REST API

Everything in the PromptGlass console is available through a versioned REST API at https://<tenant>/api/v1. Use it to pull metrics into BI tools, automate policy changes from CI, and export events to S3, ADLS, Snowflake or Databricks. Requests authenticate with OAuth 2.0 client credentials or short-lived personal tokens. Every call is checked against your role and written to the audit log.

Authentication

curl -s https://acme.eu.promptglass.ai/api/v1/oauth/token \
  -d grant_type=client_credentials -d client_id=$PG_CLIENT_ID -d client_secret=$PG_CLIENT_SECRET \
  -d scope="metrics:read events:read policies:write"

Common endpoints

Method	Path	Purpose
GET	/metrics/adoption?groupBy=department,app&period=week	Adoption metrics
GET	/metrics/cost?groupBy=cost_center,model&month=2026-10	Cost metrics
GET	/seats/idle?days=60	Idle seats
GET	/events?since=…&detection=secret.*&limit=500	Event search (cursor paginated)
GET	/apps?sanctioned=false&minRisk=high	Shadow AI inventory
GET/PUT	/policies/{name}	Read / replace a policy
POST	/policies/{name}:simulate	Simulate against history
POST	/detectors/{name}:test	Test a detector against text
GET	/catalog/urls.txt	Effective AI domain list (for SWG / PAC)
GET	/pac	Generated PAC file

Example: weekly adoption

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://acme.eu.promptglass.ai/api/v1/metrics/adoption?groupBy=department&period=week&since=2026-09-01"

{
  "data": [
    { "week": "2026-10-27", "department": "Finance", "activeUsers": 142, "penetration": 0.61, "sanctionedShare": 0.88 },
    { "week": "2026-10-27", "department": "Legal",   "activeUsers": 38,  "penetration": 0.47, "sanctionedShare": 0.95 }
  ],
  "meta": { "kAnonymity": 5, "suppressedGroups": 2 }
}

Bulk export

Scheduled exports write Parquet files partitioned by day:

apiVersion: promptglass.ai/v1
kind: Export
metadata: { name: lakehouse }
spec:
  dataset: events            # events | detections | cost | adoption
  schedule: "0 2 * * *"
  destination:
    type: s3                 # s3 | adls | gcs | snowflake | databricks
    uri: s3://acme-lake/promptglass/events/
    roleArn: arn:aws:iam::111122223333:role/PromptGlassExport
  includeContent: false

Rate limits and versioning

The default limit is 600 requests per minute per client, and 429 responses include Retry-After. Breaking changes ship only in a new major path (/api/v2), and deprecated fields are announced in the changelog at least six months ahead.