Last Watch is an API-first application. Anything that is managed with the web interface can also be managed with the web API as documented here.
This documentation might not be completely up to date. You can always reverse engineer the API by using the inspector on your browser to see what the web inteface is doing. Also, you can refer to the API Routes and API Tests to see how the API is defined in the code.
Here is a basic example showing how to get the latest relevant detection events for a given profile.
curl -i GET "http://<SERVER_IP>:<WEB_PORT>/api/events?page=1&relevant&profileId=1"
{
"data": [
{
"id": 331465,
"image_file_name": "events\/annke101sd.20201219_171959023.jpg",
"image_dimensions": "640x480",
"occurred_at": "2020-12-19 23:19:59",
"detection_profiles_count": 3
},
{
"id": 331457,
"image_file_name": "events\/annke101sd.20201219_171926090.jpg",
"image_dimensions": "640x480",
"occurred_at": "2020-12-19 23:19:26",
"detection_profiles_count": 3
}
...
]
}
Profiles are referenced by their slug. You can copy the slug from the Detection Profiles page. The slug is also is returned by the API when a profile is first created.
/api/profiles
| GET
| Get Detection Profiles
/api/profiles/<profile_slug>
| GET
| Get single Detection Profile details
/api/profiles
| POST
| Create a new Detection Profile
/api/profiles/<profile_slug>
| PATCH
| Update a Detection Profile
/api/profiles/<profile_slug>/status
| GET
| Get the on/off status of a Detection Profile
/api/profiles/<profile_slug>/status
| PUT
| Turn on/off a Detection Profile
Options:
status=<new_status>
| set to "enabled", "disabled", or "as_scheduled"start_time=<HH:mm>
| when status is "as_scheduled", the time-of-day when the profile is enabledend_time=<HH:mm>
| when status is "as_scheduled", the time-of-day when the profile is disabledperiod=<minutes>
| when the status is "disabled", the number of minutes before the profile is automatically re-enabled
/api/profiles/<profile_slug>/automations
| GET
| Get the Automations to which a Detection Profile is subscribed
/api/profiles/<profile_slug>/automations
| PUT
| Subscribe/unsubscribe a Detection Profile to an Automation
/api/profiles/<profile_slug>
| DELETE
| Delete a Detection Profile
/api/events?<option_1>&<option_2>&...
| GET
| Get list of Detection Events
Options:
page=<page_number>
| Page number starting with 1relevant
| Only include events with a relevant detectionprofileId=<profile_id>
| Only include events which matched the given profile
/api/events/latest
| GET
| Get the latest Detection Event
/api/events/<event_id>
| GET
| Get the details of a given Detection Event
/api/events/<event_id>/next
| GET
| Get the next event (chronologically) after a given Detection Event
/api/events/<event_id>/previous
| GET
| Get the previous event (chronologically) before a given Detection Event
/api/automations/telegram
| GET
| Get all Telegram automation configs
/api/automations/telegram
| POST
| Create a new Telegram automation config
/api/automations/webRequest
| GET
| Get all Web Request automation configs
/api/automations/webRequest
| POST
| Create a new Web Request automation config
/api/automations/folderCopy
| GET
| Get all Folder Copy automation configs
/api/automations/folderCopy
| POST
| Create a new Folder Copy automation config
/api/automations/smbCifsCopy
| GET
| Get all SMB/CIFS Copy automation configs
/api/automations/smbCifsCopy
| POST
| Create a new SMB/CIFS Copy automation config
/api/alive
| GET
| Check if Last Watch is up and running
/api/statistics
| GET
| Get the home page statistics
/api/objectClasses
| GET
| Get full list of objects which can be profiled
/api/errors?page=<page_number>
| GET
| Get latest automation errors starting with page 1
/api/deepstackLogs?page=<page_number>
| GET
| Get latest logs from the Deepstack API starting with page 1
If you want to create detection events without using the watch folder, you can use the following webhook.
/api/events
| POST
| Create a new detection event
Options:
image_file=<data>
| Required. Data stream of the jpg file.