Customer API is a separate integration boundary
Customer API gives an entitled customer a supported machine connection for customer-owned systems. It is separate from Nova sign-in and from interfaces used inside the Nova application.
A customer can pull approved views of events, alerts, threat intelligence, posture assets, posture findings, exposure relationships, and audit history. A customer can also submit event records through the supported HTTPS ingestion contract. Availability still depends on the customer edition, deployment, and enabled data products.
Pull responses contain the customer-visible version of each record, not every field Nova stores. This keeps a SIEM or data-lake integration aligned with the evidence and field boundaries shown to the same customer in Nova.
Plan one purpose-bound client for each integration
- Choose whether the customer system will pull approved records, submit events, or do both.
- Create a dedicated client for one owning system and one business purpose. Do not share one client across unrelated integrations.
- Grant only the required data scopes and restrict the client to known source networks when the integration has stable addresses.
- Use paired time ranges and the returned cursor for incremental pulls. Preserve event identifiers when retrying a submission so Nova can recognize the same occurrence.
- Confirm the versioned reference, limits, retention, retry behavior, and support path supplied for the customer deployment.
Protect and operate API access
Nova shows a client secret only when it is created or rotated. Store it immediately in an approved secret system. Never place it in browser code, public repositories, screenshots, chat, logs, or support tickets.
The customer system exchanges the client credential for a short-lived access token. Monitor failures and limits, rotate credentials before they expire, revoke a replaced credential after verification, and disable the whole client when the integration must stop immediately.