Programmatic access today: tokens and signed webhooks
Virtik is not an API-first product — it is an operational platform with a small programmatic surface. Today that surface is personal access tokens and signed webhooks for integration events. Delivering incident and detection events to your systems, and a general public API, are not available yet.
Surfaces
What is available
Support states here match the integration catalog exactly.
Personal access tokens
Tokens are issued per organisation and scoped to what they need, under the same entitlement model as a person: a token cannot reach a site the organisation is not licensed for. A general public REST API is not available yet.
Available
Outbound webhooks
Signed webhooks for integration events, so you can verify a delivery came from Virtik. Retries and delivery status are visible to the organisation that configured them. Incident and detection events are not delivered by webhook today.
Requires configuration
Event stream export
Bulk extraction of operational events for reporting and archival. Not built; no date is committed.
Planned
How it behaves
Three things worth knowing before you build
Entitlement applies to machines too
There is no back door for integrations. An API credential passes the same role and entitlement checks a person does, enforced at the data layer.
Deliveries can be verified
Every webhook delivery is signed, so your endpoint can reject anything that did not come from Virtik.
Credentials are per organisation
Nothing is shared across tenants, and revoking a credential is immediate rather than eventual.
Reference documentation
Endpoint reference, webhook payload schemas and authentication detail are published as part of the documentation set rather than summarised here, so there is one authoritative version rather than two that drift.
Those reference pages are not published yet. If you are scoping an integration now, a technical session is faster than waiting — we can walk the event model and confirm what your systems would actually receive.
Reference pages
- AuthenticationNot published yet
- API referenceNot published yet
- Webhook payloadsNot published yet
- Event modelNot published yet
- Rate limitsNot published yet