Customer support SOP

Public OpenAPI usage

Use only documented public routes. Tenant production keys are issued after a commercial engagement — never from this page. Do not request or share credentials, environment files, admin APIs, or internal host details.

StatusContact support
  1. 1. Identify the host. CPA, CVA, and XDR are live at cpa / cva / xdr.defenailabs.com. Hub is defenailabs.com. Confirm the product the customer named.
  2. 2. Check public status first. Open /status or GET the platform-status / health URLs below. If the host is unreachable, collect the case on /contact. Do not guess internal IPs.
  3. 3. Authenticate only with customer-issued tokens. Public GETs need no key. Signup, SSO, and tenant APIs use the customer’s own workspace credentials. Support must never ask for admin API keys, database URLs, or .env values.
  4. 4. Call only public methods. Allowed examples:
    MethodURLPurpose
    GEThttps://defenailabs.com/api/healthHub liveness (status, no secrets)
    GEThttps://defenailabs.com/api/search?q=Public site search
    GEThttps://cpa.defenailabs.com/api/public/platform-statusCPA/CVA/XDR shared platform status
    GEThttps://cpa.defenailabs.com/api/public/pricing?product=cpaPublic CPA list prices
    GEThttps://cva.defenailabs.com/api/public/pricing?product=cvaPublic CVA list prices
    GEThttps://xdr.defenailabs.com/api/public/pricing?product=xdrPublic XDR list prices
    GEThttps://cpa.defenailabs.com/api/public/capability-maturityPublished capability honesty catalog
  5. 5. Rate limits and errors. Retry 429/5xx with backoff. Do not scrape authenticated consoles. Pricing JSON may include module catalogs; treat list prices as informational USD, not a contract.
  6. 6. Escalate. Product defects: tenant admin in the live console. Commercial: /contact. Security issues: vulnerability disclosure. Never paste logs that contain tokens, cookies, or PII into public tickets.

Out of scope for this SOP: /admin, CMS write APIs, license private keys, GVT360 tenant secrets, LLM operator residuals, and any unpublished OpenAPI. Tenant OpenAPI packs are delivered after engagement.