Network Pulse Ingest API

Last updated 16 August 2026

Most people should install the InfraCue Collector instead of reading this page. The guided setup in Network Pulse → Set up installs it, fills in the credentials, and confirms the first check-in for you.

This page is for the other case: you already run a monitoring tool and would rather forward what it already knows than run a second agent. Everything below is what the collector itself sends, so anything that can POST signed JSON can speak it.

Zabbix and Nagios have ready-made handlers — pick that source when you create the connection and follow its setup guide instead of mapping fields by hand. For PRTG, SolarWinds, ManageEngine or anything else, use the generic webhook below and map your tool's fields to this payload.

Endpoint

POST https://<host>/<workspace-slug>/api/network-pulse/ingest.php
Content-Type: application/json

The workspace comes from the URL path, not from the body. A request without the slug cannot identify a tenant and is rejected before the credentials are looked at.

Headers

Signing

The signature is an HMAC-SHA256 over the timestamp, a literal full stop, and the raw request body exactly as sent — sign the bytes you will transmit, not a re-serialised copy of them, or whitespace differences will break the comparison.

signature = "sha256=" + hex( hmac_sha256( timestamp + "." + raw_body, secret ) )

Two failures account for nearly every 401 we see:

• Local time instead of UTC. Windows PowerShell 5.1's Get-Date -UFormat %s returns a local-time epoch, which in IST is 19,800 seconds outside a 300-second tolerance. Use [DateTimeOffset]::UtcNow.ToUnixTimeSeconds().
• Re-encoding the body after signing. Sign last, send what you signed.

Bash

TS=$(date -u +%s)
BODY='{"events":[{"device_id":"sw-core-01","status":"down"}]}'
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -r | cut -d' ' -f1)

curl -sS -X POST "https://infracue.com/$SLUG/api/network-pulse/ingest.php" \
  -H 'Content-Type: application/json' \
  -H "X-InfraCue-Integration-Key: $KEY" \
  -H "X-InfraCue-Timestamp: $TS" \
  -H "X-InfraCue-Signature: sha256=$SIG" \
  --data-raw "$BODY"

PowerShell

$ts   = [string][System.DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
$body = '{"events":[{"device_id":"sw-core-01","status":"down"}]}'
$hmac = [System.Security.Cryptography.HMACSHA256]::new([Text.Encoding]::UTF8.GetBytes($secret))
$sig  = ($hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes("$ts.$body")) |
         ForEach-Object { $_.ToString('x2') }) -join ''

Invoke-RestMethod -Method Post -Uri "https://infracue.com/$slug/api/network-pulse/ingest.php" `
  -ContentType 'application/json' `
  -Headers @{
      'X-InfraCue-Integration-Key' = $key
      'X-InfraCue-Timestamp'       = $ts
      'X-InfraCue-Signature'       = "sha256=$sig"
  } -Body $body

Body

Either an object with an events array, or a single event object on its own. At most 100 events per request; the body must be under 1 MB.

{
  "events": [
    {
      "device_id":     "sw-core-01",
      "name":          "Core switch, Mumbai BKC",
      "device_type":   "switch",
      "host":          "10.20.0.1",
      "location_name": "Mumbai HQ - BKC",
      "status":        "down",
      "severity":      "critical",
      "event_type":    "status",
      "title":         "ICMP unreachable",
      "message":       "3 consecutive probes failed",
      "occurred_at":   "2026-08-16T09:41:07Z",
      "affects_state": true,
      "metadata":      { "probe": "icmp", "loss_pct": 100 }
    }
  ]
}

deviceId, occurredAt, eventId, deviceType and eventType are accepted as camelCase aliases.

Responses

Always JSON, always with a boolean success.

200 { "success": true, "result": { "accepted": 1, "duplicates": 0,
                                   "capacity_limited": 0, "samples": 0 } }

capacity_limited counts devices we refused because the workspace is at its plan device limit. It is not an error — the rest of the batch is still stored.

Rate limit

300 requests per minute per connection. Beyond that you get 422 until the minute rolls over. Batch your events rather than sending one request per device.

What we do with it

• A device whose status changes gets a state-change record and, if your alert rules say so, a ticket in the right queue with the priority you chose.
• A batch where nothing changed state is the normal case and is accepted as such.
• We never call into your network. Everything is inbound from you.

Something here not matching what the endpoint does? Tell us — that is a bug in this page.