Todyl

aid: todyl
name: Todyl
description: Todyl is a Denver, Colorado cybersecurity company that sells a single-agent, cloud-native security platform to
  managed service providers, solution providers and internal IT teams. The Todyl Security Platform consolidates modules that
  are usually bought separately — SASE (Secure Access Service Edge, delivered over Todyl's Secure Global Network), Endpoint
  Security (EDR/NGAV), a cloud-native SIEM, MXDR (24x7 managed extended detection and response with a human SOC), GRC (governance,
  risk and compliance), and Security Automation playbooks — behind one agent and one multi-tenant portal. Todyl operates a
  live production REST API at https://api.todyl.com (path-versioned at /v1) that partners use to enumerate devices, deployment
  groups and billing data across their tenants, and it integrates with PSA/RMM tooling such as Autotask and ConnectWise. Access
  is authenticated with an External API token pair issued inside the Todyl portal; the API reference itself is published only
  in the customer-authenticated knowledge base, so no public OpenAPI, reference page or developer portal exists at the time
  of this profile.
accessModel:
  pricing: unknown
  onboarding: approval
  trial: false
  try_now: false
  public: false
  label: Requires approval
  confidence: medium
  probe_state: gated
  source:
  - plans
  - authentication
  - rate-limits
  - security
  generated: '2026-11-06'
  method: derived
image: https://cdn.prod.website-files.com/6961173a0b3c0ce2c689dccc/696157d64c5080ff6aff85a5_todyl-logo.svg
url: https://raw.githubusercontent.com/api-evangelist/todyl/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
x-tier: profiled
x-tier-reason: enrichment
specificationVersion: '0.20'
created: '2026-08-30'
modified: '2026-08-30'
tags:
- Company
- Cybersecurity
- Security
- Managed Service Providers
- SASE
- SIEM
- Endpoint Security
- Managed Detection and Response
- Governance Risk and Compliance
- Zero Trust
- Networking
apis:
- name: Todyl External API
  description: Todyl's External API is a path-versioned REST API served from https://api.todyl.com. Probing it unauthenticated
    returns Todyl's own JSON error envelope ({"error":{"code":"auth_missing_token","message":"Credentials missing or invalid.","request_id":"req_..."}}),
    and supplying the X-Todyl-Client-Id / X-Todyl-Access-Token header pair changes the code to auth_malformed_token, confirming
    those are the credential headers the service recognises. Tokens are minted in the Todyl portal under Account -> Developer
    APIs -> External API Tokens. Every path probed — including /openapi.json, /v1/openapi.json and /.well-known/* — answers
    401, so no machine-readable contract is reachable without credentials.
  humanURL: https://www.todyl.com/support
  baseURL: https://api.todyl.com
  tags:
  - Security
  - Devices
  - Billing
  properties:
  - type: Authentication
    url: authentication/todyl-authentication.yml
  - type: ErrorCatalog
    url: errors/todyl-error-codes.yml
  - type: RateLimits
    url: rate-limits/todyl-rate-limits.yml
  - type: Conventions
    url: conventions/todyl-conventions.yml
  - type: Lifecycle
    url: lifecycle/todyl-lifecycle.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: RateLimits
  url: rate-limits/todyl-rate-limits.yml
- type: DomainSecurity
  url: security/todyl-domain-security.yml
- type: Website
  url: https://www.todyl.com/
- type: Blog
  url: https://www.todyl.com/blog
- type: BlogRSS
  url: https://www.todyl.com/blog/rss.xml
- type: Support
  url: https://www.todyl.com/support
- type: StatusPage
  url: https://status.todyl.com
- type: Pricing
  url: https://www.todyl.com/request-pricing
- type: SignUp
  url: https://portal.todyl.com/session/login
- type: TermsOfService
  url: https://www.todyl.com/terms
- type: PrivacyPolicy
  url: https://www.todyl.com/privacy
- type: Compliance
  url: https://www.todyl.com/system-description
- type: GitHubOrganization
  url: https://github.com/todylcom
- type: LinkedIn
  url: https://www.linkedin.com/company/todyl
- type: Conformance
  url: conformance/todyl-conformance.yml
- type: LLMsTxt
  url: llms/todyl-llms.txt
- type: Plans
  url: plans/todyl-plans-pricing.yml
x-enrichment:
  date: '2026-08-30'
  status: minimal
  artifacts_added: 12
  pass: local-v1
x-coverage:
  state: gated
  reason: customer-only-docs
  detail: Todyl runs a live production REST API at api.todyl.com, but the host authenticates EVERY path — /openapi.json, /v1/openapi.json
    and /.well-known/* all return 401 auth_missing_token — and the API reference itself is published only inside the customer
    knowledge base at support.todyl.com, whose root serves a Next.js sign-in page marked noindex/nofollow, so an integrator
    cannot read the contract before buying.
  evidence:
  - url: https://api.todyl.com/openapi.json
    status: 401
  - url: https://api.todyl.com/v1/devices
    status: 401
  - url: https://support.todyl.com/
    status: 200
  - url: https://www.todyl.com/developers
    status: 404
  checked: '2026-08-30'