API

Everything in the LEA Platform console is available over HTTP. The API has two parts:

Base URL: your own LEA server, e.g. https://lea.example.com. All responses are JSON.

Authentication

Every request except /lea/version needs a bearer token.

Local account (service user):

curl -X POST -u apiuser:'<password>' https://lea.example.com/lea/authenticate_api
# → {"token": "<TOKEN>"}

SSO token exchange: send a token from your OIDC provider and get a LEA token back.

curl -X POST -H "Authorization: Bearer <SSO_TOKEN>" \
  https://lea.example.com/lea/authenticate_api_from_token

Use the token:

curl -H "Authorization: Bearer <TOKEN>" https://lea.example.com/api/clients

Store tokens in a secret manager or environment variables, not in scripts.

Roles

Query syntax (PostgREST)

GET /api/ returns the OpenAPI description of the data API.

GET /api/clients_verified?verified=eq.true
GET /api/clients?name=ilike.*prod*
GET /api/cmds?id=in.(1,2,3)
GET /api/clients?order=name.asc&offset=0&limit=100
GET /api/clients?select=id,name

Add the header Prefer: count=exact to get a total count.

Filter by a dynamic tag value:

GET /api/clients?cmd_info->hostname->>stdout=like.web-*

Main endpoints

Hosts

Rules

Groups

Results

Audit

Enrollment (admin)

Read enrollment state from /api/clients_verified (enrollment_state, cert_status).

Example: open a 30-minute window for every host with a certificate error.

IDS=$(curl -s -H "Authorization: Bearer $TOKEN" \
  "$LEA/api/clients_verified?enrollment_state=eq.cert_error&select=id" | jq -c 'map(.id)')
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  "$LEA/api/rpc/reenroll_clients" -d "{\"p_ids\": $IDS, \"p_minutes\": 30}"

Settings and platform

Status codes