Lacework

REST API v2 at <your-account>.lacework.net/api/v2. Resources: Alerts, Vulnerabilities, Policies, Compliance (reports), CloudActivities, UserActivities, ContainerActivities. GET /api/v2/Alerts returns current alerts with severity, context, and timing. Filtering via JSON query object in request body (POST for complex filters). Pagination via pageSize and nextPage cursor. Response includes Lacework-specific metadata (mceval_guid, entity context). OpenAPI spec available.

Standard HTTP status codes with JSON error bodies. 401 for expired/invalid tokens (requires OAuth2 refresh), 403 for insufficient permissions, 400 for malformed queries. Alert data freshness depends on agent polling cadence (typically minutes for cloud events, near-real-time for process activity). Rate limits documented per account tier. Lacework SaaS uptime SLA on enterprise agreements.

Lacework uses machine learning to detect anomalies across cloud accounts (AWS, GCP, Azure), container workloads, and CI/CD pipelines — going beyond signature-based scanning to identify unusual behavioral patterns (Polygraph). For agents, the API enables: querying security alerts and policy violations, fetching container vulnerability scan results, pulling compliance assessment data, and integrating Lacework findings into incident response workflows. The v2 API is well-structured for programmatic consumption. Good fit for security agent pipelines that need ML-enriched cloud security context. Confidence is docs-derived.

OAuth2 client credentials flow: POST /api/v2/access/tokens with keyId and secret to obtain a time-limited bearer token (24h expiry). API keys created in Lacework console as Service Account key pairs. Token refresh must be handled proactively. No long-lived API tokens — all access requires OAuth2 token exchange. Scopes are account-level; RBAC controls what the service account can access.

docs.lacework.net/api/v2/docs provides the full API reference with OpenAPI spec, authentication guide, and query examples. API reference is well-organized by resource type. Getting started requires a Lacework account and service account key. OAuth2 token exchange flow is clearly documented. SDK availability limited; direct REST calls are the primary path. Community support via Lacework Customer Success.