HTTP API
The REST endpoint in one screen: POST Cypher as JSON, send your key in a header, read the response envelope.
On this page (4)
HTTP API Documentation
The Whisper API is one HTTP endpoint. POST a read-only Cypher query as JSON to https://graph.whisper.security/api/query and you get back columns and rows. There is no SDK to install and no session to manage; curl, fetch, or any HTTP client works as is.
The same endpoint serves every request, and every runnable example in these docs goes through it. A GET variant and a /api/query/stats endpoint exist for quick checks and graph-wide counts; the API Reference covers all three.
Try it
One request end to end: resolve google.com to its IP addresses over the RESOLVES_TO edge. Running it here needs an account, so sign in — there is no card to enter.
curl -s -X POST https://graph.whisper.security/api/query \
-H "Content-Type: application/json" \
-H "X-API-Key: $WHISPER_API_KEY" \
-d "{\"query\":\"MATCH (h:HOSTNAME {name: \\\"google.com\\\"})-[:RESOLVES_TO]->(ip:IPV4) RETURN ip.name AS ip LIMIT 5\"}"The Raw tab shows the exact JSON envelope the API returns: columns, rows, and statistics.get an API key →
Authentication
Send your key in the X-API-Key header. Authorization: Bearer <key> and Authorization: ApiKey <key> are also accepted. If a signed-in call is not returning what you expect, confirm the key is being read — CALL whisper.quota() answers that in one call — before you debug the query.
Requests without a key are answered. A key identifies your traffic, which is what support needs to find a request, and it is required by the calls that say so on their own pages. Create one — there is no card to enter.
One practical header: production sits behind a WAF that rejects some default programmatic User-Agent strings with HTTP 403. Send an explicit User-Agent (any descriptive string) and you will not hit it.
The response envelope
Every successful query returns the same three fields:
| Field | What it holds |
|---|---|
columns | Column names, in RETURN order. |
rows | One object per row, keyed by column name. |
statistics | rowCount and server-side executionTimeMs. Network latency is not included. |
Errors come back as application/problem+json with a type, title, status, detail, and usually a suggestions array that proposes a rewrite. The full status table lives in Errors.
Go deeper
- API Reference: the shared envelope, auth, and pagination, with a page per endpoint — POST /api/query, GET /api/query, GET /api/query/stats — each with code in cURL, Python, Node, Go, and Ruby.
- Errors: the problem+json shape and every status code you can hit.
- Cypher Reference: the read-only dialect, its clauses and functions, and the golden rules that keep queries fast.