API reference

Every endpoint AxisSynapse exposes for tenant integration. Every entry below has copy-paste curl, parameter docs, and a link to the playground.

Total: 25 endpoints across 9 groups.

Discovery (2)Sessions (3)Step-Up Authentication (2)SAML 2.0 SSO (2)SCIM 2.0 Provisioning (6)Webhooks (Subscriptions) (4)Network Policy (2)Attestation Policy (2)Audit Log (2)

Discovery

GET/api/developers/openapi.jsonPublic — no auth

OpenAPI 3.1 specification

Machine-readable spec covering every endpoint in this registry. Download once and feed to your code generator (oapi-codegen, openapi-typescript, etc.) — re-pull when the X-AxisSynapse-Spec-Version response header changes.

Examples

Download the spec

curl

curl https://app.axissynapse.com/api/developers/openapi.json > axissynapse.openapi.json

Try it in the playground →

GET/api/developers/events.jsonPublic — no auth

Webhook event catalog

Every event type your tenant can subscribe a webhook to, with example payloads. Generated from the live audit-code constants — never out of date.

Examples

List every event type

curl

curl https://app.axissynapse.com/api/developers/events.json | jq '.events[].type'

Try it in the playground →

Sessions

GET/api/me/sessionsSession cookie

List my active sessions

Returns every UserSession row for the calling user, with device label + IP prefix + location, plus a `current` flag on the row matching the request's session cookie.

Examples

List my sessions

curl

curl -X GET https://app.axissynapse.com/api/me/sessions \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

DELETE/api/me/sessions/{id}Session cookie

Revoke a session

Soft-deletes a UserSession row. Self-revoking the current session returns `signOut: true` — the client should immediately bounce to /auth/login.

Parameters

path

required

UserSession.id

Examples

Revoke a session

curl

curl -X DELETE https://app.axissynapse.com/api/me/sessions/sess_xxx \
  -H "Cookie: $YOUR_SESSION_COOKIE"

POST/api/me/sessions/heartbeatSession cookie

Mirror + touch the current session

Heartbeat endpoint called by the dashboard layout every ~5 minutes. Refreshes the as_sid cookie, persists device + geo info, returns 401 SESSION_REVOKED if the admin has revoked the row.

Examples

Heartbeat

curl

curl -X POST https://app.axissynapse.com/api/me/sessions/heartbeat \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

Step-Up Authentication

POST/api/auth/step-up/challenge-optionsSession cookie

Begin a step-up ceremony

Issues a WebAuthn AuthnRequest challenge for the given purpose. Returns the factors the viewer can use (WebAuthn-only when the purpose requires phishing-resistant).

Examples

Start step-up for payroll ACH

curl

curl -X POST https://app.axissynapse.com/api/auth/step-up/challenge-options \
  -H "Cookie: $YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"purpose":"PAYROLL_TRANSMIT_ACH"}'

Error codes this endpoint may return

UNKNOWN_PURPOSE NO_FACTOR_AVAILABLE

Try it in the playground →

GET/api/auth/step-up/statusSession cookie

Check whether a step-up token is still valid

Read-only inspection of the freshest unused step-up token for the (viewer, purpose). Drives UI button labels.

Parameters

purpose

query

required

Closed STEP_UP_PURPOSES enum value.

Examples

Check token freshness

curl

curl -X GET https://app.axissynapse.com/api/auth/step-up/status?purpose=PAYROLL_SEAL \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

SAML 2.0 SSO

GET/api/saml/{providerId}/metadataPublic — no auth

SP metadata XML

Returns the AxisSynapse SP metadata XML the IdP administrator pastes into their wizard (Okta, Entra, ADFS, Ping). entityID and ACS URL embedded.

Parameters

providerId

path

required

Tenant SAML provider id.

Examples

Download SP metadata

curl

curl https://app.axissynapse.com/api/saml/prov_xxx/metadata > axissynapse-sp-metadata.xml

Try it in the playground →

GET/api/saml/{providerId}/loginPublic — no auth

Initiate SP-initiated sign-in

Builds an AuthnRequest, persists the InResponseTo state, and renders an auto-submitting form that POSTs the SAMLRequest to the IdP. Optional `relayState` param routes the user to a specific URL post-login.

Parameters

providerId	path	required	Provider id.
relayState	query	optional	Post-login redirect URL.

Examples

Start SAML sign-in

curl

curl -L "https://app.axissynapse.com/api/saml/prov_xxx/login?relayState=/dashboard"

SCIM 2.0 Provisioning

GET/api/scim/v2/ServiceProviderConfigPublic — no auth

Capability discovery

RFC 7644 §4. Returns what we support: PATCH yes, filter yes (maxResults 200), bulk no, sort no, etag no. IdPs (Okta / Entra / JumpCloud) fetch this before provisioning.

Examples

Inspect server capabilities

curl

curl https://app.axissynapse.com/api/scim/v2/ServiceProviderConfig

Try it in the playground →

GET/api/scim/v2/UsersSCIM bearer

List users (filtered)

RFC 7644 query language. Supports filter operators eq, ne, co, sw, ew, gt, ge, lt, le, pr with and/or/not + parens + dotted paths.

Parameters

filter	query	optional	SCIM filter e.g. `userName eq "alice@axis.com"`.
startIndex	query	optional	1-based pagination cursor.
count	query	optional	Page size (default 100, max 200).

Examples

Find a user by email

curl

curl -X GET https://app.axissynapse.com/api/scim/v2/Users?filter=userName%20eq%20"alice@axis.com" \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json"

Paginate active users

curl

curl -X GET https://app.axissynapse.com/api/scim/v2/Users?filter=active%20eq%20true&startIndex=1&count=100 \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json"

Try it in the playground →

POST/api/scim/v2/UsersSCIM bearer

Create a user (provisioning push)

Idempotent: an existing (tenant, userName) returns 200 with the existing row instead of 409. New rows return 201.

Examples

Provision a new employee

curl

curl -X POST https://app.axissynapse.com/api/scim/v2/Users \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json" \
  -H "Content-Type: application/scim+json" \
  -d '{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "alice@axis.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Adams"
  },
  "active": true,
  "emails": [
    {
      "value": "alice@axis.com",
      "primary": true,
      "type": "work"
    }
  ]
}'

Try it in the playground →

GET/api/scim/v2/Users/{id}SCIM bearer

Read a user by id

Parameters

path

required

TenantUser.id

Examples

Fetch a user

curl

curl -X GET https://app.axissynapse.com/api/scim/v2/Users/u_xxx \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json"

Try it in the playground →

PUT/api/scim/v2/Users/{id}SCIM bearer

Replace a user (full update)

RFC 7644 §3.5.1. Whole-resource replace. Most IdPs prefer PATCH (next endpoint) because PUT requires sending the entire resource.

Parameters

path

required

User id.

Try it in the playground →

PATCH/api/scim/v2/Users/{id}SCIM bearer

Patch a user (partial update)

RFC 7644 §3.5.2 PatchOp. Supports add / replace / remove on top-level + dotted paths + filtered sub-paths (`emails[type eq "work"].value`).

Parameters

path

required

User id.

Examples

Deactivate (offboard)

curl

curl -X PATCH https://app.axissynapse.com/api/scim/v2/Users/u_xxx \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json" \
  -H "Content-Type: application/scim+json" \
  -d '{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}'

Update work email

curl

curl -X PATCH https://app.axissynapse.com/api/scim/v2/Users/u_xxx \
  -H "Authorization: Bearer $AXISSYNAPSE_SCIM_TOKEN" \
  -H "Accept: application/scim+json" \
  -H "Content-Type: application/scim+json" \
  -d '{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "emails[type eq \"work\"].value",
      "value": "new@axis.com"
    }
  ]
}'

Try it in the playground →

Webhooks (Subscriptions)

GET/api/settings/webhooksSession cookie

List webhook subscriptions

Tenant-admin only. Returns all subscriptions WITHOUT the signing secret — secrets are only shown once at create time.

Examples

List subscriptions

curl

curl -X GET https://app.axissynapse.com/api/settings/webhooks \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

POST/api/settings/webhooksSession cookie

Create a webhook subscription

Response includes the raw `secret` ONCE (whsec_…). The DB stores only the hashed form; we can't surface it again. Filters are glob patterns (`ACCOUNT_STEPUP_*`, `*`).

Examples

Subscribe to step-up events

curl

curl -X POST https://app.axissynapse.com/api/settings/webhooks \
  -H "Cookie: $YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"name":"Step-up audit feed","url":"https://your-app.example.com/hooks/axissynapse","eventFilters":["ACCOUNT_STEPUP_*"]}'

Try it in the playground →

POST/api/settings/webhooks/{id}/testSession cookie

Send a synchronous test delivery

POSTs a signed `axissynapse.webhook.test` payload to the URL and returns the receiver's status + body + elapsed time. Doesn't enqueue a real WebhookDelivery row.

Parameters

path

required

Webhook subscription id.

Examples

Test a subscription

curl

curl -X POST https://app.axissynapse.com/api/settings/webhooks/wh_xxx/test \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

GET/api/settings/webhooks/{id}/deliveriesSession cookie

List recent deliveries

Up to 100 most-recent delivery attempts for the subscription. Useful for debugging 4xx/5xx receivers.

Parameters

path

required

Webhook subscription id.

Examples

Read deliveries

curl

curl -X GET https://app.axissynapse.com/api/settings/webhooks/wh_xxx/deliveries \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

Network Policy

GET/api/settings/network-policySession cookie

Read tenant network policy

Returns the policy mode + per-surface enforcement toggles + admin bypass.

Examples

Read policy

curl

curl -X GET https://app.axissynapse.com/api/settings/network-policy \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

POST/api/settings/network-policy/testSession cookie

Preview a decision for an IP

Pure 'what-if' tool — runs the policy evaluator without persisting anything.

Examples

Test a corporate IP

curl

curl -X POST https://app.axissynapse.com/api/settings/network-policy/test \
  -H "Cookie: $YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"ip":"203.0.113.42","surface":"API"}'

Try it in the playground →

Attestation Policy

GET/api/settings/attestation-policySession cookie

Read WebAuthn attestation policy

Returns the policy + the curated AAGUID catalog (FIPS hardware / hardware / platform / synced).

Examples

Read policy

curl

curl -X GET https://app.axissynapse.com/api/settings/attestation-policy \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

POST/api/settings/attestation-policy/testSession cookie

Preview an AAGUID decision

Pure preview — pass an AAGUID + flags, get the decision without affecting policy.

Examples

Test a YubiKey 5 NFC

curl

curl -X POST https://app.axissynapse.com/api/settings/attestation-policy/test \
  -H "Cookie: $YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"aaguid":"ee882879-721c-4913-9775-3dfcce97072a"}'

Try it in the playground →

Audit Log

GET/api/settings/audit-logSession cookie

Query the audit ledger

Filter by actor, action (exact / comma-list / prefix*), resource type/id, date range, free-text. Cursor pagination. Tenant-admin only.

Parameters

userId	query	optional	Actor TenantUser.id.
action	query	optional	Action code or prefix* glob.
from	query	optional	ISO timestamp lower bound.
to	query	optional	ISO timestamp upper bound.
cursor	query	optional	Opaque cursor from a prior page.

Examples

Last hour of step-up events

curl

curl -X GET https://app.axissynapse.com/api/settings/audit-log?action=ACCOUNT_STEPUP_*&from=2026-06-09T07:53:42.626Z \
  -H "Cookie: $YOUR_SESSION_COOKIE"

Try it in the playground →

GET/api/settings/audit-log/exportSession cookie

Stream CSV / NDJSON export

RFC 4180 CSV or NDJSON. 50k-row hard cap. Same filter params as the query endpoint. Audited as ACCOUNT_AUDIT_LOG_EXPORTED.

Parameters

format

query

optional

csv (default) or ndjson

Examples

Download a week of step-up audit

curl

curl -X GET https://app.axissynapse.com/api/settings/audit-log/export?format=csv&action=ACCOUNT_STEPUP_*&from=2026-06-02T08:53:42.627Z > stepup.csv \
  -H "Cookie: $YOUR_SESSION_COOKIE"