You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
All endpoints are under /api/. Request bodies are application/json unless noted. Every /api/ route requires a valid session cookie (set by POST /api/auth/login), and so do the /webhook/* control endpoints below. The unauthenticated endpoints are the target-facing ones — /login, /qr/*, /intune/*, /receive, and /capture — plus GET /health on the main port, which returns {status:"ok"} for reverse-proxy and container health checks.
Authentication
Method
Path
Notes
POST
/api/auth/login
{username, password} → sets session HttpOnly cookie; returns {status, username, role, must_change_password}. Returns 429 with a Retry-After header once the login rate limit trips
{resource_sp_id, principal_id, app_role_id} — grant an application permission
POST
.../graph/{targetId}/assign-directory-role
{principal_id, role_definition_id, directory_scope_id?} — assign a directory role
GET
.../graph/{targetId}/find-sp
?appId= — resolve a service principal by appId (defaults to Microsoft Graph)
Search and custom
Method
Path
Notes
POST
.../graph/{targetId}/search
M365 cross-resource search
POST
.../graph/{targetId}/custom
Arbitrary Graph API request
MFA (via campaign target)
Method
Path
Notes
GET
.../graph/{targetId}/mfa/methods
List registered MFA methods
POST
.../graph/{targetId}/mfa/session
Get My Sign-ins session context
POST
.../graph/{targetId}/mfa/add-phone
{phone_type, phone_number}
POST
.../graph/{targetId}/mfa/add-email
{email}
POST
.../graph/{targetId}/mfa/add-app
{app_type, secret_key?}
POST
.../graph/{targetId}/mfa/register-totp
Register TOTP + returns secret/QR
POST
.../graph/{targetId}/mfa/verify
{verification_id, code}
POST
.../graph/{targetId}/mfa/delete
{method_id}
POST
.../graph/{targetId}/mfa/fido2/begin
{key_name}
POST
.../graph/{targetId}/mfa/fido2/complete
{verification_id, attestation_response}
Device certificates
Method
Path
Notes
GET
/api/device-certs
List all stored device certs
POST
/api/device-certs
Register a new virtual device
POST
/api/device-certs/import
Import existing cert (PEM + key)
DELETE
/api/device-certs/{id}
Delete a device cert
Primary Refresh Tokens
Method
Path
Notes
GET
/api/prts
List all stored PRTs
POST
/api/prts/request
{label, deviceCertId, refreshToken, clientId, targetUpn, tenantId} — mints a PRT from a captured refresh token bound to the device cert (camelCase fields)
POST
/api/prts/import
Import a raw PRT
POST
/api/prts/ingest
Same-origin PRT drop (console): store a PRT (prt/prt_token, session_key, upn, tenant_id, device_cert_id, label) and, with a campaign_id + session key, auto-exchange it to a Graph token ingested into the campaign
POST
/api/prts/{id}/use-in-campaign
Take a stored PRT, mint a Graph access token (needs the stored session key) and ingest it into {campaign_id, client_id?, resource?} so it is usable in Graph Actions
DELETE
/api/prts/{id}
Delete a PRT
POST
/api/prts/{id}/access-token
{resource, scope, client_id} → access token
GET
/api/prts/{id}/cookie
PRT → SSO cookie
Windows Hello keys
Method
Path
Notes
GET
/api/winhello-keys
List registered keys
POST
/api/winhello-keys
{device_cert_id, campaign_id, target_id, label}
DELETE
/api/winhello-keys/{id}
Delete
Deployment ledger / teardown
Method
Path
Notes
GET
/api/artifacts
List all deployed-artifact ledger entries
GET
/api/campaigns/{id}/artifacts
List a campaign's deployed artifacts
POST
/api/artifacts/{artId}/rollback
Revert one artifact (Graph-kind auto; else returns skipped_manual)
POST
/api/campaigns/{id}/teardown
Revert all auto-revertible artifacts newest-first; returns {rolled_back, failed, skipped_manual, results}
OTP secrets
Method
Path
Notes
GET
/api/otp-secrets
List all stored TOTP secrets
POST
/api/otp-secrets
{label, secret} — add a secret
GET
/api/otp-secrets/{id}/code
Generate current TOTP code
DELETE
/api/otp-secrets/{id}
Delete
Request templates
Saved custom Graph API request templates (stored globally, used in the custom request builder in Advanced Tools).
Method
Path
Notes
GET
/api/request-templates
List all saved request templates
POST
/api/request-templates
{label, method, url, body?} — save a template
DELETE
/api/request-templates/{id}
Delete a template
Utilities
Method
Path
Notes
POST
/api/util/tenant-lookup
{domain} → tenant ID via OIDC metadata
Webhook listener
/receive and /capture are public so beacons and broker callbacks can reach them. The /webhook/* control endpoints require an operator session.
Method
Path
Auth
Notes
POST
/receive
public
Always-on receiver. Logs any application/json or application/json-raw payload to the webhook log
POST
/capture
public
Native Broker Interop. Targets POST a captured URI here; the broker URI is parsed and written to the webhook log as a broker_capture entry
GET
/webhook/status
session
{running, port, log_path, entries}
POST
/webhook/start
session
{port: N} — bind the standalone listener on port N; returns an error immediately if the port is unavailable
POST
/webhook/stop
session
Graceful shutdown (5s timeout)
GET
/webhook/logs
session
Last 100 entries as {entries, total}
The webhook log file is stream_monitor.log under storage.artifacts_path.
Token listener
A standalone OAuth-token intake server that ingests tokens (from an AiTM proxy, phishing page, or manual drop) into a campaign. The intake endpoint runs on its own port (default 8000) and is unauthenticated by design; the /api/token-listener/* control endpoints require an operator session. See configuration.md for the payload format.
PRT variant — if the body carries prt/prt_token (+ session_key, upn, tenant_id, optional device_cert_id/label/campaign_id), the PRT is stored complete in the PRT vault. With a campaign_id and session key it is also exchanged for a Graph access token ingested into the campaign. Returns {status:"prt_stored", prt_id, exchanged?, exchange_error?}