Witen

Witen API

The public Collector base URL is https://collector.witenlabs.com. Port 8420 is internal and is not part of the public URL.

Authentication boundaries

  • Browser customer APIs use the signed-in website session.
  • Enrolled assets use a host-specific wts- bearer credential.
  • wte- enrollment tokens are single-use and expire after 15 minutes by default.
  • Administrative and service APIs require separate privileged authentication.

Never deploy a fleet ownership credential to individual hosts. Exchange an enrollment token once and retain only the resulting installation credential.

Enrollment exchange

POST /api/v1/enrollments/exchange
Content-Type: application/json

{
  "enrollment_token": "wte-...",
  "sensor_id": "unique-asset-name"
}

Treat the returned wts- value as a secret. An enrollment token cannot be reused after a successful exchange.

Operational endpoints

| Method and path | Purpose | Authentication | | --- | --- | --- | | GET /health | Check Collector availability. | None | | POST /api/v1/events | Submit bounded asset observations. | Installation bearer credential | | GET /api/v1/bad-ips/outbound | Retrieve distributed-intelligence updates available to an asset. | Installation bearer credential | | GET /api/v1/advisories | List publisher-confirmed WordPress advisories and privacy-thresholded exploitation observations. | Customer or service-scoped credential |

Vulnerability advisory feed

GET /api/v1/advisories?limit=50&offset=0 returns only public lifecycle states. Each record identifies its source and publisher, preserves affected and fixed version evidence, and uses an empty affected_versions value when the source does not establish a range. It never interprets an unknown range as every version.

Exploitation observations appear only when a separately validated classifier signature matches at least three independent sensors. These aggregates contain event, sensor, and source-address counts, but no contributing customer, hostname, request, sensor identity, or source address. A missing observation means Witen has no publishable match; it does not prove that exploitation has not occurred.

Failure handling

Clients should use bounded exponential backoff, preserve event ordering, respect response status codes, and avoid replacing credentials merely because the Collector is temporarily unavailable. Warden continues local detection and enforcement during Collector outages.