Falco HTTP API

naftiko: 1.0.0-alpha2
info:
  label: Falco HTTP API
  description: The Falco HTTP API provides health check, version, and rules management endpoints for the Falco cloud-native
    runtime security engine. Falco uses eBPF to detect unexpected application behavior and alerts on threats at runtime. This
    API is served by the Falco web server when enabled via configuration.
  tags:
  - Falco
  - API
  created: '2026-05-06'
  modified: '2026-05-06'
capability:
  consumes:
  - type: http
    namespace: falco
    baseUri: http://localhost:8765
    description: Falco HTTP API HTTP API.
    resources:
    - name: healthz
      path: /healthz
      operations:
      - name: gethealthz
        method: GET
        description: Falco Health check
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: version
      path: /version
      operations:
      - name: getversion
        method: GET
        description: Falco Version information
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-rules
      path: /api/v1/rules
      operations:
      - name: getrules
        method: GET
        description: Falco List loaded rules
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-rules-reload
      path: /api/v1/rules/reload
      operations:
      - name: reloadrules
        method: POST
        description: Falco Reload rules
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
  exposes:
  - type: rest
    port: 8080
    namespace: falco-rest
    description: REST adapter for Falco HTTP API.
    resources:
    - path: /healthz
      name: gethealthz
      operations:
      - method: GET
        name: gethealthz
        description: Falco Health check
        call: falco.gethealthz
        outputParameters:
        - type: object
          mapping: $.
    - path: /version
      name: getversion
      operations:
      - method: GET
        name: getversion
        description: Falco Version information
        call: falco.getversion
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/rules
      name: getrules
      operations:
      - method: GET
        name: getrules
        description: Falco List loaded rules
        call: falco.getrules
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/rules/reload
      name: reloadrules
      operations:
      - method: POST
        name: reloadrules
        description: Falco Reload rules
        call: falco.reloadrules
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    port: 9090
    namespace: falco-mcp
    transport: http
    description: MCP adapter for Falco HTTP API for AI agent use.
    tools:
    - name: gethealthz
      description: Falco Health check
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: falco.gethealthz
      outputParameters:
      - type: object
        mapping: $.
    - name: getversion
      description: Falco Version information
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: falco.getversion
      outputParameters:
      - type: object
        mapping: $.
    - name: getrules
      description: Falco List loaded rules
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: falco.getrules
      outputParameters:
      - type: object
        mapping: $.
    - name: reloadrules
      description: Falco Reload rules
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: falco.reloadrules
      outputParameters:
      - type: object
        mapping: $.