API Overview

FORG has two different API surfaces with different authentication models. Keep them separate:

• Customer REST API (public): https://forg.pro/api/v1 using customer API keys.
• Agent ingest API (internal): engine ingestion endpoints using per-session HMAC signatures.

1) Customer REST API (public)

This is the documented integration surface for customer applications and automation. It is described by the published OpenAPI spec and authenticated with bearer API keys.

Base URL: https://forg.pro/api/v1
Auth: Authorization: Bearer forg_live_{32hex} | forg_test_{32hex}
Spec: https://forg.pro/api/v1/openapi.json

Most non-SCIM routes are read-only; certain resources (webhooks, projects, alerts, goals, and API keys) support scoped writes. SCIM provisioning endpoints require a separate org SCIM bearer token.

Generated endpoint index (from OpenAPI)

The table below is generated directly from readOnlySpec() (the same source used by /api/v1/openapi.json), so docs stay aligned with the published spec.

2) Agent ingest API (internal, HMAC)

This surface is for FORG agent/runtime telemetry transport, not customer API-key integrations. Requests are signed per session and verified server-side.

Ingress surface: https://engine.forg.pro (and same-host /engine/v1 proxy)
Auth model: HMAC-SHA256 request signature over signed envelope + body hash
Key source: internal session-key exchange (operator/internal only)

Signed envelope headers:

Do not send customer API keys to internal ingest endpoints.

OpenAPI spec

Import https://forg.pro/api/v1/openapi.json into Postman, Insomnia, or a client generator.