Eleion Phalanx API

Introduction

The Eleion Phalanx API provides programmatic access to ten integrated security products:

• Praetor — Automated offensive security testing, vulnerability scanning, and compliance scoring
• Vigil — Continuous autonomous monitoring with 37 scanners, 5,256 Sigma rules, 21K+ threat intelligence IoCs, NLP threat hunting, and attack path analysis
• Regen — Self-healing engine with 5 specialized healers, learning from every remediation, pre-heal config snapshots, and rollback capability
• Forge — AI-powered code factory with governance pipeline, multi-tier execution (local LLM + cloud AI), SOAR playbook editor, and audit trail
• Aegis — Active defense with honeytokens (7 types), SSH/HTTP/SMTP honeypots, honey files, DNS canaries, and attacker attribution
• Centurion — NIS2 + ISO 27001 compliance engine with 105 controls, 10 automated adapters, and bulk evidence upload
• Aquila — Email security with SPF/DKIM/DMARC/BIMI scoring, phishing simulation with 10 templates, and campaign tracking
• Scutum — Endpoint protection via a Unified Agent supporting 6 platforms (Linux, macOS, Windows, AWS, Azure, GCP) with 95 CIS checks per platform
• Disciplina — Security awareness training with 5 courses, quizzes, certificates, and phishing auto-enrollment
• Praesidium — Physical security checklists, WiFi audit, zone management, and sensor monitoring

Deploy the Unified Agent (Scutum) across Linux, macOS, Windows, AWS, Azure, and GCP for deep visibility without exposing credentials.

Base URL

https://api.eleion.io/v1

All endpoints are relative to this base URL. For example, the status endpoint is at https://api.eleion.io/v1/status.

Request Format

The API accepts and returns JSON. Set Content-Type: application/json for request bodies. All timestamps are ISO 8601 (UTC).

Authentication

All API requests require an API key passed in the X-API-Key header. Keys are prefixed with el_ and can be managed from the Eleion Portal or the Admin Dashboard.

Example Authenticated Request

curl -s https://api.eleion.io/v1/status \
  -H "X-API-Key: el_your_api_key_here"

Authentication Errors

Quick Start

Get up and running in 3 steps:

1. Register and get your API key

curl -s -X POST https://api.eleion.io/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@company.com",
    "password": "your_secure_password",
    "company": "Your Company",
    "plan": "sentinel"
  }'

2. Check platform status

curl -s https://api.eleion.io/v1/status \
  -H "X-API-Key: el_your_api_key_here"

3. Run your first scan

curl -s -X POST https://api.eleion.io/v1/praetor/scans \
  -H "X-API-Key: el_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"scan_type": "quick"}'

Status

Check platform health and your tenant information.

{
  "status": "operational",
  "tenant": {
    "id": "YOUR_TENANT",
    "name": "Your Company",
    "plan": "guardian"
  },
  "products": {
    "praetor": "healthy",
    "vigil": "healthy",
    "regen": "healthy",
    "forge": "healthy",
    "aegis": "healthy",
    "centurion": "healthy",
    "aquila": "healthy",
    "scutum": "healthy",
    "disciplina": "healthy",
    "praesidium": "healthy"
  },
  "version": "1.7.0",
  "timestamp": "2026-03-07T12:00:00Z"
}

Praetor Offensive Security

Praetor provides automated offensive security testing — vulnerability scanning, penetration testing, compliance scoring, and automated remediation recommendations. 10 API endpoints.

Security Score

{
  "score": 82,
  "grade": "B+",
  "breakdown": {
    "network": 85,
    "application": 78,
    "compliance": 90,
    "configuration": 75
  },
  "trend": "improving",
  "last_scan": "2026-03-07T10:30:00Z"
}

Scans

{
  "scan_id": "scan_20260307_001",
  "status": "queued",
  "message": "Scan queued successfully"
}

Findings

{
  "findings": [
    {
      "id": "f_0042",
      "severity": "high",
      "category": "configuration",
      "title": "TLS 1.0 enabled on port 443",
      "description": "Legacy TLS protocol detected...",
      "remediation": "Disable TLS 1.0 in nginx config",
      "first_seen": "2026-03-01T08:00:00Z",
      "scan_id": "scan_20260307_001"
    }
  ],
  "total": 1
}

Reports & Remediations

Vigil Autonomous Guardian

Vigil provides continuous autonomous monitoring with auto-discovery, 37 security scanners, 5,256 Sigma detection rules, 570 CIS compliance checks across 6 platforms (Linux, macOS, Windows, AWS, Azure, GCP) via the Unified Agent, 21,000+ threat intelligence IoCs from 7 feed sources, NLP-powered threat hunting, and attack path analysis. 14 API endpoints.

Dashboard

{
  "entities_total": 634,
  "findings_24h": 12,
  "scanners_active": 37,
  "sigma_rules": 5256,
  "cis_checks": {
    "total": 570,
    "per_platform": 95,
    "platforms": ["linux", "macos", "windows", "aws", "azure", "gcp"]
  },
  "threat_iocs": 21000,
  "threat_feeds": 7,
  "recent_findings": [
    {
      "id": 1042,
      "severity": "medium",
      "category": "config",
      "title": "Unencrypted Redis port exposed",
      "found_at": "2026-03-07T11:45:00Z"
    }
  ]
}

Scans

Findings

Whitelist

NLP Threat Hunter

curl -s -N -X POST https://api.eleion.io/v1/vigil/hunt \
  -H "X-API-Key: el_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"query": "Find exposed services with no TLS"}'

Attack Paths

{
  "nodes": [
    {
      "id": "nginx",
      "type": "service",
      "risk_score": 35,
      "findings_count": 3
    }
  ],
  "edges": [
    {
      "source": "nginx",
      "target": "api_v3",
      "type": "proxies_to"
    }
  ],
  "total_nodes": 495,
  "total_edges": 1145
}

Regen Self-Healing

Regen is the autonomous self-healing engine. It continuously monitors services, diagnoses issues, and applies remediation — learning from each round to improve future responses. Features 5 specialized healers, an escalation chain (5 failures triggers human alert), pre-heal config snapshots, and rollback capability. 9 API endpoints.

Dashboard & Health

{
  "total_rounds": 256,
  "total_heals": 723,
  "success_rate": 0.91,
  "experience_points": 4340,
  "healers": [
    "ServiceHealer",
    "ProductHealer",
    "AgentHealer",
    "SecurityHealer",
    "DbHealer"
  ],
  "escalation_chain": "5 failures triggers human alert",
  "last_round": "2026-03-07T11:50:00Z"
}

Healing Rounds

Individual Heals

{
  "heals": [
    {
      "id": 723,
      "round_id": 256,
      "healer": "ServiceHealer",
      "target": "quiron-proxy",
      "issue": "High memory usage (92%)",
      "remedy": "adaptive_restart",
      "success": true,
      "healed_at": "2026-03-07T11:50:30Z"
    }
  ],
  "total": 723
}

Snapshots & Rollback

Forge Code Factory

Forge is the autonomous code factory — create development tasks, track progress through a governance pipeline with approval workflows, and review AI-generated code changes. Multi-tier execution: Tier 1 (local Ollama LLM for fast tasks) and Tier 2 (Claude for complex tasks). Includes SOAR playbook editor with visual node-based editing and YAML export. 15 API endpoints.

Tasks

curl -s -X POST https://api.eleion.io/v1/forge/tasks \
  -H "X-API-Key: el_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Add rate limiting to API endpoints",
    "description": "Implement per-tenant rate limiting using Redis...",
    "priority": 2,
    "target_files": ["routers/api_gateway.py"]
  }'

{
  "id": 43,
  "title": "Add rate limiting to API endpoints",
  "status": "pending",
  "message": "Task created, awaiting governance approval"
}

Governance

Statistics & Audit

{
  "total_tasks": 127,
  "completed": 118,
  "failed": 9,
  "success_rate": 0.929,
  "avg_execution_s": {
    "tier1_ollama": 45,
    "tier2_claude": 180
  },
  "tasks_today": 5
}

SOAR Playbooks

Visual node-based playbook editor with 6 node types: trigger, condition, action, notification, delay, and end. Export to YAML for integration with external SOAR tools.

Aegis Active Defense

Aegis is the active defense and deception engine. Deploy honeytokens (7 types: API keys, database credentials, AWS keys, config files, DNS entries, email addresses, webhook URLs), SSH/HTTP/SMTP honeypots, honey files, and DNS canaries across your infrastructure. Attacker interactions are captured and attributed automatically. Tier-gated: Guardian plan and above. 8 API endpoints.

Honeytokens

{
  "id": "ht_a1b2c3",
  "token_type": "aws_key",
  "token_value": "AKIA...",
  "name": "S3 backup canary",
  "active": true,
  "created_at": "2026-03-07T10:00:00Z"
}

Honeypots

DNS Canaries

Attribution & Dashboard

Centurion Compliance

Centurion is the NIS2 + ISO 27001 compliance engine. 105 controls with 10 automated adapters that pull evidence from other Eleion products (Vigil, Regen, Praetor, Scutum, SAML, MFA, supply chain, crypto inventory, backup). Bulk evidence upload for manual controls. Per-tenant configuration. 7 API endpoints.

Dashboard & Controls

{
  "nis2_score": 100,
  "iso27001_score": 95.2,
  "controls_total": 105,
  "compliant": 56,
  "partial": 6,
  "non_compliant": 0,
  "not_evaluated": 43,
  "last_assessment": "2026-03-07T06:00:00Z"
}

Evidence

Reports & Config

Aquila Email Security

Aquila provides email security scoring and phishing simulation. Scan domains for SPF, DKIM, DMARC, and BIMI configuration. Run phishing awareness campaigns with 10 built-in templates and track employee response rates. 5 API endpoints.

Domain Scanning

{
  "domain": "example.com",
  "score": 85,
  "spf": { "status": "pass", "record": "v=spf1 include:..." },
  "dkim": { "status": "pass", "selectors": ["default"] },
  "dmarc": { "status": "pass", "policy": "quarantine" },
  "bimi": { "status": "missing" }
}

Phishing Simulation

Scutum Endpoint Protection

Scutum provides endpoint protection via the Unified Agent — a cross-platform agent supporting 6 platforms (Linux, macOS, Windows, AWS, Azure, GCP) with 95 CIS checks per platform (570 total). Token-based registration, heartbeat monitoring, event collection, and per-host CIS scoring. 6 API endpoints.

Agent Lifecycle

Data Collection

Host Overview

{
  "hosts": [
    {
      "agent_id": "ag_x1y2z3",
      "hostname": "prod-web-01",
      "platform": "linux",
      "cis_score": 87,
      "findings": 3,
      "heals": 12,
      "online": true,
      "last_seen": "2026-03-07T12:01:00Z"
    }
  ],
  "total": 1
}

Installation

curl -sL https://app.eleion.io/v1/agent/install/linux | bash

Disciplina Security Awareness

Disciplina provides security awareness training with 5 courses, quizzes, certificate generation, and automatic phishing campaign enrollment for employees who fail assessments. 5 API endpoints.

Courses & Progress

{
  "courses": [
    {
      "id": "phishing-101",
      "title": "Phishing Awareness",
      "modules": 4,
      "quiz_questions": 20,
      "enrolled": 45,
      "completed": 38,
      "pass_rate": 0.84
    }
  ]
}

Certificates & Enrollment

Praesidium Physical Security

Praesidium manages physical security and WiFi auditing. Maintain security checklists for physical locations, run WiFi network scans to detect rogue access points, manage security zones, and monitor sensors. 4 API endpoints.

Checklists & WiFi

{
  "networks_found": 12,
  "rogue_aps": 1,
  "weak_encryption": 2,
  "open_networks": 0,
  "evil_twin": false,
  "scan_time": "2026-03-07T14:00:00Z"
}

Zones & Sensors

Unified Agent Cross-Platform

The Unified Agent (Scutum) is a single cross-platform agent supporting Linux, macOS, Windows, AWS, Azure, and GCP. It auto-detects the operating system or accepts a --platform flag for cloud environments. Features token-based registration, heartbeat every 60 seconds, CIS auto-scan (95 checks per platform), and event collection with Sigma matching.

Supported Platforms

• Linux — Ubuntu, Debian, RHEL, CentOS, Alpine. 95 CIS checks (filesystem, auth, network, logging, services)
• macOS — Ventura, Sonoma, Sequoia. 95 CIS checks (FileVault, Gatekeeper, firewall, privacy, updates)
• Windows — Windows 10/11, Server 2019/2022. 95 CIS checks (BitLocker, Windows Defender, audit policy, services)
• AWS — CloudTrail, IAM, S3, EC2, RDS, Lambda, VPC. 95 CIS AWS Benchmark checks
• Azure — Activity logs, VMs, Storage, Key Vault, NSGs, SQL. 95 CIS Azure Benchmark checks
• GCP — Cloud Audit, IAM, GCS, Compute, Cloud SQL, VPC. 95 CIS GCP Benchmark checks

Architecture

Agents run inside your infrastructure and communicate outbound only. No inbound ports required. Data is pushed to Eleion via authenticated HTTPS calls. Cloud agents deploy as serverless functions (Lambda/Azure Functions/Cloud Functions).

Per-Host Dashboard

Each registered agent appears in the Scutum host overview with its CIS score, finding count, heal count, platform icon, and online/offline status. Use the /v1/agent/overview/hosts endpoint to retrieve per-host data programmatically.

Alerts & Webhooks Notifications

Manage security alerts across all products. Configure webhook endpoints for real-time notifications. Alert dispatcher runs every 10 minutes with 30-minute cooldown and deduplication. 16 endpoints.

Alerts

Alert Preferences

Webhooks

Reports Intelligence

Generate comprehensive security reports combining data from all products.

Metering

Track API and product usage for billing and capacity planning.

{
  "period_start": "2026-03-01T00:00:00Z",
  "period_end": "2026-03-31T23:59:59Z",
  "api_calls": 4521,
  "scans": 34,
  "heals": 89,
  "forge_tasks": 12,
  "agent_heartbeats": 8640,
  "plan_limits": {
    "api_calls": 50000,
    "scans": 100,
    "heals": "unlimited",
    "forge_tasks": 50,
    "agents": 50
  }
}

Plans

Four plan tiers are available, each unlocking different product sets and capabilities.

Rate Limits

API requests are rate-limited per API key based on your plan tier.

Rate Limit Headers

Every response includes rate limit information:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 117
X-RateLimit-Reset: 1740393600

Errors

The API uses standard HTTP status codes and returns errors in a consistent JSON format.

Error Response Format

{
  "detail": "Human-readable error message"
}

Status Codes