API & Integrations — SignalExposure

Built for developers

A real API, not a logo wall

Every capability below maps to a documented endpoint you can call today.

🔑

Tenant-scoped keys

Authenticate with X-API-Key or Bearer. Per-key rate limits, per-member RBAC, honest 429s and RFC 7807 errors.

🔎

Exposure & search

Score any domain, pull the snapshot, search the corpus by domain or identifier — all licence-gated and aggregates-only.

📡

STIX 2.1 & SIEM feeds

Standards-based export that Splunk, Sentinel and Elastic ingest natively — STIX bundles and an NDJSON feed with a since cursor.

🔔

Webhooks & Slack

Signed, replayable webhooks and Slack alerts per tenant, filtered by severity. Configure exactly which events fire.

🛰

Attack surface & takedowns

Pull the attack surface, run a typosquat scan, and prepare RDAP takedowns — capabilities no feed reseller exposes.

◫

Multi-tenant & leads

Provision tenants, convert pilots, export leads to CSV. The whole MSSP funnel is API-driven.

Featured integrations

Fits the tools you already run

Native where standards allow, honest about the rest.

SIEM

Splunk · Sentinel · Elastic

Ingest STIX 2.1 / NDJSON natively for correlation, dashboards and alerting.

Identity

Okta · Entra ID

Drive remediation — session revocation, forced reset, MFA — through the approval-gated action engine.

Collab

Slack · webhook

Real-time alerts and funnel notifications, signed and replayable, live today.

Ticketing

Jira · ServiceNow

Open and track cases via webhook — every alert carries the context to auto-populate a ticket.

Simple, developer-friendly API

Get a key in the dashboard, authenticate with a header, then query exposure, pull snapshots, and drive response. No SDK required.

Header auth — X-API-Key or Bearer
Exposure & score — /v1/exposure/{domain}/score
SIEM feed — /v1/export/siem?since=…
Takedowns — /v1/takedown

Full API reference →

example.sh

# score any domain — deterministic, explainable
curl "$BASE/v1/exposure/acme.com/score" \
  -H "X-API-Key: $KEY"

# pull new intel into your SIEM (STIX / NDJSON)
curl "$BASE/v1/export/siem?since=2026-08-01" \
  -H "X-API-Key: $KEY"

# prepare a takedown for a confirmed lookalike
curl -X POST "$BASE/v1/takedown" \
  -H "X-API-Key: $KEY" \
  -d '{"brand":"acme.com","impersonator":"acme-login.net"}'

Connect SignalExposure to your security stack