# Prophet Docs

Prophet is network breach detection infrastructure, built from first principles and delivered as a service.

Prophet is autonomous network breach detection and attribution. Customers deploy lightweight collectors wherever traffic exists. Collectors extract the shape of network communication — and the host context behind it — and stream compact telemetry to Prophet infrastructure, where it is modeled, analyzed, and turned into finished investigations: who got in, how, as what identity, what they ran, and where the data went. Prophet catches modern breaches with near-zero false positives and delivers finished investigations, not raw alerts. One question is deliberately left for a human: was this authorized?

Canonical docs: https://docs.prophet.io/
Marketing site: https://prophetic.ai/
Console: https://console.prophet.io/
API base URL: https://app.prophet.io
OpenAPI spec: https://docs.prophet.io/openapi.json
Full LLM text export: https://docs.prophet.io/llms-full.txt
Markdown API reference: https://docs.prophet.io/api-reference.md

Key documentation sections:
- Overview: https://docs.prophet.io/#overview
- Quickstart: https://docs.prophet.io/#quickstart
- Authentication: https://docs.prophet.io/#authentication
- Collector config: https://docs.prophet.io/#collector-config
- Python SDK: https://docs.prophet.io/#sdk
- PQL: https://docs.prophet.io/#pql
- API reference: https://docs.prophet.io/#api
- Quickstart / API key: https://docs.prophet.io/#quickstart-api-key
- Quickstart / Token exchange: https://docs.prophet.io/#quickstart-token
- Quickstart / Deploy node: https://docs.prophet.io/#quickstart-node
- Quickstart / Registration: https://docs.prophet.io/#quickstart-registration

API families:
- OAuth2: https://docs.prophet.io/#api-oauth2 — Issue JWT access tokens, register collectors, and run device authorization.
- Deployments: https://docs.prophet.io/#api-deployments — Create and manage child tenant deployments for MSP parent accounts.
- Nodes: https://docs.prophet.io/#api-nodes — Provision units, inspect node health, trigger updates, and pull diagnostics.
- Profiles: https://docs.prophet.io/#api-profiles — Reusable collector capture configuration for fleets and child deployments.
- Collector: https://docs.prophet.io/#api-collector — Download binaries and install or uninstall the Prophet collector.
- Search: https://docs.prophet.io/#api-flows — Query flow records, request timeseries buckets, and run terms aggregations over flow data.
- Investigations: https://docs.prophet.io/#api-investigations — Read the finished investigations Prophet produces when breach signal appears — verdict, key findings, provenance lineage across access, execution, and network, and recommended actions. One question is left for a human: was this authorized?
- Explore: https://docs.prophet.io/#api-explore — External-organization communication shape: which external services a network sends traffic to, and the texture of each relationship (when, rhythm, transfer, who, how). Communication shape is what Prophet models to detect breaches — these endpoints expose the same view of your network for exploration.
- Events: https://docs.prophet.io/#api-events — Fetch event topics and records from Prophet plugin activity.
- Automation: https://docs.prophet.io/#api-automation — List, set, and delete automations scoped to a tenant or child tenant.

Important API prefix:
- Public controller REST endpoints are mounted under /rest.
- Search API endpoints are mounted under /search.
- Bearer tokens are JWTs issued by POST https://app.prophet.io/rest/oauth2/token/1.0.

High-value endpoint anchors:
- POST /rest/oauth2/token/1.0: https://docs.prophet.io/#api-oauth-token — Exchange API credentials
- POST /rest/oauth2/register/1.0: https://docs.prophet.io/#api-oauth-register — Register legacy node
- POST /rest/oauth2/device/1.0: https://docs.prophet.io/#api-oauth-device-start — Start device authorization
- GET /rest/oauth2/device/approve/1.0: https://docs.prophet.io/#api-oauth-device-info — Get device approval info
- POST /rest/oauth2/device/approve/1.0: https://docs.prophet.io/#api-oauth-device-approve — Approve or deny device
- POST /rest/oauth2/device/poll/1.0: https://docs.prophet.io/#api-oauth-device-poll — Poll device authorization
- GET /rest/deployments/1.0: https://docs.prophet.io/#api-deployments-list — List child deployments
- POST /rest/deployments/1.0: https://docs.prophet.io/#api-deployments-create — Create child deployment
- DELETE /rest/deployments/1.0: https://docs.prophet.io/#api-deployments-delete — Delete child deployment
- GET /rest/nodes/1.0: https://docs.prophet.io/#api-nodes-list — List nodes
- GET /rest/nodes/1.0/outdated: https://docs.prophet.io/#api-nodes-outdated — List outdated nodes
- GET /rest/nodes/1.0/:node_id: https://docs.prophet.io/#api-nodes-get — Get node
- GET /rest/nodes/1.0/:node_id/diagnostics: https://docs.prophet.io/#api-nodes-diagnostics — Pull node diagnostics
- GET /rest/nodes/1.0/:node_id/pprof: https://docs.prophet.io/#api-nodes-pprof — Capture pprof profile
- POST /rest/nodes/1.0/:node_id/update: https://docs.prophet.io/#api-nodes-update — Update node
- POST /rest/nodes/provision/1.0: https://docs.prophet.io/#api-nodes-provision — Provision unit credential
- POST /rest/nodes/1.0/:node_id/manage: https://docs.prophet.io/#api-nodes-manage — Legacy deploy-node manage
- GET /rest/profiles/1.0: https://docs.prophet.io/#api-profiles-list — List profiles
- POST /rest/profiles/1.0: https://docs.prophet.io/#api-profiles-create — Create profile
- DELETE /rest/profiles/1.0/:profile_id: https://docs.prophet.io/#api-profiles-delete — Delete profile
- GET /rest/collector/download/1.0: https://docs.prophet.io/#api-collector-download — Download collector binary
- GET /rest/collector/install/1.0: https://docs.prophet.io/#api-collector-install — Get install script
- GET /rest/collector/uninstall/1.0: https://docs.prophet.io/#api-collector-uninstall — Get uninstall script
- POST /search/records/1.0: https://docs.prophet.io/#api-flows-query — Query flow records
- POST /search/agg/1.0: https://docs.prophet.io/#api-flows-terms-agg — Aggregate flow terms
- GET /rest/investigations/1.0: https://docs.prophet.io/#api-investigations-list — List investigations
- GET /rest/investigations/1.0/:id: https://docs.prophet.io/#api-investigations-get — Get investigation
- GET /rest/events/1.0/:customerId: https://docs.prophet.io/#api-events-topics — Fetch event topics
- GET /rest/events/1.0/:customerId/:eventId: https://docs.prophet.io/#api-events-records — Fetch event records
- GET /rest/automation/1.0: https://docs.prophet.io/#api-automation-list — List or fetch automations
- POST /rest/automation/1.0: https://docs.prophet.io/#api-automation-set — Create or update automation
- DELETE /rest/automation/1.0: https://docs.prophet.io/#api-automation-delete — Delete automation
- GET /rest/explore/1.0/egress/organizations: https://docs.prophet.io/#api-explore-egress-organizations — List external organizations
- GET /rest/explore/1.0/egress/organizations/:org: https://docs.prophet.io/#api-explore-egress-organization — Organization header
- GET /rest/explore/1.0/egress/organizations/:org/temporal: https://docs.prophet.io/#api-explore-egress-temporal — Organization — temporal
- GET /rest/explore/1.0/egress/organizations/:org/cadence: https://docs.prophet.io/#api-explore-egress-cadence — Organization — cadence
- GET /rest/explore/1.0/egress/organizations/:org/transfer: https://docs.prophet.io/#api-explore-egress-transfer — Organization — transfer
- GET /rest/explore/1.0/egress/organizations/:org/reach: https://docs.prophet.io/#api-explore-egress-reach — Organization — reach
- GET /rest/explore/1.0/egress/organizations/:org/access: https://docs.prophet.io/#api-explore-egress-access — Organization — access