---
title: "Security API"
description: "Security Center, incidents and emergency controls."
label: "Security"
generated: "the API catalogue in apps/control-plane/src/routes/developer.ts"
---


Every emergency control has a side-effect-free blast radius preview, and executing one requires `confirm_blast_radius: true` plus a reason. The preview exists so nobody finds out what a control does by using it.

:::warning Step-up required
1 endpoint in this group require a fresh step-up authentication within the last few minutes, even for a session that already holds the permission. They are marked below.
:::

## Endpoints

| | Endpoint | Permission | Notes |
| --- | --- | --- | --- |
| `GET` | `/v1/security/overview` | `security:read` | — |
| `POST` | `/v1/security/emergency/preview` | `security:read` | — |
| `POST` | `/v1/security/emergency/execute` | `security:emergency_action` | step-up, high impact |
| `GET` | `/v1/incidents` | `incident:read` | — |
| `POST` | `/v1/incidents` | `incident:manage` | — |

## What each endpoint does

### `GET /v1/security/overview`

Security Center overview.

Requires `security:read`.

### `POST /v1/security/emergency/preview`

Blast radius preview. Side-effect free.

Requires `security:read`.

### `POST /v1/security/emergency/execute`

Execute an emergency control.

Requires `security:emergency_action`. Step-up authentication is also required.

Request body:

```json
{
  "kind": "PAUSE_AGENT|REVOKE_AGENT|…",
  "target_id": "string",
  "reason": "string",
  "confirm_blast_radius": "true"
}
```

### `GET /v1/incidents`

List incidents.

Requires `incident:read`.

### `POST /v1/incidents`

Create an incident.

Requires `incident:manage`.