REST API — Getting Started

Overview

The KyberGate REST API lets you programmatically manage policies, query device data, submit logs, and automate workflows. It is used internally by KyberGate agents (Chrome extension, iOS/macOS profiles, Windows agent) and is available for IT teams to build integrations.

Full API documentation is available in the KyberGate dashboard under Settings → API or at kybergate.com/docs/api.

Prerequisites

• A KyberGate organization with API access enabled
• Admin role or API key with appropriate permissions
• Familiarity with REST APIs and tools like curl, Postman, or your scripting language of choice

Authentication

KyberGate API uses two authentication methods:

API Key (Header-based)

For server-to-server integrations, use an API key passed in the Authorization header:

• Header: Authorization: Bearer YOUR_API_KEY
• Generate API keys in the dashboard under Settings → API Keys
• Each key can be scoped to specific permissions (read-only, read-write, admin)

Service Account Token

For KyberGate agents and device-level authentication, a service account token is used. This is configured automatically during device enrollment and is not typically used for custom integrations.

Permissions

API keys can be configured with granular permissions:

• policies:read — read filtering policies
• policies:write — create and update policies
• devices:read — list and view device information
• devices:write — send commands to devices
• logs:read — query browsing logs and activity reports
• logs:write — submit browsing logs (used by agents)
• settings:read — read organization settings
• settings:write — modify organization settings

Rate Limits

To ensure fair usage and system stability, the API enforces rate limits:

• Standard tier: 60 requests per minute per API key
• Enterprise tier: 300 requests per minute per API key
• Rate limit headers are included in every response:
  • X-RateLimit-Limit — your limit
  • X-RateLimit-Remaining — requests remaining in the window
  • X-RateLimit-Reset — timestamp when the window resets

If you exceed the limit, you will receive a 429 Too Many Requests response. Wait for the reset window before retrying.

Base URL

All API endpoints are relative to your proxy region:

• East (primary): https://proxy.kybergate.com
• West: https://proxy-west.kybergate.com

Steps

Step 1: Generate an API Key

In the KyberGate dashboard, go to Settings → API Keys → Create New Key. Give it a descriptive name (e.g., "SIS Integration" or "Monitoring Script"), select the permissions it needs, and click Create.

Copy the key immediately — it is only shown once.

Step 2: Test the Connection

Use the health endpoint to verify your API key works:

• GET /health
• Header: Authorization: Bearer YOUR_API_KEY
• Expected response: { "status": "healthy", "version": "0.6" }

Step 3: Query Your Organization's Policy

Retrieve the active filtering policy:

• GET /api/policy/YOUR_ORG_ID
• This returns the blocked domains, blocked categories, bypass domains, school hours, and filter mode

Step 4: List Devices

Retrieve your registered devices:

• GET /api/devices/YOUR_ORG_ID
• Returns device name, platform, last seen, online status, and assigned user

Step 5: Send a Command

Send a lock command to a device:

• POST /api/commands/YOUR_ORG_ID/DEVICE_ID
• Body: { "type": "lock", "payload": { "message": "Device locked by IT" } }

Step 6: Query Browsing Logs

Retrieve recent browsing activity:

• GET /api/logs/YOUR_ORG_ID?limit=100&startDate=2026-04-01
• Returns timestamped log entries with URL, domain, action, category, device, and user

Tips

• Use read-only API keys for monitoring and reporting scripts — never use admin keys for read-only tasks
• Store API keys securely (environment variables or a secrets manager) — never hard-code them
• Check the X-RateLimit-Remaining header to avoid hitting rate limits in batch operations
• The API returns JSON for all endpoints except PAC files and MDM profiles
• Use pagination parameters (limit, offset, startDate, endDate) for large datasets
• Full endpoint reference with request/response examples is available at kybergate.com/docs/api

FAQ

Q: Is the API included in all plans? A: API access is available on Pro and Enterprise plans. Basic plans can use the dashboard but not the API.

Q: Can I use the API to create or modify filtering policies? A: Yes, with a policies:write API key. You can create, update, and delete policies programmatically.

Q: Is there a webhook option for real-time events? A: Webhook support for real-time safety alerts and device events is on the product roadmap. Currently, use polling with the logs and devices endpoints.

Q: What format are API responses in? A: All responses are JSON with UTF-8 encoding. HTTP status codes follow standard REST conventions (200 for success, 400 for bad request, 401 for unauthorized, 404 for not found, 429 for rate limited, 500 for server error).

Q: Can I use the API from Google Apps Script or Zapier? A: Yes. The API is standard REST and works with any HTTP client, including Google Apps Script, Zapier, Power Automate, and scripting languages like Python, Node.js, or PowerShell.