API for Third-Party Applications
Functions
The API for Third-Party Applications section allows authorized external systems to access the data collected by BusinessLog in read-only mode.
This feature is designed for integration with tools such as SIEM, EDR, XDR, or other analysis and monitoring software.
Through the APIs, it is possible to retrieve information such as the list of machines, SOC events, failed events, user sessions, software inventory, antivirus events, and log reviews. All available operations are strictly read-only: authorized applications can therefore access and consult the data, but cannot modify it.
The accompanying technical documentation confirms that the BusinessLog APIs allow authorized applications to access these areas and that all the operations described are read-only.
The APIs are disabled by default.
To enable them, open the BusinessLog Settings, locate the API for Third-Party Applications section, and enable the Enable API option.
On the same screen, you can configure the ports used by the service for HTTP and HTTPS connections. HTTPS must be used for access from other computers, while HTTP is allowed only on the local computer.
Authorized Applications
To allow an external system to access BusinessLog, a new application must be created using the New Application button.
Each authorized application has its own API key. The key identifies the application when sending requests to BusinessLog and determines which APIs it is allowed to access.
The grid displays the configured applications, their creation date, any expiration date, and their Active status. A blank expiration date indicates that no expiration date has been set.
API Key
When a new application is created, BusinessLog generates an API key.
The key is displayed only at this stage and must be copied and stored immediately in a secure location.
If the key is lost, it cannot be recovered and must be regenerated.
The Regenerate Key button immediately replaces the previous key. After regeneration, the new key must be updated in the external application that sends API requests.
The API key must not be included in URLs or log files.
Available APIs
The Available APIs button displays the list of areas that can be accessed through the APIs.
The available APIs are:
-
AntivirusEvents: antivirus events;
-
FailedEvents: failed events;
-
LogReviews: log reviews;
-
MachineList: list of machines;
-
Soc: SOC events;
-
SoftwareInventory: software inventory;
-
UserSessions: user sessions.
The entry marked with an asterisk (*) indicates access to all APIs.
The paths are relative to the installation base address, and all requests use the GET method. The API name also identifies the area to be used when configuring access permissions.
Permissions
An active application without specific permissions can access all available APIs, including any APIs added in the future.
Using the Permissions button, you can define exceptions for the selected application by allowing or denying access to individual areas.
A rule for a specific area takes precedence over the general rule. A disabled or expired rule denies access to that area.
If multiple rules with the same priority exist, the deny rule takes precedence.
In the example shown, the application Pippo is generally authorized, but access to the Machine List is denied. This means that the application can access the other areas, but not the list of machines.
Permissions are saved when the window is closed. Expiration dates and times are based on the BusinessLog server time.
API Service Verification
To quickly verify whether the API process is responding, the following endpoint is available: /ping
This check can be performed directly from a browser and does not require an API key.
The check shows whether the service is reachable and whether the APIs are enabled in BusinessLog.
On the computer hosting BusinessLog, using the default port, you can open:
If a different port is configured, replace 5090 with the configured port number.
From another computer, use the installation’s HTTPS address followed by /ping.
When the APIs are enabled, the response shows:
Access to service: OK
APIs Enabled: Yes
When the APIs are disabled, the second line becomes:
APIs Enabled: No
The HTTP status code remains 200 in both cases, because the process is running even when access to the data APIs is disabled.
Note for Integrators
The APIs return responses in JSON format. Lists return an object containing the items property; an empty list is a valid response with an HTTP 200 status code.
Property names are always in English and use camelCase format, regardless of the language configured in BusinessLog.
To use the data APIs, the integrating application must include the following header in every request:
X-API-Key
The key must be the one assigned to the authorized application.
Guide for Users and Integrators: download PDF