API v1

Build with SignalGuard data.

Run event-security scans from your backend, fetch saved briefs, and render the current risk picture inside customer portals, venue sites, and internal operations tools.

API keys OpenAPI

1. Create a key

Generate a scoped key from your workspace. Keys inherit the issuing org and sub-org.

2. Run or fetch

Run a scan on demand or fetch a stored scan created by Live Monitor, bulk upload, or the UI.

3. Render safely

Call SignalGuard from your server. Send only the fields your public page should display.

First request

Live

curl -X POST https://signalguard.live/api/v1/scan \
  -H "Authorization: Bearer $SIGNALGUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "eventName": "Google I/O 2026",
    "eventLocation": "Shoreline Amphitheatre, Mountain View, CA",
    "eventDate": "2026-05-20T09:00:00-07:00",
    "keyword": "Google I/O"
  }'

Authentication

Send API keys as Bearer tokens. Keep keys on your server only. Do not put sk_live_* keys into browser JavaScript, static HTML, or mobile apps.

Key scope

Keys are scoped to the workspace and sub-org active when they are created. Reads and writes cannot cross that scope.

Rotation

Create a replacement key, deploy it, confirm traffic, then revoke the old key from /api-keys.

Endpoints

GET /api/v1/status

Validate a key and inspect the scope it resolves to.

POST /api/v1/scan

Run an event-security scan and persist the result under the key's workspace.

{
  "eventName": "Google I/O 2026",
  "eventLocation": "Shoreline Amphitheatre, Mountain View, CA",
  "eventDate": "2026-05-20T09:00:00-07:00",
  "keyword": "Google I/O",
  "lat": 37.4268,
  "lon": -122.0803
}

GET /api/v1/scan/{scanId}

Fetch a stored scan with per-signal severity, headline, generated timestamp, and raw signal payload.

GET /api/v1/events?limit=20

List saved events in scope, including latest scan id, latest severity, venue coordinates, event timing, and Live Monitor status.

Website Integration Pattern

Public sites should call SignalGuard from a backend route, then render a reduced status object. This keeps your API key private and lets you decide which details are safe for a public audience.

Node / Express example

app.get("/event-status/:scanId", async (req, res) => {
  const sg = await fetch(`https://signalguard.live/api/v1/scan/${req.params.scanId}`, {
    headers: { Authorization: `Bearer ${process.env.SIGNALGUARD_API_KEY}` }
  });
  const { scan } = await sg.json();

  res.json({
    venue: scan.venue,
    severity: scan.severity,
    completedAt: scan.completedAt,
    signals: scan.signals.map((s) => ({
      signal: s.signal,
      severity: s.severity,
      headline: s.headline
    }))
  });
});

Errors

Status	Code	Meaning
400	bad_input	Required fields are missing or malformed.
401	invalid_api_key	The Bearer token is missing, revoked, or invalid.
403	team_tier_required	The key is valid, but the workspace is not on Team or Enterprise.
404	not_found	The resource does not exist in the key's scope.
429	rate_limited	The key exceeded 1,000 requests in the current hour.
502	scan_failed	One or more upstream signal calls failed hard enough to stop the scan.

Next Surfaces

Signed webhooks

Push scan.completed and alert.fired events to customer systems.

Publish tokens

Browser-safe tokens for read-only public status widgets.

SDKs

Typed JavaScript helpers generated from the OpenAPI contract.