Developers
Your records, read from your own tools.
Eurus has a read-only API for each business's controls, findings, events and actions, signed webhooks that send its events as they happen, and SCIM for a directory to provision people. Every answer carries ids, never a person's name.
The read-only API
An admin makes a key under Admin, API keys. It is shown once, and only its SHA-256 is kept.
Authenticate
Send the key as Authorization: Bearer fwk_… on each request. A revoked, expired, unknown or malformed key gets 401.
Four resources
GET /api/v1/controls, /api/v1/findings, /api/v1/events and /api/v1/actions, each for the key's own business.
Ids, never names
Answers hold ids, kinds, statuses, numbers and times: never a name, an email address, a phone number or text a person typed.
Filters and pages
Findings and actions take status and limit, from 1 to 500. Events take since, a time in ISO 8601, kind, the start of an event kind, limit, and after, the next_after of the page before.
Limits
120 requests a minute for each key, counted across every server, with X-RateLimit headers. Past it the answer is 429, with Retry-After.
Webhooks out
An admin adds an https address and the kinds of event to send. Each new event goes out once, as JSON with ids only.
Signed
Each delivery carries FourWinds-Signature: t, the time in Unix seconds, and v1, the HMAC-SHA256 of the time and the body. The signing secret is shown once and kept sealed.
Tried again
An answer other than 2xx is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. Every attempt is kept.
Public addresses only
An address that leads to a private network is refused before anything is sent.
Sandboxes hold their webhooks
A sample business, a free demo or a business in sandbox records each delivery as unsent, with the reason.
Slack and Teams
An address can be a Slack or Teams incoming webhook. Each alert is then a chat message in words, with a link into the app.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyPeople from your directory
SCIM
A directory provisions, changes, deactivates and deprovisions people over SCIM 2.0, with a token an admin makes. Access ends at once.
Admins stay with the business
SCIM never makes an admin, and never gives back access an admin ended.
Single sign-on
People sign in through the business's own directory. Once the admin has signed in that way, members' passwords can be refused.
Everything, to take elsewhere
An admin can take every record the business holds as one file, each table with its fingerprint. A ledger export checks out with code that runs outside the database.
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.