Skip to content
Explore msspAPIs, MCP and SIEM forwarding
MSSP/MDR · Technology

Wire Imperum into your own service.
Scoped keys, webhooks and SDKs.

Keep your service's front end and connect the security work behind it. The Platform API lets supported systems read alerts, drive cases, run playbooks or push events. Signed webhooks carry case changes outward, while your own agents can call published tools over MCP under execution policy.

API keys or OAuth2 credentialsHMAC SHA-256 webhooksPython and TypeScript SDKs
Your service, wired inIllustrative
Platform APINorthstar
API Keys
mdr-ticketingIllustrative service identity
Northstar
alerts:readRead alert records
Granted
cases:writeCreate and update case records
Granted
executeNo execution scope
Not granted

The caller authenticates with its own key. Scopes govern access to module operations.

Scopes
ReadRetrieve alert records
WriteCreate or update permitted cases
ExecuteNo grant on this sample key
OAuth ClientsAlternative client-credentials authentication

Grant the module scopes the service needs.

Platform API
GET /alertsNorthstar service request
200 OK
POST /casesCreate the permitted case record
201 Created
NS-104Privileged account activity
Northstar
API KeysCalls use the granted scopes

Sample requests and responses. No token or request secret is shown.

Webhooks
case.closedCase lifecycle event
Delivered
HMAC SHA-256Signature on the outbound event
Your ticketing serviceVerify the signature before processing
NS-104Northstar case record

Case events cover creation, updates and closure.

SDKs
# Sample Python; client configured securely
page = client.alerts.list(status="open")
for alert in page["items"]:
    print(alert["id"])
Python / TypeScriptPlatform API SDKs
Your agentMCP client calling published tools
MCP GatewayExecution policy applies
Policy checked

Permission to connect is not permission to execute.

Permission to connect is not permission to execute. Scopes, policies and approvals still apply.

The illustrative mdr-ticketing key has alerts read and cases write access. It has no execute scope.

The service reads alerts and creates a case through permitted API operations. Response codes are illustrative.

A case.closed event reaches the service with an HMAC SHA-256 signature. Verify the signature in the receiving service.

Use an SDK for REST calls or let your own agents call published tools over MCP. Execution policy applies to tool calls.

Illustrative customer workflow
Illustrative workflow combining separate product views. Names, people, code and values are sample data, not customer results.
01 - What it does

Connect the security work to your service.

Use the Platform API to connect existing systems to Imperum. Scoped access lets your integration read or change the work it needs, while case webhooks can notify your service of changes.

Keep the service interface you operate.

The Platform API provides a REST interface with interactive documentation. API keys or OAuth2 client credentials authenticate the caller, with scopes for module operations such as read, write, execute and approve. Outbound webhooks announce case creation, updates and closure with HMAC SHA-256 signatures. Python and TypeScript SDKs support integrations, and a separate Reporting API issues tokens for BI tools. Your team can use those surfaces to connect customer workflows to its own service interface.

Your front end can work with Imperum records while the integration has an explicit scope of access.

Integration: mdr-ticketingExample
Authentication
API key or OAuth2 client credentials
Scopes
Alerts read, cases write
Webhooks
Case created, updated, closed
SDKs
Python and TypeScript

Illustrative integration and scopes. No credentials or live request data are shown.

Use your existing service interface

Read alerts and drive cases through a documented REST API.

Receive case changes

Use signed webhooks to bring case lifecycle events into your service.

02 - How it works in the product

Grant the access the integration needs.

Decide which operations the service will call, then configure its authentication and scopes. Review the result with a sample workflow before using it for customer work.

  1. 01
    Platform API

    Open interactive documentation under Settings, Integrations and review the operations.

  2. 02
    API Keys

    Configure authentication and the module scopes needed by the integration.

  3. 03
    Webhooks

    Configure case events and verify the HMAC SHA-256 signature in the receiving service.

  4. 04
    MCP Gateway

    Publish the tools your own agent may call and review their execution policies.

Permission to connect is not permission to execute. Licensed capabilities, scopes, permissions and applicable approval policies still apply.

03 - How it connects

Connect APIs to the rest of the estate.

REST integrations and MCP clients serve different callers. Use connectors for external tool access and the gateway for published tool calls; bring an engineer into the integration work when needed.

In the editions

The PortalIncluded

API access follows enabled modules and granted scopes.

Autonomous SOCIncluded

Call the capabilities enabled in the issued license.

SecOps PlatformIncluded

Operational module access still follows license and permissions.

04 - What it means for your service

Keep your front end. Run Imperum behind it.

Use the API to work with security records and webhooks to receive their changes. Your service can retain its own interface while Imperum supplies the licensed capabilities behind the workflow.

Reuse the service front end

Build the connection through REST and the supported SDKs.

Follow case changes

Subscribe to case creation, update and closure events.

Separate access from action

Review scopes for REST callers and execution policy for MCP tools.

Start with one customer

  1. 01
    Choose a service interaction

    Pick an alert read or case operation your integration needs.

  2. 02
    Grant its scope

    Configure authentication without including secrets in application source.

  3. 03
    Check a complete exchange

    Test the permitted call and signature verification for a case webhook.

Explore Case Prioritizer and Case Router

Questions about APIs, MCP and SIEM forwarding.

1Can we build our own service on top of Imperum?

The Platform API exposes REST operations to read alerts, drive cases, run playbooks or push events. API keys or OAuth2 client credentials authenticate callers, and module scopes determine access. Python and TypeScript SDKs support integration work. Confirm the licensed modules and permissions required by the workflow.

2Do webhooks tell us when a case closes?

Outbound case webhooks cover case creation, updates and closure and are signed with HMAC SHA-256. Configure the receiving service and verify the signature before processing an event. The event list described here covers cases.

Have any other questions? Talk to our team

Keep your service interface.
Connect the security work.

Bring your API workflow to Imperum and review its scopes, licensed capabilities and execution controls.

Book a Demo

Film · 1:00

Imperum AI Fabric

One minute on the AI Fabric appliance: the agents, Agent Studio, routing, pools, Veil and token metering.