API Reference
The ArxLayer control-plane API
Everything ArxLayer does is driven by an API-first control plane. This is the resource model you work with — domains, policies, versions, IP lists, and more — secured with scoped, tenant-isolated access.
Resource model
What you can manage
Domains & origins
Register the hostnames you protect and the origins behind them, with validated, pinned origin targets.
Policies & versions
Create policies and immutable versions; promote a version to activate it, or roll back to a known-good one.
Activations & bypass
Activate versions per domain, and use an audited emergency bypass to flip to detect or off in seconds.
IP lists & reputation
Manage allow, deny, and greylist entries at domain, account, and platform scope, with TTLs and revisions.
Events & usage
Read security events and per-domain usage aggregates for analytics and billing.
Auth & tenancy
OAuth2 resource-server auth with scopes; every object is filtered by your tenant by construction.
Authentication
The control plane is an OAuth2 resource server. Requests carry a bearer token validated against a JWKS, checked for the required scopes, and resolved to a tenant context — so access is both scope-gated and tenant-isolated.
Get API access
Start free to provision a tenant, or talk to us about an enterprise rollout.