API, webhooks and ATAK export.
Read-only REST for your own workspace, outbound webhooks to your security operations centre (GSOC), and Cursor-on-Target for the TAK ecosystem. Available on Team and Enterprise Packs.
- Your keyCreated in the console, scoped
- One workspaceA key can never read another
- Read the recordRecces, ops, incidents, positions
- Your systemsJSON, webhooks or CoT XML
Authentication
An admin creates keys in the console under Settings → API keys. The key is shown once, stored hashed, and scoped. It resolves to exactly one workspace — a key can never read another tenant. 600 requests per minute per key.
curl -H "x-api-key: rn_live_…" \ "https://sjklvobxgbwcghljixbd.supabase.co/functions/v1/public-api/v1/recces?limit=20"
Keys are created, scoped and revoked in the console under Settings → API keys, and every call is journalled against the key that made it. If a key leaks, revoking it is one action and takes effect immediately.
Keys are scoped and revocable, and every call is logged.
Illustrative diagram of the integrations screen.
Endpoints
| Endpoint | Scope | Returns |
|---|---|---|
| GET /v1/recces?since=<iso>&limit=<n> | read:recces | Recces in the workspace, newest first. `since` filters on last update. |
| GET /v1/recces/{id} | read:recces | One recce with every section, its officer and its Quality Score. |
| GET /v1/ops?limit=<n> | read:ops | Live operations (active and completed). |
| GET /v1/ops/{id}/incidents?since=<iso> | read:ops or read:incidents | Incidents and messages for a job, typed by the message kind (`kind`). |
| GET /v1/ops/{id}/positions | read:ops or read:positions | Latest position per officer on the job: coordinates, direction, speed, battery, connection state. |
| GET /v1/ops/{id}/cot | export:cot | Cursor-on-Target XML for ATAK/WinTAK: team positions and incident points. |
Responses are { "data": … }. Errors: 401 invalid key · 403 scope required · 404 · 429 rate limited (with Retry-After).
Outbound webhooks to your operations centre
Configure a destination in Live Ops → webhooks: URL, shared secret and minimum severity, optionally per job. Every qualifying incident is POSTed as JSON with Authorization: Bearer <secret>. Deliveries and failures are visible in the console; a failing endpoint never holds up the job.
POST https://your-gsoc.example/recce-net
Authorization: Bearer <shared secret>
Content-Type: application/json
{ "event_id": "…", "event_name": "…", "incident": { "id": "…", "category": "spot", "severity": "high",
"description": "…", "coordinates": { "lat": 51.5, "lng": -0.1 }, "officer": "…", "created_at": "…" } }ATAK / WinTAK
Export any job as Cursor-on-Target: officer positions (typed a-f-G-U-C) with direction and speed, and incidents as map points. From the console (Live Ops → Export CoT) or the API endpoint above with the export:cot scope. Every export is journalled in your workspace.
Single sign-on
Enterprise workspaces sign in with SAML. Send us your identity provider metadata; we register the provider and give you a provider ID to enter under Settings → SSO with your verified email domain. New people from that domain are provisioned into the workspace on first sign-in with the role you choose.