NetBird REST API — Events

naftiko: 1.0.0-alpha2
info:
  label: NetBird REST API — Events
  description: 'NetBird REST API — Events. 3 operations. Lead operation: List all Audit Events. Self-contained Naftiko capability
    covering one Netbird business surface.'
  tags:
  - Netbird
  - Events
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    NETBIRD_API_KEY: NETBIRD_API_KEY
capability:
  consumes:
  - type: http
    namespace: netbird-events
    baseUri: https://api.netbird.io
    description: NetBird REST API — Events business capability. Self-contained, no shared references.
    resources:
    - name: api-events-audit
      path: /api/events/audit
      operations:
      - name: get
        method: GET
        description: List all Audit Events
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-events-network-traffic
      path: /api/events/network-traffic
      operations:
      - name: get
        method: GET
        description: List all Traffic Events
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: page
          in: query
          type: integer
          description: Page number
        - name: page_size
          in: query
          type: integer
          description: Number of items per page
        - name: user_id
          in: query
          type: string
          description: Filter by user ID
        - name: reporter_id
          in: query
          type: string
          description: Filter by reporter ID
        - name: protocol
          in: query
          type: integer
          description: Filter by protocol
        - name: type
          in: query
          type: string
          description: Filter by event type
        - name: connection_type
          in: query
          type: string
          description: Filter by connection type
        - name: direction
          in: query
          type: string
          description: Filter by direction
        - name: search
          in: query
          type: string
          description: Case-insensitive partial match on user email, source/destination names, and source/destination addresses
        - name: start_date
          in: query
          type: string
          description: Start date for filtering events (ISO 8601 format, e.g., 2024-01-01T00:00:00Z).
        - name: end_date
          in: query
          type: string
          description: End date for filtering events (ISO 8601 format, e.g., 2024-01-31T23:59:59Z).
    - name: api-events-proxy
      path: /api/events/proxy
      operations:
      - name: get
        method: GET
        description: List all Reverse Proxy Access Logs
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: page
          in: query
          type: integer
          description: Page number for pagination (1-indexed)
        - name: page_size
          in: query
          type: integer
          description: Number of items per page (max 100)
        - name: sort_by
          in: query
          type: string
          description: Field to sort by (url sorts by host then path)
        - name: sort_order
          in: query
          type: string
          description: Sort order (ascending or descending)
        - name: search
          in: query
          type: string
          description: General search across request ID, host, path, source IP, user email, and user name
        - name: source_ip
          in: query
          type: string
          description: Filter by source IP address
        - name: host
          in: query
          type: string
          description: Filter by host header
        - name: path
          in: query
          type: string
          description: Filter by request path (supports partial matching)
        - name: user_id
          in: query
          type: string
          description: Filter by authenticated user ID
        - name: user_email
          in: query
          type: string
          description: Filter by user email (partial matching)
        - name: user_name
          in: query
          type: string
          description: Filter by user name (partial matching)
        - name: method
          in: query
          type: string
          description: Filter by HTTP method
        - name: status
          in: query
          type: string
          description: Filter by status (success = 2xx/3xx, failed = 1xx/4xx/5xx)
        - name: status_code
          in: query
          type: integer
          description: Filter by HTTP status code
        - name: start_date
          in: query
          type: string
          description: Filter by timestamp >= start_date (RFC3339 format)
        - name: end_date
          in: query
          type: string
          description: Filter by timestamp <= end_date (RFC3339 format)
    authentication:
      type: bearer
      token: '{{env.NETBIRD_API_KEY}}'
  exposes:
  - type: rest
    namespace: netbird-events-rest
    port: 8080
    description: REST adapter for NetBird REST API — Events. One Spectral-compliant resource per consumed operation, prefixed
      with /v1.
    resources:
    - path: /v1/api/events/audit
      name: api-events-audit
      description: REST surface for api-events-audit.
      operations:
      - method: GET
        name: get
        description: List all Audit Events
        call: netbird-events.get
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/events/network-traffic
      name: api-events-network-traffic
      description: REST surface for api-events-network-traffic.
      operations:
      - method: GET
        name: get
        description: List all Traffic Events
        call: netbird-events.get
        with:
          page: rest.page
          page_size: rest.page_size
          user_id: rest.user_id
          reporter_id: rest.reporter_id
          protocol: rest.protocol
          type: rest.type
          connection_type: rest.connection_type
          direction: rest.direction
          search: rest.search
          start_date: rest.start_date
          end_date: rest.end_date
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/api/events/proxy
      name: api-events-proxy
      description: REST surface for api-events-proxy.
      operations:
      - method: GET
        name: get
        description: List all Reverse Proxy Access Logs
        call: netbird-events.get
        with:
          page: rest.page
          page_size: rest.page_size
          sort_by: rest.sort_by
          sort_order: rest.sort_order
          search: rest.search
          source_ip: rest.source_ip
          host: rest.host
          path: rest.path
          user_id: rest.user_id
          user_email: rest.user_email
          user_name: rest.user_name
          method: rest.method
          status: rest.status
          status_code: rest.status_code
          start_date: rest.start_date
          end_date: rest.end_date
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: netbird-events-mcp
    port: 9090
    transport: http
    description: MCP adapter for NetBird REST API — Events. One tool per consumed operation, routed inline through this capability's
      consumes block.
    tools:
    - name: list-all-audit-events
      description: List all Audit Events
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: netbird-events.get
      outputParameters:
      - type: object
        mapping: $.
    - name: list-all-traffic-events
      description: List all Traffic Events
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: netbird-events.get
      with:
        page: tools.page
        page_size: tools.page_size
        user_id: tools.user_id
        reporter_id: tools.reporter_id
        protocol: tools.protocol
        type: tools.type
        connection_type: tools.connection_type
        direction: tools.direction
        search: tools.search
        start_date: tools.start_date
        end_date: tools.end_date
      outputParameters:
      - type: object
        mapping: $.
    - name: list-all-reverse-proxy-access
      description: List all Reverse Proxy Access Logs
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: netbird-events.get
      with:
        page: tools.page
        page_size: tools.page_size
        sort_by: tools.sort_by
        sort_order: tools.sort_order
        search: tools.search
        source_ip: tools.source_ip
        host: tools.host
        path: tools.path
        user_id: tools.user_id
        user_email: tools.user_email
        user_name: tools.user_name
        method: tools.method
        status: tools.status
        status_code: tools.status_code
        start_date: tools.start_date
        end_date: tools.end_date
      outputParameters:
      - type: object
        mapping: $.