API Overview

The MITRITY REST API provides programmatic access to the full MITRITY platform. Manage agents, policies, audit logs, and integrations through a consistent, well-documented API.

Base URL

All API requests are made to:

https://api.mitrity.com/api/v1/

The API is versioned via the URL path. The current version is v1. When breaking changes are introduced, a new version will be released alongside the existing version with a documented migration path.

Authentication

All API requests require authentication via a Bearer token. Generate API keys in the MITRITY dashboard at Settings > API Keys.

curl https://api.mitrity.com/api/v1/agents \
  -H "Authorization: Bearer mk_your-api-key-here"

An API key starts with mk_ and belongs to one organization. It acts with the current role and access scope of the user who created it, and its scopes can narrow it further; see API Keys.

Edge nodes and agents authenticate their own calls, such as POST /api/v1/delegation-chains/evaluate, with the agent's key in the X-Agent-Key header instead of an API key.

Treat API keys as secrets. Do not commit them to source control or expose them in client-side code. Rotate keys regularly in Settings > API Keys.

Rate Limits

The API counts requests in one-minute windows:

Because dashboard sessions are counted per person, people working in the dashboard do not spend the budget your integrations rely on, and your API keys do not count toward the dashboard's ceiling.

The limit and what is left of it are included in every response:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 94

When the limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header giving the seconds until the window resets. A dashboard request refused because your tenant's sessions together reached their ceiling still reports the person's own limit, with nothing remaining, and Retry-After gives the seconds until the ceiling's window resets.

Response Format

All responses are JSON. Successful responses use standard HTTP status codes:

{
  "data": { ... },
  "meta": {
    "request_id": "req_abc123",
    "timestamp": "2026-03-01T12:00:00Z"
  }
}

Error responses include a machine-readable error code and a human-readable message:

{
  "error": {
    "code": "invalid_request",
    "message": "The tool_pattern field is required.",
    "request_id": "req_abc123"
  }
}

Pagination

List endpoints return paginated results. Use cursor and limit query parameters:

GET /api/v1/agents?limit=25&cursor=eyJpZCI6MTAwfQ

The response includes a next_cursor field. When next_cursor is null, you have reached the end of the list.

Key Endpoints

Agents

Policies

Audit Log

Credentials

See Credential Broker for the full credential → grant → lease model.

Delegation Chains

Threat Intelligence

LLM Usage

LLM Guardrail Budgets

Per-policy LLM cost/rate guardrails enforced by the LLM Gateway (model allowlists + per-call token caps are authored as policy rules; see the Policies endpoints).

SIEM destinations

Health & Readiness

Unauthenticated endpoints for load balancers and uptime checks (no /api/v1 prefix):

SDKs and Tools

Official SDKs are available for common languages:

• Python: pip install mitrity
• Go: go get github.com/mitrity/mitrity-go
• TypeScript: npm install @mitrity/sdk

Each SDK wraps the REST API with typed methods, automatic pagination, retry logic, and token management.

Interactive API Reference

Explore the full API with request/response schemas, example payloads, and a built-in request testing panel in the interactive API reference.