API Reference

Everything programmable in Ozone goes through the Orchestrator API gateway at https://ozone.techforcz.com over HTTPS. This page is a high-level map of that surface: how you authenticate, the endpoints a collector uses over its lifecycle, the telemetry ingest path, and the authenticated product API your own tooling calls. It is intentionally conceptual: it names endpoints and describes what they do rather than pinning down every request and response field.

API access is available on all plans. See Licensing & Tiers.

Authentication and tokens

Ozone uses different token types for different callers. Each is scoped to what that caller needs.

Token	Issued by	Used for
User JWT (bearer)	POST /auth/login, refreshed via POST /auth/refresh	Authenticating a signed-in user to the product API
OIDC SSO session	/auth/oidc/callback	Signing in through an OIDC identity provider
MFA (TOTP)	Enrolled per user	A second factor on top of user login
SAML SSO	Enterprise plan	Federated sign-in for Enterprise tenants
Collector JWT	POST /collectors/register, exchanged from a one-time registration token	Authenticating an enrolled collector to the Orchestrator
Per-tenant ingest token	Provisioned per tenant	Authenticating telemetry to POST /ingest/{token}
Edge token (RS256)	Validated offline against GET /auth/jwks.json	Letting the collector verify signatures at the edge without a live round-trip

Notes on the model:

• User sessions start at POST /auth/login and return a bearer JWT you send on the authenticated product API. Use POST /auth/refresh to get a fresh token without re-entering credentials. OIDC users complete sign-in at /auth/oidc/callback; TOTP adds MFA; SAML SSO is available on Enterprise.
• Collectors authenticate with a collector JWT obtained at registration (below), not with a user token.
• Ingest is authenticated by a per-tenant ingest token embedded in the path, separate from user auth.
• Edge tokens are RS256-signed so the collector can validate them offline using the public keys served at GET /auth/jwks.json. This is what keeps a collector working during an internet outage.

Collector lifecycle

These paths are public (no user JWT) but are authenticated by the token or one-time credential the caller presents.

Endpoint	Purpose
POST /collectors/register	Exchange a one-time registration token for a long-lived collector JWT (enrolment)
POST /collectors/heartbeat	Report that an enrolled collector is alive and reachable

Ingest

Endpoint	Purpose
POST /ingest/{token}	Accept telemetry from a tenant, authenticated by the per-tenant ingest token in the path

The ingest path is kept separate from the user-facing API so that telemetry volume does not compete with interactive requests.

Product API (authenticated)

The following endpoints require a user JWT as a bearer token. Each is one slice of the product.

Endpoint	Purpose
/alerts	Query and manage alerts
/correlation	Correlated incidents and event grouping
/inventory	Monitored devices and their metadata
/ai	AI-assisted analysis features (availability depends on plan)
/notifications	Internal notification dispatch (alert and escalation events). Customer connector configuration is not done here: connectors are set up on the on-prem collector's Integrations page, not through a SaaS product API
/licensing	Plan, limits, and license state
/billing	Billing and subscription information
/audit	Audit log of account activity
/search	Search across Ozone data

Rate limiting

• The authenticated product API is limited to roughly 120 requests per minute per user by default.
• The ingest path is separate from the per-user limiter, so telemetry ingest is not throttled by a user's API usage.

note

If you receive a rate-limit response, back off and retry. Batch where you can rather than polling tightly.

Examples

Sign in and obtain a user JWT:

curl -X POST https://ozone.techforcz.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "<password>"}'

Call an authenticated endpoint with the bearer token:

curl https://ozone.techforcz.com/alerts \
  -H "Authorization: Bearer <jwt>"

tip

Replace <jwt> with the token returned by /auth/login, and <token> (on the ingest path) with your tenant's ingest token. Never put a token in a query string; send it in the Authorization header or the documented path segment.

Related

• Ports & Endpoints: the single HTTPS entry point this API rides on.
• Licensing & Tiers: which features the /ai and SSO surfaces unlock per plan.