Skip to contentSkip navigation

HTTP API

The REST endpoint in one screen: POST Cypher as JSON, send your key in a header, read the response envelope.

On this page (4)

HTTP API Documentation

The Whisper API is one HTTP endpoint. POST a read-only Cypher query as JSON to https://graph.whisper.security/api/query and you get back columns and rows. There is no SDK to install and no session to manage; curl, fetch, or any HTTP client works as is.

The same endpoint serves every request, and every runnable example in these docs goes through it. A GET variant and a /api/query/stats endpoint exist for quick checks and graph-wide counts; the API Reference covers all three.

A Cypher query travels as a JSON POST to /api/query and returns columns, rows, and statistics.

Try it

One request end to end: resolve google.com to its IP addresses over the RESOLVES_TO edge. Running it here needs an account, so sign in — there is no card to enter.

Live · graph.whisper.security
POST /api/query

Sign in to run this against the live graph.
Call it from your codeX-API-Key
curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $WHISPER_API_KEY" \
  -d "{\"query\":\"MATCH (h:HOSTNAME {name: \\\"google.com\\\"})-[:RESOLVES_TO]->(ip:IPV4) RETURN ip.name AS ip LIMIT 5\"}"

The Raw tab shows the exact JSON envelope the API returns: columns, rows, and statistics.get an API key →

Authentication

Send your key in the X-API-Key header. Authorization: Bearer <key> and Authorization: ApiKey <key> are also accepted. If a signed-in call is not returning what you expect, confirm the key is being read — CALL whisper.quota() answers that in one call — before you debug the query.

Requests without a key are answered. A key identifies your traffic, which is what support needs to find a request, and it is required by the calls that say so on their own pages. Create one — there is no card to enter.

One practical header: production sits behind a WAF that rejects some default programmatic User-Agent strings with HTTP 403. Send an explicit User-Agent (any descriptive string) and you will not hit it.

The response envelope

Every successful query returns the same three fields:

FieldWhat it holds
columnsColumn names, in RETURN order.
rowsOne object per row, keyed by column name.
statisticsrowCount and server-side executionTimeMs. Network latency is not included.

Errors come back as application/problem+json with a type, title, status, detail, and usually a suggestions array that proposes a rewrite. The full status table lives in Errors.

Go deeper