Firewall Ingest
Submit raw firewall rule dumps (iptables, nftables, ufw or firewalld output) for the firewall connectivity map.
Submit raw firewall rule dumps (iptables, nftables, ufw or firewalld output) for the firewall connectivity map. This is the endpoint the downloadable collector script posts to. Call it directly from your own tooling if you prefer.
Ingest a firewall snapshot
POST
/api/v1/firewall/ingestAuth: Bearer API keyRate limit: 60 requests / minute per API key
Submit a raw firewall configuration dump for parsing into the firewall connectivity map. Accepts the output of iptables-save, nft list ruleset, ufw status verbose or firewall-cmd --list-all; the format is auto-detected when not supplied. Provide ips or endpoint_id so the snapshot can be matched to a monitored endpoint. Parsing is asynchronous. 202 confirms the snapshot was accepted.
- The downloadable collector script (
aegis-firewall-agent.sh, available from the portal) wraps this endpoint. Run it from cron on each server instead of integrating manually.
Body parameters
| Name | Type | Required | Notes |
|---|---|---|---|
output | string | Required | The raw firewall dump (up to 512 KB).max:524288 |
format | string | Optional | Dump format; auto-detected when omitted.one of: |
hostname | string | Optional | Hostname of the server the dump came from.max:255 |
ips | array | Optional | IP addresses of the server, used to match it to a monitored endpoint (max 32).max:32 |
ips.* | ip | Optional | |
collected_at | date | Optional | When the dump was collected. |
endpoint_id | uuid | Optional | Monitored endpoint UUID, when you already know it. |
Example request
curl -X POST 'https://portal.example.com/api/v1/firewall/ingest' \
-H 'Authorization: Bearer $AEGIS_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"output": "example",
"hostname": "web01.example.com",
"collected_at": "2026-07-12T09:30:00+00:00",
"endpoint_id": "9f2c1e4a-5b6d-4e7f-8a9b-0c1d2e3f4a5b"
}'Response: 202
{
"success": true,
"snapshot_id": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
"endpoint_id": "9f2c1e4a-5b6d-4e7f-8a9b-0c1d2e3f4a5b"
}