Nightsec API v1

Change stream

Receive additions and removals without downloading another full snapshot. Available on Pro and Business.

Connect

GET/v1/stream?after={cursor}

Start from the cursor in your snapshot manifest.

curl -N 'https://nightsec.io/v1/stream?after=42' \
  -H "Authorization: Bearer $NIGHTSEC_API_KEY" \
  -H 'Accept: text/event-stream'

The after cursor is exclusive: a value of 42 returns changes after event 42.

Apply events

Event	Action
`upsert`	Insert or replace the IP’s record using the event’s `data` object.
`delete`	Remove the IP from your local results.
`reconnect`	Reconnect using your last applied event ID.
`access_revoked`	Stop reconnecting and check your key and plan.

Data events contain id, operation, data and observed_at. Save the cursor after applying the event. Ignore IDs you have already applied.

Reconnect

Connections rotate after 55 seconds. Resume with Last-Event-ID; retry transient failures with backoff.

curl -N 'https://nightsec.io/v1/stream' \
  -H "Authorization: Bearer $NIGHTSEC_API_KEY" \
  -H 'Last-Event-ID: 42'

MMDB files cannot be edited in place. Store changes in an overlay, including removals, and replace the base file with a new snapshot periodically.

Poll instead

GET/v1/events?after=42&limit=100

Returns events, next_cursor and has_more. Apply the page, save its cursor, then fetch the next page while has_more is true. The maximum page size is 1,000.