Authenticated ingestion

Connect a real sensor

Send observations only when you have a real JA4-family value. Atlas rejects unavailable persistence and never reports a write that did not happen.

Authentication

Both supported forms use the same shared platform key.

Authorization: Bearer $PLATPHORM_API_KEYX-PlatPhorm-API-Key: $PLATPHORM_API_KEY

Supported ingestion routes

These adapters persist into the same observation model.

POST /api/ingest/httpOne JSON observation

POST /api/ingest/batchBounded JSON observation batch

POST /api/ingest/zeekZeek JSON records

POST /api/ingest/suricataSuricata EVE JSON records

POST /api/ingest/syslogSyslog records containing JA4 fields

HTTP example

Use an observed value; the placeholders below are intentionally not presented as captured data.

curl -X POST https://atlas.platphormnews.com/api/ingest/http \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $PLATPHORM_API_KEY" \
  -H "traceparent: 00-<trace-id>-<span-id>-01" \
  -d '{
    "sensor": "your-sensor-name",
    "ja4": "<observed-ja4-value>",
    "env": "production",
    "path": "/observed/path",
    "method": "GET"
  }'

Trace propagation

Preserve traceparent and tracestate. Atlas also accepts safe X-PlatPhorm trace, span, request, source-site, target-site, workflow-run, test-run, agent-run, and session identifiers. Never put keys or credentials in baggage.