Documentation/API Reference

API Reference

InsightPilot APIs use Laravel Sanctum tokens, tenant middleware, subscription middleware, and ability checks. Use the X-InsightPilot-Organization header to select an organization when the user belongs to more than one workspace.

Developer and Webhooks page with API token and signed webhook controls — **Developer portal:** create API tokens, register signed webhooks, test deliveries, and inspect attempts from the admin UI.

Data Connections page showing connector setup for analytics APIs and metadata — **Connector metadata:** API consumers can inspect supported connectors and safety policy while admins manage credentials in the UI.

Sanctum Abilities

Ability	Purpose
`saved-queries:read`	Read saved queries.
`saved-queries:write`	Create saved queries.
`dashboards:snapshot`	Create dashboard snapshots.
`report-exports:read`	Read report exports.
`report-exports:write`	Create report exports.
`webhooks:manage`	Manage webhook definitions.
`ai-governance:read/write/review/evidence/admin`	Access AI Governance records, reviews, evidence, and admin rules.
`command-center:read/write`	Read and update Command Center item state.
`system-health:read/admin`	Read or run System Health checks.
`audit-center:read/export`	Search audit records and export audit packs.

Endpoint Groups

/api/v1/saved-queries for saved-query read/write.
/api/v1/dashboards/{dashboard}/snapshots for dashboard snapshots.
/api/v1/report-exports for report export read/write.
/api/v1/webhooks for webhook definitions.
/api/v1/ai-governance/* for AI use cases, vendors/models, risk assessments, approvals, controls, evidence, notices, incidents, evaluations, alerts, monitor runs, questionnaires, and governance reports.
/api/v1/command-center/items and /api/v1/command-center/items/state for operating queue data and state updates.
/api/v1/system-health and /api/v1/system-health/run for health findings and manual runs.
/api/v1/audit-center/items and /api/v1/audit-center/exports for audit search and PDF audit pack export.
/api/v1/connectors/metadata for supported connector metadata and SQL safety policy.

Sample Requests

GET /api/v1/command-center/items?high_severity=1
Authorization: Bearer <token>
X-InsightPilot-Organization: 1

POST /api/v1/system-health/run
Authorization: Bearer <token with system-health:admin>

POST /api/v1/audit-center/exports
Authorization: Bearer <token with audit-center:export>
Content-Type: application/json

{"module":"AI Governance","severity":"high"}

SCIM 2.0 Provisioning

SCIM is organization-scoped and authenticates with an Enterprise Security bearer token. It manages identities without exposing local passwords. Deleting a SCIM User deactivates the local account and revokes its active device sessions; deleting a Group removes only that SCIM group.

POST /api/scim/v2/Users
Authorization: Bearer ip_scim_...
Content-Type: application/json

{"userName":"analyst@example.com","externalId":"entra-42","active":true}

PATCH /api/scim/v2/Groups/12
Authorization: Bearer ip_scim_...
Content-Type: application/json

{"Operations":[{"op":"remove","path":"members[value eq \"18\"]"}]}

Supported resources are /api/scim/v2/Users and /api/scim/v2/Groups, with list, read, create, patch, and delete operations. Group member values use InsightPilot SCIM User resource IDs, not database user IDs.

Webhook Events

Webhook deliveries are signed with X-InsightPilot-Signature. Events include report creation, anomaly creation, action creation, executive brief completion, AI Governance risk/approval/incident/control/evidence/report/public-notice events, Command Center resolution, System Health critical findings, audit pack exports, and database connection test pass/fail events.

{
  "organization_id": 1,
  "event": "system_health.critical",
  "created_at": "2026-07-07T10:00:00Z",
  "delivery_id": 42,
  "attempt": 1,
  "data": {"key": "storage", "title": "Private artifact storage is not writable."}
}

Connector safety: Direct guarded SQL supports MySQL, MariaDB, PostgreSQL, SQL Server, Redshift, Snowflake, and BigQuery. Private CSV, Google Sheets, Stripe, HubSpot, and GA4 use the managed-source dataset layer. Every source is constrained to approved metadata, explicit fields, source freshness, and read-only query execution.