Deepwatch

Deepwatch is a US managed security services provider delivering AI-native managed detection and response (MDR) governed by human security experts. Its Guardian platform and Security Center console aggregate and correlate telemetry from a customer's existing SIEM, EDR, cloud, identity, network and vulnerability tooling — Splunk, CrowdStrike Falcon Next-Gen SIEM, Microsoft Sentinel, Google SecOps, SentinelOne, Microsoft Defender, Carbon Black, Okta, Entra ID, Tenable, Qualys, Wiz, Palo Alto and Fortinet among them — rather than requiring a rip-and-replace. Services span MDR, managed endpoint detection and response, continuous threat exposure management, vulnerability management, managed firewall, dark web monitoring and active response, with the NEXA agentic-AI ecosystem layered across detection, investigation and response. Deepwatch publishes contractual service-level commitments (99.9% platform uptime, 10-minute critical MTTD), a SafeBase trust center and an llms.txt, but exposes no public API documentation: the customer-facing surface is an authenticated GraphQL API behind the Security Center console.

Deepwatch publishes 1 API on the APIs.io network. Tagged areas include Company, Cybersecurity, Managed Detection and Response, Security Operations, and Threat Intelligence.

Deepwatch’s developer surface includes engineering blog, support, authentication, and 21 more developer resources.

🌐 Visit website 📡 Source on GitHub
27.8/100 emerging ▬ flat Agent 13/100 agent aware Full breakdown ↓
scored 2026-08-05 · rubric v0.9.1
1 APIs
CompanyCybersecurityManaged Detection and ResponseSecurity OperationsThreat IntelligenceVulnerability ManagementManaged Security ServicesAgentic AI

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-05 · rubric v0.9.1
Composite quality — 27.8/100 · emerging
Contract Quality 0.0 / 25
Developer Ergonomics 3.5 / 20
Commercial Clarity 10.0 / 20
Operational Transparency 4.1 / 13
Governance 1.5 / 12
Discoverability 8.7 / 10
Agent readiness — 13/100 · agent aware
Machine-Readable Contract 0 / 18
Agentic Access Contract 0 / 10
MCP Server 0 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 0 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 4 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/deepwatch: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 1

Individual APIs this provider publishes, each with its own machine-readable definition.

Deepwatch Security Center API

The authenticated GraphQL API behind the Deepwatch Security Center console (devportal.deepwatch.com). The endpoint is an AWS AppSync GraphQL service at devportalapi.deepwatch.co...

Security Posture 4

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Deepwatch Authentication

openIdConnect/oauth2 · 2 schemes

SECURITY

Deepwatch Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Deepwatch Vulnerability Disclosure

Hackerone · contact published

SECURITY

Deepwatch Trust Center

SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023, PCI DSS

SECURITY

Scopes 1

OAuth scopes governing access to this provider's APIs.

Deepwatch Scopes

7 scopes · authorizationCode/implicit/deviceCode

7 scopes

SCOPES

Resources

Get Started 1

Portal, sign-up, and the first successful call

Login
Login

Agent Surfaces 2

MCP servers, agent skills, and machine-readable catalogs

LLMsTxt
LLMsTxt
 WellKnown
WellKnown

Design & Contract 3

Pagination, idempotency, versioning, errors, and events

Conventions
Conventions
 Conformance
Conformance
 Lifecycle
Lifecycle

Build 1

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization

Access & Security 7

Authentication, authorization, and security posture

TrustCenter
TrustCenter
 Compliance
Compliance
 Security
Security
 Authentication
Authentication
 OAuthScopes
OAuthScopes
 DomainSecurity
DomainSecurity
 VulnerabilityDisclosure
VulnerabilityDisclosure

Scroll for all 7

Operate 3

Status, limits, changes, and where to get help

Support
Support
 StatusPage
StatusPage
 SLA
SLA

Commercial 2

Pricing, plans, and the legal terms of use

TermsOfService
TermsOfService
 PrivacyPolicy
PrivacyPolicy

Company 4

The organization behind the API

Website
Website
 Blog
Blog
 BlogRSS
BlogRSS
 Partners
Partners

Other 1

Properties that don't map to a standard resource type

OpenIDConnect
OpenIDConnect

Source (apis.yml)

apis.yml Raw ↑ 
aid: deepwatch
name: Deepwatch
description: 'Deepwatch is a US managed security services provider delivering AI-native managed detection and response (MDR)
  governed by human security experts. Its Guardian platform and Security Center console aggregate and correlate telemetry
  from a customer''s existing SIEM, EDR, cloud, identity, network and vulnerability tooling — Splunk, CrowdStrike Falcon Next-Gen
  SIEM, Microsoft Sentinel, Google SecOps, SentinelOne, Microsoft Defender, Carbon Black, Okta, Entra ID, Tenable, Qualys,
  Wiz, Palo Alto and Fortinet among them — rather than requiring a rip-and-replace. Services span MDR, managed endpoint detection
  and response, continuous threat exposure management, vulnerability management, managed firewall, dark web monitoring and
  active response, with the NEXA agentic-AI ecosystem layered across detection, investigation and response. Deepwatch publishes
  contractual service-level commitments (99.9% platform uptime, 10-minute critical MTTD), a SafeBase trust center and an llms.txt,
  but exposes no public API documentation: the customer-facing surface is an authenticated GraphQL API behind the Security
  Center console.'
url: https://raw.githubusercontent.com/api-evangelist/deepwatch/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
x-harvest-source-url: https://forgeglobal.com/deepwatch_stock/
x-tier: profiled
x-tier-reason: enrichment-pipeline
specificationVersion: '0.20'
created: '2026-08-01'
modified: '2026-08-01'
image: https://www.deepwatch.com/wp-content/uploads/cropped-DeepWatch-Guardian-Orange-192x192.png
tags:
- Company
- Cybersecurity
- Managed Detection and Response
- Security Operations
- Threat Intelligence
- Vulnerability Management
- Managed Security Services
- Agentic AI
apis:
- name: Deepwatch Security Center API
  description: 'The authenticated GraphQL API behind the Deepwatch Security Center console (devportal.deepwatch.com). The
    endpoint is an AWS AppSync GraphQL service at devportalapi.deepwatch.com/graphql/ with a realtime subscription channel
    advertised over wss://*.deepwatch.com/graphql/realtime. Deepwatch publishes no public schema, reference documentation
    or OpenAPI: anonymous introspection is refused by a WAF rule (HTTP 403 WAFForbiddenException) and access is gated behind
    Okta-brokered single sign-on. Recorded here as an evidenced, auth-gated contract surface, not a public API.'
  humanURL: https://devportal.deepwatch.com/
  baseURL: https://devportalapi.deepwatch.com/graphql/
  tags:
  - Security Operations
  - GraphQL
  - Managed Detection and Response
  properties:
  - type: Login
    url: https://login.deepwatch.com/
  - type: Authentication
    url: authentication/deepwatch-authentication.yml
  x-evidence:
    fetched: '2026-08-01'
    endpoint_discovered_in: https://devportal.deepwatch.com/main.js
    csp_realtime_channel: wss://*.deepwatch.com/graphql/realtime
    introspection_http_status: 403
    introspection_error: WAFForbiddenException
    access: authenticated
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: TrustCenter
  url: security/deepwatch-trust-center.yml
- type: Website
  url: https://www.deepwatch.com/
- type: Blog
  url: https://www.deepwatch.com/blog/
- type: BlogRSS
  url: https://www.deepwatch.com/feed/
- type: Support
  url: https://www.deepwatch.com/support/
- type: GitHubOrganization
  url: https://github.com/deepwatch
- type: Login
  url: https://login.deepwatch.com/
- type: TermsOfService
  url: https://legal.deepwatch.com/tscs-2025-2
- type: PrivacyPolicy
  url: https://www.deepwatch.com/privacy-policy/
- type: Compliance
  url: https://www.deepwatch.com/trust/
- type: Security
  url: https://www.deepwatch.com/trust/
- type: StatusPage
  url: https://status.deepwatch.com/
- type: SLA
  url: https://legal.deepwatch.com/sla-102025
- type: Partners
  url: https://www.deepwatch.com/technology-partners/
- type: LLMsTxt
  url: llms/deepwatch-llms.txt
- type: WellKnown
  url: well-known/deepwatch-well-known.yml
- type: OpenIDConnect
  url: well-known/deepwatch-openid-configuration.json
- type: Authentication
  url: authentication/deepwatch-authentication.yml
- type: OAuthScopes
  url: scopes/deepwatch-scopes.yml
- type: Conventions
  url: conventions/deepwatch-conventions.yml
- type: Conformance
  url: conformance/deepwatch-conformance.yml
- type: Lifecycle
  url: lifecycle/deepwatch-lifecycle.yml
- type: DomainSecurity
  url: security/deepwatch-domain-security.yml
- type: VulnerabilityDisclosure
  url: security/deepwatch-vulnerability-disclosure.yml
x-enrichment:
  date: '2026-08-01'
  status: enriched
  artifacts_added: 11
  pass: local-v1