Signal Feed API Overview

What it is (and what it isn't)

The Signal Feed is a push-only webhook ingestion API. It allows your internal security tools (SIEMs, vulnerability scanners, IAM providers) to periodically push aggregated metrics to your AutoCSAT tenant.

AutoCSAT does not install agents on your network, nor does it make inbound requests to your infrastructure. You remain in complete control of the data flow and schedule.

Integration Workflow

1. Generate an API Key: In your AutoCSAT dashboard, navigate to Settings > API Keys and generate a new tenant-scoped key (e.g., acst_live_...).
2. Configure your systems: Set up a cron job, SOAR playbook, or SIEM webhook to aggregate the required metric (e.g., "active users without MFA").
3. POST the data: Send the JSON payload to the AutoCSAT ingestion endpoint.
4. View the Interim Report: AutoCSAT automatically maps the incoming signal to the relevant CBN CSAT control, keeping your maturity score dynamically updated.

Example Payload

Here is an illustrative example of pushing an IAM metric to the feed:

curl -X POST https://api.autocsat.org/v1/signals/ingest \
  -H "X-API-Key: acst_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "control_domain": "identity_access",
    "metric_name": "mfa_coverage",
    "value": 94.5,
    "unit": "percentage",
    "timestamp": "2026-10-01T12:00:00Z"
  }'