Sigmatic API

Sigmatic serves its REST API under /sigmatic/api/ on your install’s address. The Sigmatic backend also serves its OpenAPI document at /openapi.json and interactive docs at /docs on its own port, which the gateway doesn’t route.

Log shippers use a separate ingest API, authorised per data source; see Send logs.

Python and TypeScript clients

The veltro-sdk (Python) and @veltrosecurity/sdk (TypeScript) packages include a Sigmatic client. Point it at your address plus /sigmatic and pass a personal access token from the admin console as a bearer token:

from veltro_sdk import BearerToken, SigmaticClient

sigmatic = SigmaticClient("https://sigmatic.example.com/sigmatic", auth=BearerToken(token))
alerts = sigmatic.alerts.list()

The gateway checks the token on every request and calls Sigmatic with its owner’s current Sigmatic grant. A token whose scopes are all read-only can only read. Sigmatic has no API keys of its own. Client SDKs covers installing the clients, timeouts and errors.

AI agents

Sigmatic’s tools are also available to AI agents over MCP at /mcp on the same address. See MCP.