Endpoint Exposure Summary
Every endpoint of your active account with its access posture as the edge enforces it, plus an open / protected count — one call answers "which of my endpoints can anyone reach?". Pair it with Bulk Endpoint Auth Settings to put a sign-in in front of the open ones.
An endpoint is open when it has no auth settings, its mode is none, or every sign-in method is turned off. It is protected when visitors must sign in (basic or sso), or when its stored mode is one the edge no longer supports — such an endpoint refuses every request and carries a note. Only the auth mode decides; firewall policies, rate limits and traffic policy rules are not counted.
Requires the endpoints:read permission in the active account.
Response (200 OK)
summary.total integer
Number of endpoints in the account.
summary.open integer
Endpoints anyone can reach (
protected: false).summary.protected integer
Endpoints that require a sign-in or refuse every request (
protected: true).endpoints array
One entry per endpoint, newest first. Empty array when the account has none.
endpoints[].uuid string (uuid)
The endpoint's public id.
endpoints[].hostname string
The endpoint's public hostname.
endpoints[].status string
The endpoint's status:
active, inactive, pending_dns or dns_failed.endpoints[].auth_mode string
The stored auth mode:
none (also for an endpoint with no auth settings) or basic. An endpoint on sso reads basic here, because sso is stored as basic with SSO sign-in turned on (see Endpoint Auth Config). A mode the edge no longer supports reads back as stored (for example token).endpoints[].protected boolean
true when visitors must sign in, or when every request is refused (unsupported mode).endpoints[].enforce_https boolean
true when the edge requires HTTPS for this endpoint. false when the endpoint has no auth settings.endpoints[].note string
Set only when the stored auth mode is one the edge refuses outright:
This endpoint's auth mode "token" is not supported: it refuses every request until its owner chooses none, basic or sso. Omitted otherwise.Errors
401 Unauthorized
Missing or invalid auth.
403 Forbidden
Your role lacks
endpoints:read (Insufficient permissions for this action), or you are not a member of the active account.500
The endpoint list could not be read (
Failed to list endpoints).Request
curl "https://api.ngris.com/v1/endpoints/exposure-summary" \
-H "X-API-KEY: <your_api_key>"
Response — 200 OK
{
"summary": {
"total": 3,
"open": 1,
"protected": 2
},
"endpoints": [
{
"uuid": "019bd40c-ca85-7f0f-94f3-0445a3577e18",
"hostname": "calm-otter-91.ngris.dev",
"status": "active",
"auth_mode": "none",
"protected": false,
"enforce_https": false
},
{
"uuid": "019ba0a5-abcc-7a95-af8e-2f8559f823cd",
"hostname": "api.example.com",
"status": "active",
"auth_mode": "basic",
"protected": true,
"enforce_https": true
},
{
"uuid": "019bef7f-73ed-7d77-a6c2-9163d00d68df",
"hostname": "staging.example.com",
"status": "inactive",
"auth_mode": "token",
"protected": true,
"enforce_https": false,
"note": "This endpoint's auth mode \"token\" is not supported: it refuses every request until its owner chooses none, basic or sso."
}
]
}