Read your surveillance data, push your market data, and mirror alerts into your SIEM or ticketing system. All endpoints are tenant-scoped by API key; dispositions and approvals always happen inside DataTap.
Create keys at Portal → Admin → API keys (shown once, revocable). Send as a bearer token:
curl -H "Authorization: Bearer dtk_..." https://datatap.org/api/v1/cases
Rate limit: 120 requests/minute per key. Unauthorized → 401, throttled → 429.
| Endpoint | Returns |
|---|---|
GET /api/v1/cases | Cases with dispositions, SLA state, WORM timelines, linked accounts/clusters |
GET /api/v1/alerts | Alerts with detection facts, narratives, triage state |
GET /api/v1/packages | Audit packages with hashed manifests, chain hashes, release records |
POST /api/v1/events — JSON-lines body (one object per line, same fields as the
drop-copy schema).
Send an Idempotency-Key header: retries with the same key return the original
validation report without re-ingesting.
curl -X POST https://datatap.org/api/v1/events \
-H "Authorization: Bearer dtk_..." \
-H "Idempotency-Key: batch-2026-09-08-001" \
--data-binary @- <<'EOF'
{"kind":"trade","ts_ms":1200,"market":"CHIEFS-WIN-SB","account":"ACCT-1","side":"buy","px":0.58,"qty":4000}
{"kind":"settlement","ts_ms":86400000,"market":"CHIEFS-WIN-SB","account":"ACCT-1","outcome":"win"}
EOF
Response: {"accepted": n, "rejected": [[line, reason], ...], "markets": [...], "replayed": bool}
— rows are accepted whole or rejected whole; accepted events are append-only (WORM posture).
Register endpoints at Admin → outbound webhooks (https only; signing secret shown once).
Events: alert.created, case.disposition. Deliveries retry 3× with backoff
and are visible (with manual retry) on the Admin screen.
Verify the signature — x-datatap-signature: sha256=HMAC_SHA256(secret, raw_body):
expected = "sha256=" + hex(hmac_sha256(secret, raw_body)) constant_time_compare(expected, request.headers["x-datatap-signature"])
Questions or a format we should support? Get in touch · Data & Usage Guide