API Endpoints¶

All endpoints require authentication. See Authentication.

Scans¶

POST /api/scan/trigger?profile=quick&subnet=192.168.1.0/24

Param	Default	Values
`profile`	`normal`	`quick`, `normal`, `intensive`
`subnet`	config	CIDR notation

Response:

{"status": "started", "scan_id": 15, "profile": "quick", "subnet": "192.168.1.0/24"}

GET /api/scan/status

{"scanning": true, "scan_id": 15, "subnet": "192.168.1.0/24", "profile": "quick"}

GET /api/scans?limit=50&offset=0

GET /api/scans/{scan_id}/devices

GET /api/devices

Param	Description
`scan_id`	From specific scan
`risk_level`	`critical`, `high`, `medium`, `low`, `none`
`is_trusted`	`true` or `false`
`zone`	Zone name

GET /api/devices/{device_id}

Full device with ports, risk details, CVEs.

PUT /api/devices/{device_id}

{"label": "proxmox-01", "zone": "Servers", "is_trusted": true, "notes": "Main hypervisor"}

POST /api/scan/device/{ip_address}

GET /api/changes

Param	Description
`scan_id`	Filter by scan
`change_type`	`device_added`, `device_removed`, `port_opened`, `port_closed`, `service_changed`
`severity`	Filter by severity
`limit`	Max results

GET /api/stats

{"total_devices": 25, "devices_at_risk": 3, "critical": 0, "high": 1, "last_scan": "..."}

GET /api/trends?days=30

Historical data for charts.

GET /api/zones

["Servers", "Network", "IoT", "Workstations"]

GET /api/keys

POST /api/keys

{"name": "grafana"}

DELETE /api/keys/{key_id}

GET /api/config

PUT /api/config

{"network": {"subnet": "192.168.1.0/24"}, "scanning": {"port_range": "1-1000"}}

GET /api/audit-logs?action=login_failed&limit=100

GET /api/audit-logs/actions

GET /api/updates/check?force=false

Auto-detect the local network for scan configuration.

GET /api/network/detect

{
  "local_ip": "192.168.1.50",
  "suggested_subnet": "192.168.1.0/24",
  "hostname": "argus-server"
}

GET /health

{"status": "healthy", "timestamp": "..."}