystringyesAlert ID to remediate (e.g. al_8H3aX7).
titlebodystringyesShort request title — shown in the dashboard.
descriptionbodystringnoMarkdown description — estimated impact and steps.
actionsbodyarray<object>yesSequence of changes: { type, target, diff_summary }.
approver_idsbodyarray<string>noIDs of responsible users who can approve (default: all admins).
AuthorizationheaderBearer <token>yesAPI token with scope remediations:write.

Sample response

The samples below are illustrative — real production URLs are not yet available.

POST /v1/remediations → 200 OK (illustrative)json
{
  "id": "rm_4bY2z9",
  "alert_id": "al_8H3aX7",
  "title": "Enable at-rest encryption on db-prod-eu-1",
  "status": "pending",
  "created_by": "usr_92Lx",
  "created_at": "2026-08-13T09:51:42Z",
  "actions": [
    {
      "type": "config.update",
      "target": "aws:rds:db-prod-eu-1",
      "diff_summary": "storage_encrypted: false → true"
    }
  ],
  "approvers": [
    {
      "id": "usr_42Mx",
      "email": "ciso@example.com",
      "approved": false
    }
  ],
  "linked_alert": "al_8H3aX7"
}
GET/v1/frameworksPreview
List available compliance frameworks with versions and control counts. Useful for tenants building a framework-picker UI. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
localequerystringnoel | en — returns localized names and descriptions.
versionquerystringnoSpecific framework version (e.g. 2013, 2022).
activequerybooleannoFilter active/retired frameworks (default: true).
AuthorizationheaderBearer <token>yesAPI token with scope frameworks:read.

Sample response

The samples below are illustrative — real production URLs are not yet available.

GET /v1/frameworks → 200 OK (illustrative)json
{
  "data": [
    {
      "code": "GDPR",
      "name": "General Data Protection Regulation",
      "version": "2016/679",
      "controls_count": 99,
      "status": "active",
      "locale": "en"
    },
    {
      "code": "ISO27001",
      "name": "ISO/IEC 27001 — Information Security Management",
      "version": "2022",
      "controls_count": 93,
      "status": "active",
      "locale": "en"
    },
    {
      "code": "NIS2",
      "name": "NIS 2 Directive — Network & Information Security",
      "version": "2022/2555",
      "controls_count": 64,
      "status": "active",
      "locale": "en"
    }
  ]
}
GET/v1/frameworks/{code}/controlsPreview
List controls for a specific compliance framework — each control includes family, title, description and default severity. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
codepathstringyesFramework code (e.g. GDPR).
localequerystringnoel | en — localized labels.
familyquerystringnoFilter by family (e.g. A.8 for ISO 27001).
AuthorizationheaderBearer <token>yesAPI token with scope frameworks:read.

Sample response

The samples below are illustrative — real production URLs are not yet available.

GET /v1/frameworks/{code}/controls → 200 OK (illustrative)json
{
  "framework": "GDPR",
  "version": "2016/679",
  "locale": "en",
  "controls": [
    {
      "id": "gdpr-art-32",
      "family": "Chapter 4",
      "title": "Security of processing",
      "description": "Pseudonymization and encryption of data, ability to ensure confidentiality, integrity, availability and resilience.",
      "severity_default": "high"
    },
    {
      "id": "gdpr-art-30",
      "family": "Chapter 4",
      "title": "Records of processing activities",
      "description": "Maintenance of records of processing activities for which the controller is responsible.",
      "severity_default": "medium"
    }
  ]
}
POST/v1/assessmentsPreview
Submit a maturity self-assessment against a compliance framework — returns a score, risk level and recommendations. The same submission can also be made from the public assessment form. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
framework_codebodystringyesFramework code (GDPR, NIS2, ISO27001...).
organization_sizebodystringyesmicro | small | medium | large | enterprise.
responsesbodyobjectyesMap { control_id: 0..4 } where 0 = weak, 4 = full.
contact_emailbodystringyesContact email to send the report to (RFC 5322).
localebodystringnoel | en — report and recommendations language.
AuthorizationheaderBearer <token>yesAPI token with scope assessments:write (optional if submission is made publicly).

Sample response

The samples below are illustrative — real production URLs are not yet available.

POST /v1/assessments → 200 OK (illustrative)json
{
  "id": "as_7pQrZ1",
  "framework": "NIS2",
  "organization_size": "medium",
  "score": 62,
  "risk_level": "medium",
  "recommendations": [
    {
      "priority": 1,
      "control_id": "nis2-art-21.2.a",
      "title": "Risk-management policy documentation",
      "rationale": "Explicit documentation is required per Article 21(2)(a)."
    },
    {
      "priority": 2,
      "control_id": "nis2-art-21.2.e",
      "title": "Incident response plan",
      "rationale": "A documented incident response playbook with roles and SLA is missing."
    }
  ],
  "report_url": "https://app.tekmerion.example/reports/as_7pQrZ1",
  "created_at": "2026-08-13T11:02:38Z"
}
GET/v1/profilePreview
Retrieve tenant and current-user profile — useful for SIEM enrichment and ticketing automation that wants to enrich events with organization context. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
AuthorizationheaderBearer <token>yesAPI token with scope profile:read (default on all tokens).

Sample response

The samples below are illustrative — real production URLs are not yet available.

GET /v1/profile → 200 OK (illustrative)json
{
  "organization": {
    "id": "org_31Kx",
    "name": "Acme Maritime Ltd",
    "size": "medium",
    "industry": "Transport · Maritime",
    "country": "GR",
    "frameworks_subscribed": [
      "GDPR",
      "ISO27001",
      "NIS2"
    ],
    "features": {
      "webhooks": true,
      "sso": false
    }
  },
  "user": {
    "id": "usr_92Lx",
    "email": "ciso@acme-maritime.example",
    "role": "admin",
    "last_active_at": "2026-08-13T10:55:14Z"
  }
}
POST/v1/webhooksPreview
Register a webhook endpoint for push events — Tekmerion sends POST requests to your URL with an HMAC signature. The secret is returned once at creation time. · Scheduled endpoint — not yet available in production.

Request parameters

ParameterInTypeRequiredDescription
urlbodystring (URL)yesHTTPS endpoint that accepts POST requests — must respond within 5 seconds.
eventsbodyarray<string>yesEvents to subscribe to: alert.created, alert.resolved, evidence.attached, remediation.approved, remediation.executed.
secretbodystringnoOptional HMAC secret — if omitted, the server generates a 32-byte random one and returns it once.
activebodybooleannoIf false, events are stored but not sent (default true).
AuthorizationheaderBearer <token>yesAPI token with scope webhooks:write.

Sample response

The samples below are illustrative — real production URLs are not yet available.

POST /v1/webhooks → 200 OK (illustrative)json
{
  "id": "wh_9aBcD3",
  "url": "https://hooks.example.com/tekmerion",
  "events": [
    "alert.created",
    "alert.resolved",
    "evidence.attached"
  ],
  "secret": "whsec_3f9a1b2c4d5e6f78a9b0c1d2e3f4a5b6",
  "secret_returned_once": true,
  "active": true,
  "created_at": "2026-08-13T12:00:00Z"
}

Early access

Want to try the API first?

The first customers to express interest will receive an invitation to the API closed beta and have a direct line to the design team — ideal for shaping the endpoints that matter to SIEM, ticketing or cloud integrations.

Express interestSee plansReply within one business day