Support / Developers

CivicGuard API

Connect approved systems to scoped events, device health, and immutable access records. Every token inherits the user, purpose, and geography behind it.

REST resources and signed webhooks

The API uses JSON over HTTPS and OAuth 2.0 client credentials. Production access requires an approved integration, least-privilege scopes, and a named customer administrator.

  • Events and aggregate corridor metrics
  • Device inventory and health
  • Audit events and export status
  • Signed event and incident webhooks
curl https://api.civicguard.observer/v1/events \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Civic-Purpose: OVERSIGHT-24" \
  -G \
  --data-urlencode "from=2026-09-19T00:00:00Z" \
  --data-urlencode "device_group=official-fleet"

{
  "data": [{
    "event_id": "evt_7M4…",
    "captured_at": "2026-09-19T14:32:18Z",
    "fleet_class": "municipal",
    "retention_expires_at": "2026-10-03T14:32:18Z"
  }],
  "next_cursor": "eyJvZmZzZXQi…"
}

Predictable, reviewable access

MethodEndpointPurposeScope
GET/v1/eventsRetrieve approved event recordsevents:read
GET/v1/metrics/corridorsRetrieve aggregate countsmetrics:read
GET/v1/devicesList devices and healthdevices:read
GET/v1/audit-eventsRetrieve access historyaudit:read
GET/v1/explanationsRetrieve department explanations, uneditedexplanations:read
POST/v1/webhook-endpointsRegister signed delivery targetwebhooks:write

Rate limits

600 requests per minute per tenant. Aggregate endpoints are limited to 60 requests per minute.

Idempotency

Write operations accept an Idempotency-Key header retained for 24 hours.

Auditability

Token creation, calls, response classifications, and exports are retained in the customer audit log.

The API documentation shown here is a public overview. Schema files and a sandbox tenant are provided during approved integration onboarding.