API

ELM exposes a browsable REST API at /api/v1/ for automation. Core resources include hosts and groups, sources and Depot data, content views, kickstarts and credentials, Ascender, users and teams, settings, and the audit log. Some web-interface features use internal endpoints and are not part of this public API.

Authentication

API requests authenticate with either:

• Session cookie - the same session issued when you sign in to the web interface.
• HTTP Basic auth - a local ELM username and password on each request.

Requests operate with the calling user's permissions.

For state-changing requests made with a session cookie, send the CSRF token issued by the web application. HTTP Basic auth is usually simpler for scripts.

Discovering the API

The API is self-describing: request the index at /api/v1/ to list the available resources. The index is filtered by your permissions, so it only shows what your account can access.

curl -su <username>:<password> http://<elm-server>:8080/api/v1/

Resources follow standard REST conventions - list and create on the collection, retrieve and update on the individual resource - and respond with JSON. Because the API is browsable, you can also explore it in a browser while signed in to the web interface.

Example - list sources:

curl -su <username>:<password> http://<elm-server>:8080/api/v1/sources/

Paginated collections return 50 rows by default and accept a maximum page size of 200.

Related

• Manage who can call what with Users, teams, and permissions.
• Sign-in methods behind session auth: Authentication.
• Give AI assistants read-only access through the MCP server.