API Overview

The MITRITY REST API gives you programmatic access to the full MITRITY platform. Use it to manage agents, policies, audit logs and integrations from your own code.

Base URL

You send all API requests to:

https://api.mitrity.com/api/v1/

The API is versioned in the URL path, and the current version is v1. When breaking changes are introduced, a new version will be released next to the existing one, with a documented migration path.

Authentication

Every API request needs a Bearer token. You generate API keys in the MITRITY dashboard, at Settings > API Keys.

curl https://api.mitrity.com/api/v1/agents \
  -H "Authorization: Bearer mk_your-api-key-here"

An API key starts with mk_ and belongs to one organization. It acts with the current role and access scope of the user who created it, and its scopes can narrow it further. See API Keys.

Edge nodes and agents authenticate their own calls, such as POST /api/v1/delegation-chains/evaluate, with the agent's key in the X-Agent-Key header instead of an API key.

Treat API keys as secrets. Do not commit them to source control, and do not expose them in client-side code. Rotate keys regularly, in Settings > API Keys.

Rate Limits

The API counts requests in one-minute windows:

Because dashboard sessions are counted per person, people working in the dashboard do not spend the budget your integrations rely on, and your API keys do not count toward the dashboard's ceiling.

The limit and what is left of it are included in every response:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 94

When the limit is exceeded, the API returns 429 Too Many Requests, with a Retry-After header that gives the seconds until the window resets.

A dashboard request can also be refused because your tenant's sessions together reached their ceiling. That response still reports the person's own limit, with nothing remaining, and its Retry-After gives the seconds until the ceiling's window resets.

Response Format

All responses are JSON, with standard HTTP status codes. A single resource is returned as the object itself. A paged list returns its items in data, together with the paging values:

{
  "data": [ ... ],
  "total": 132,
  "limit": 50,
  "offset": 0
}

Some list endpoints return a plain JSON array instead. The interactive API reference shows the response of each endpoint.

Error responses carry a human-readable message and the HTTP status code:

{
  "error": "agent not found",
  "code": 404
}

Pagination

Paged list endpoints take limit and offset query parameters:

GET /api/v1/agents?limit=25&offset=50

On most of them, limit defaults to 50 and cannot exceed 200. The response's total is the number of items that match, so you have reached the end of the list when offset plus the items returned reaches total.

Key Endpoints

Agents

Policies

Audit Log

Credentials

See Credential Broker for the full credential → grant → lease model.

Delegation Chains

Threat Intelligence

LLM Usage

LLM Guardrail Budgets

Per-policy LLM cost/rate guardrails, enforced by the LLM Gateway. Model allowlists and per-call token caps are authored as policy rules; see the Policies endpoints.

SIEM destinations

Health & Readiness

Unauthenticated endpoints for load balancers and uptime checks (no /api/v1 prefix):

SDKs and Tools

MITRITY publishes governance adapters for common languages:

• Python: pip install mitrity
• Go: go get github.com/mitrity-io/mitrity-go
• TypeScript: npm install @mitrity/sdk

They are not REST API clients. Each one connects the tool calls an agent's own code or framework makes to the co-located MITRITY edge through the admission API, so those calls are governed before they run. See Framework Adapters.

Interactive API Reference

The interactive API reference covers the full API, with request and response schemas, example payloads and a built-in panel for testing requests.