Integrations

Workspace management API

Manage tenant sites, team membership, rules, and integrations with authenticated workspace requests.

On this page

Sites & policy

Management routes are relative to https://api.bastionsecurity.io/api and use Authorization: Bearer <accessToken>. Responses use the standard success/data/timestamp envelope. Owners manage sites; team roles and SAML site scope restrict access.

Route	Operation
GET /sites	List accessible sites; SAML sessions return only their scoped workspace.
POST /sites	Create {name, domain, allowedOrigins?}; owner plan site cap applies.
GET /sites/{id}	Read a site you can access.
PATCH /sites/{id}	Owner updates name, domain, threshold, challengeMode, allowedOrigins, enabledRules.
POST /sites/{id}/rotate-keys	Owner rotates public and server keys immediately.
DELETE /sites/{id}	Owner deletes a site. Treat as a destructive operation.

POST /api/sites

{
  "name": "Shop production",
  "domain": "shop.example.com",
  "allowedOrigins": [
    "https://shop.example.com"
  ]
}

Team membership

Route	Operation
GET /platform/team?siteId=…	Owner reads workspace team; invitation hashes are never returned.
POST /platform/team	Owner invites {siteId, email, role}; role is viewer or analyst.
PATCH /platform/team/{id}	Owner changes {role} to viewer or analyst.
POST /platform/team/{id}/resend	Owner creates a new seven-day link for a pending invite; the old link stops working.
DELETE /platform/team/{id}	Owner removes or revokes a membership.
POST /auth/invitations/accept	Existing user accepts {token} with a password-session Bearer token matching the invited email.

An invitation returns an inviteUrl and expiresAt. Share it through your own approved channel. New users register from that link; existing users follow its Sign in link or accept while already signed in. Invitations expire after seven days and are single-use. Acceptance activates the role before SSO can match the member. Role changes and removal apply to existing sessions.

Role	Allowed actions
Viewer	Read permitted workspace data, ask investigation questions, and contact support. Cannot edit rules, case decisions, settings or members.
Analyst	Viewer access plus rule management and case decisions, within the workspace plan gates.
Owner	Workspace settings, members, keys, billing, webhooks and SSO, plus analyst actions.

Workspace roles do not prevent users from updating their own personal profile or managing a separate workspace they own. Public demo invitations and mutations are disabled.

Integration endpoints

Capability	Routes	Gate
Rules	GET /rules?siteId=…; POST /rules; PATCH or DELETE /rules/{id}	Custom rules: Pro or Enterprise.
Rule field reference	GET /rules/suggestions	Authenticated session.
Webhooks	GET/PUT /webhooks?siteId=…; POST /webhooks/test?siteId=…	Owner; Pro or Enterprise.
SAML configuration	GET/PUT /auth/sso/{siteId}/config	Owner; Enterprise.
Plan catalog	GET /billing/plans	Public catalog.

Custom rule grammar

Supported fields, operators, and examples.

Webhook contracts

Receiver configuration and payloads.

SAML configuration

Identity-provider setup and sign-in requirements.