5 supported frameworks:GDPR, ISO 27001, SOC 2, NIS 2, DORA
Scheduled·
API preview.This page describes Tekmerion's planned REST API — planned endpoints, authentication scheme and request/response shapes for future integration with Splunk, Elastic, Microsoft Sentinel, Jira, Linear, AWS, Azure and GCP (integration targets, not available integrations today). All requests authenticate with Bearer tokens — the result samples are illustrative and show the agreed shape. For an activation roadmap, express interest.
This page is a non-normative previewof Tekmerion's planned REST API. The base URL shown here (https://api.tekmerion.example/v1) is an illustrative placeholder — it does not map to a live production endpoint and does not accept requests at this time. Production access to the API is not yet generally available.
Webhooks: the webhooks subsystem is not yet available. No webhook is sent by Tekmerion today — the POST /v1/webhooks card only describes the planned interface.
For early access and activation when the closed beta opens, express interest.
Every request authenticates with a single header: Authorization: Bearer <token>. Tokens are issued per tenant and carry scopes that define which actions are allowed — we recommend a separate token per integration so revocation can be targeted. Token rotation with a 24-hour overlapping window is described here as planned behaviour; the production implementation is not yet generally available.
Available scopes
alerts:readList and detail of alerts
evidence:readRead evidence and presigned URLs
frameworks:readList frameworks and controls
assessments:writeSubmit self-assessments
remediations:writeCreate and approve actions
webhooks:writeRegister and manage subscriptions
Sample request — retrieve high-severity alerts from the last 24 hours:
curl -X GET "https://api.tekmerion.example/v1/alerts?severity=high&since=2026-08-12T00:00:00Z" \
-H "Authorization: Bearer ${TEKMERION_TOKEN}" \
-H "X-Tekmerion-API-Version: 2026-08-01"Authentication errors return 401 Unauthorized with body { "error": "invalid_token" }. Wrong scope returns 403 Forbidden.
https://api.tekmerion.example/v1TLS
TLS in transit from the infrastructure edge (Polsia platform) — exact TLS versions and cipher suites are set at platform level.
Content-Type
All requests and responses are JSON (UTF-8) — the default is application/json.
Datacenter
Polsia managed platform infrastructure — the specific infrastructure region is not exposed in the application code. Details are provided on request.
Status codes
Standard HTTP — 200/201 for success, 4xx for client errors, 5xx for server errors. Every error includes request_id.
Each client can pin to a specific version by sending the header X-Tekmerion-API-Version: <yyyy-mm-dd>. The server returns the same header on every response so you can verify you are being served by the version you expected. If the pin is not recognized, the response is 400 Bad Request with an explicit reference to the closest available date.
# Request
GET /v1/alerts HTTP/1.1
Host: api.tekmerion.example
Authorization: Bearer <token>
X-Tekmerion-API-Version: 2026-08-01
# Response
HTTP/1.1 200 OK
Content-Type: application/json
X-Tekmerion-API-Version: 2026-08-01
X-Request-Id: req_aB12cD34We recommend pinning in every integration and only upgrading after testing the new version in staging. Non-breaking changes (adding fields, new endpoints) happen within the same pin.
Eight endpoints for reading alerts and evidence, creating remediations and assessment submissions, navigating compliance frameworks and registering webhooks. Each card includes the request parameters and a sample response.
/v1/alertsPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| severity | query | string | no | low | medium | high | critical — multiple values comma-separated. |
| framework | query | string | no | Framework code (GDPR, ISO27001, SOC2, NIS2, DORA — the 5 supported). PCI-DSS and HIPAA are referenced here as planned framework codes but are not yet available in production. |
| since | query | ISO 8601 datetime | no | Lower bound — alerts after the given timestamp. |
| until | query | ISO 8601 datetime | no | Upper bound — alerts before the given timestamp. |
| cursor | query | string | no | Opaque cursor from a previous page — empty for the first page. |
| limit | query | integer | no | Maximum number of results (1–100, default 25). |
| Authorization | header | Bearer <token> | yes | API token with scope alerts:read. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"data": [
{
"id": "al_8H3aX7",
"framework": "GDPR",
"control": "Art.32",
"severity": "high",
"status": "open",
"asset": "db-prod-eu-1",
"remediation_id": "rm_4bY2z9",
"created_at": "2026-08-13T09:42:11Z"
},
{
"id": "al_8H3aX8",
"framework": "ISO27001",
"control": "A.8.9",
"severity": "medium",
"status": "open",
"asset": "storage-backups-1",
"remediation_id": null,
"created_at": "2026-08-13T08:11:02Z"
}
],
"pagination": {
"next_cursor": "eyJsYXN0X2lkIjoiYWxfOEgzYVg4In0=",
"has_more": true
}
}/v1/evidence/{id}PreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| id | path | string | yes | Evidence identifier (e.g. ev_5kP9mQ). |
| Authorization | header | Bearer <token> | yes | API token with scope evidence:read. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"id": "ev_5kP9mQ",
"framework": "GDPR",
"control": "Art.30",
"asset": "customer-data-export-2026Q2.zip",
"hash": {
"algorithm": "SHA-256",
"value": "9a1f5b3c7d8e2f4a6b8c0d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a"
},
"size_bytes": 1834921,
"signed_url": "https://cdn.tekmerion.example/evidence/...?X-Sig=...",
"signed_url_expires_at": "2026-08-14T12:30:00Z",
"uploader": {
"id": "usr_92Lx",
"email": "auditor@example.com"
},
"metadata": {
"locale": "en",
"source": "manual-upload",
"tags": [
"gdpr",
"records-of-processing"
]
},
"created_at": "2026-08-10T14:22:08Z"
}/v1/remediationsPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| alert_id | body | string | yes | Alert ID to remediate (e.g. al_8H3aX7). |
| title | body | string | yes | Short request title — shown in the dashboard. |
| description | body | string | no | Markdown description — estimated impact and steps. |
| actions | body | array<object> | yes | Sequence of changes: { type, target, diff_summary }. |
| approver_ids | body | array<string> | no | IDs of responsible users who can approve (default: all admins). |
| Authorization | header | Bearer <token> | yes | API token with scope remediations:write. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"id": "rm_4bY2z9",
"alert_id": "al_8H3aX7",
"title": "Enable at-rest encryption on db-prod-eu-1",
"status": "pending",
"created_by": "usr_92Lx",
"created_at": "2026-08-13T09:51:42Z",
"actions": [
{
"type": "config.update",
"target": "aws:rds:db-prod-eu-1",
"diff_summary": "storage_encrypted: false → true"
}
],
"approvers": [
{
"id": "usr_42Mx",
"email": "ciso@example.com",
"approved": false
}
],
"linked_alert": "al_8H3aX7"
}/v1/frameworksPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| locale | query | string | no | el | en — returns localized names and descriptions. |
| version | query | string | no | Specific framework version (e.g. 2013, 2022). |
| active | query | boolean | no | Filter active/retired frameworks (default: true). |
| Authorization | header | Bearer <token> | yes | API token with scope frameworks:read. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"data": [
{
"code": "GDPR",
"name": "General Data Protection Regulation",
"version": "2016/679",
"controls_count": 99,
"status": "active",
"locale": "en"
},
{
"code": "ISO27001",
"name": "ISO/IEC 27001 — Information Security Management",
"version": "2022",
"controls_count": 93,
"status": "active",
"locale": "en"
},
{
"code": "NIS2",
"name": "NIS 2 Directive — Network & Information Security",
"version": "2022/2555",
"controls_count": 64,
"status": "active",
"locale": "en"
}
]
}/v1/frameworks/{code}/controlsPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| code | path | string | yes | Framework code (e.g. GDPR). |
| locale | query | string | no | el | en — localized labels. |
| family | query | string | no | Filter by family (e.g. A.8 for ISO 27001). |
| Authorization | header | Bearer <token> | yes | API token with scope frameworks:read. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"framework": "GDPR",
"version": "2016/679",
"locale": "en",
"controls": [
{
"id": "gdpr-art-32",
"family": "Chapter 4",
"title": "Security of processing",
"description": "Pseudonymization and encryption of data, ability to ensure confidentiality, integrity, availability and resilience.",
"severity_default": "high"
},
{
"id": "gdpr-art-30",
"family": "Chapter 4",
"title": "Records of processing activities",
"description": "Maintenance of records of processing activities for which the controller is responsible.",
"severity_default": "medium"
}
]
}/v1/assessmentsPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| framework_code | body | string | yes | Framework code (GDPR, NIS2, ISO27001...). |
| organization_size | body | string | yes | micro | small | medium | large | enterprise. |
| responses | body | object | yes | Map { control_id: 0..4 } where 0 = weak, 4 = full. |
| contact_email | body | string | yes | Contact email to send the report to (RFC 5322). |
| locale | body | string | no | el | en — report and recommendations language. |
| Authorization | header | Bearer <token> | yes | API token with scope assessments:write (optional if submission is made publicly). |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"id": "as_7pQrZ1",
"framework": "NIS2",
"organization_size": "medium",
"score": 62,
"risk_level": "medium",
"recommendations": [
{
"priority": 1,
"control_id": "nis2-art-21.2.a",
"title": "Risk-management policy documentation",
"rationale": "Explicit documentation is required per Article 21(2)(a)."
},
{
"priority": 2,
"control_id": "nis2-art-21.2.e",
"title": "Incident response plan",
"rationale": "A documented incident response playbook with roles and SLA is missing."
}
],
"report_url": "https://app.tekmerion.example/reports/as_7pQrZ1",
"created_at": "2026-08-13T11:02:38Z"
}/v1/profilePreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| Authorization | header | Bearer <token> | yes | API token with scope profile:read (default on all tokens). |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"organization": {
"id": "org_31Kx",
"name": "Acme Maritime Ltd",
"size": "medium",
"industry": "Transport · Maritime",
"country": "GR",
"frameworks_subscribed": [
"GDPR",
"ISO27001",
"NIS2"
],
"features": {
"webhooks": true,
"sso": false
}
},
"user": {
"id": "usr_92Lx",
"email": "ciso@acme-maritime.example",
"role": "admin",
"last_active_at": "2026-08-13T10:55:14Z"
}
}/v1/webhooksPreviewRequest parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| url | body | string (URL) | yes | HTTPS endpoint that accepts POST requests — must respond within 5 seconds. |
| events | body | array<string> | yes | Events to subscribe to: alert.created, alert.resolved, evidence.attached, remediation.approved, remediation.executed. |
| secret | body | string | no | Optional HMAC secret — if omitted, the server generates a 32-byte random one and returns it once. |
| active | body | boolean | no | If false, events are stored but not sent (default true). |
| Authorization | header | Bearer <token> | yes | API token with scope webhooks:write. |
Sample response
The samples below are illustrative — real production URLs are not yet available.
{
"id": "wh_9aBcD3",
"url": "https://hooks.example.com/tekmerion",
"events": [
"alert.created",
"alert.resolved",
"evidence.attached"
],
"secret": "whsec_3f9a1b2c4d5e6f78a9b0c1d2e3f4a5b6",
"secret_returned_once": true,
"active": true,
"created_at": "2026-08-13T12:00:00Z"
}Early access
The first customers to express interest will receive an invitation to the API closed beta and have a direct line to the design team — ideal for shaping the endpoints that matter to SIEM, ticketing or cloud integrations.