API reference

Argus is a REST API with a web client on top of it. Everything the product does, it does through that API.

No published API reference yet

Argus does not currently publish an endpoint reference, so there is no supported way today to build an integration against a documented contract.

If you need programmatic access, contact support and tell us what you are trying to build. A curated reference will be published here once the API is stable enough for us to commit to it.

Authentication

Two distinct credential types, for two distinct callers:

Caller	Credential
Users	JWT bearer tokens, issued at sign-in
Agents	A per-agent API key, obtained by exchanging a one-time enrollment token at first boot

The two are not interchangeable. An agent key cannot act as a user, and a user token cannot submit scan results. Agent credentials and their rotation are covered in Credentials: Bootstrap vs Manual and Agents.

Session behaviour

Worth knowing because it explains sign-out behaviour you will otherwise find puzzling. Defaults:

Setting	Default	Effect
Access token lifetime	30 minutes	Refreshed transparently while you are active
Refresh token lifetime	24 hours
Idle timeout	15 minutes	Signed out after inactivity
Absolute session lifetime	8 hours	Re-authentication required regardless of activity

The absolute lifetime is the one that surprises people: a full working day at the console ends with a sign-in prompt even though you never went idle. That is intentional, and it is the control that bounds how long a stolen session can remain useful.

Background polling deliberately does not reset the idle timer. If it did, simply leaving a dashboard open would keep a session alive indefinitely and the idle timeout would mean nothing.

Getting data out today

Until there is a published API, the supported export paths are:

• Reports for the formal artefacts: compliance reports, gap analysis, executive summary, audit log, PII summary, and more, all as CSV.
• Table exports on most pages, which export the current filtered view. Filter first, then export, and the file matches what you reviewed.

Both are covered by the same guarantees: exports carry counts and metadata, never the sensitive values themselves, and compliance exports exclude hidden and stale datastores while surfacing the count of what was excluded.

When an API does land

When endpoints are published, a removed endpoint will be replaced by a 410 Gone for one release, carrying Deprecation and Sunset headers and a body pointing at its replacement, and only deleted in the release after that. That deprecation guarantee is what a published reference is worth waiting for.