# Asynchronous job execution
Source: https://docs.sdx.altostrat.io/api-reference/developers/asynchronous-api/asynchronous-job-execution

sdx-api/openapi.json post /api/asynchronous/{router_id}
Queues a job to run scripts or config changes on the router without waiting for real-time response.



# Retrieve a list of jobs for a router
Source: https://docs.sdx.altostrat.io/api-reference/developers/asynchronous-api/retrieve-a-list-of-jobs-for-a-router

sdx-api/openapi.json get /api/routers/{router_id}/jobs
Fetch asynchronous job history or status for a specified router.



# Retrieve router faults
Source: https://docs.sdx.altostrat.io/api-reference/developers/health/retrieve-router-faults

sdx-api/openapi.json get /api/routers/{router_id}/faults
Gets the last 100 faults for the specified router, newest first.



# Retrieve router metrics
Source: https://docs.sdx.altostrat.io/api-reference/developers/health/retrieve-router-metrics

sdx-api/openapi.json get /api/routers/{router_id}/metrics
Provides uptime/downtime metrics for the past 24 hours based on heartbeats.



# Create a transient port forward
Source: https://docs.sdx.altostrat.io/api-reference/developers/port-forwards/create-a-transient-port-forward

sdx-api/openapi.json post /api/routers/{router_id}/transient-forwarding
Establish a temporary TCP forward over the management tunnel for behind-NAT access.



# Delete a transient port forward
Source: https://docs.sdx.altostrat.io/api-reference/developers/port-forwards/delete-a-transient-port-forward

sdx-api/openapi.json delete /api/routers/{router_id}/transient-forwarding/{id}
Revokes a port forward before it naturally expires.



# Retrieve a specific port forward
Source: https://docs.sdx.altostrat.io/api-reference/developers/port-forwards/retrieve-a-specific-port-forward

sdx-api/openapi.json get /api/routers/{router_id}/transient-forwarding/{id}
Returns the details for one transient port forward by ID.



# Retrieve active transient port forwards
Source: https://docs.sdx.altostrat.io/api-reference/developers/port-forwards/retrieve-active-transient-port-forwards

sdx-api/openapi.json get /api/routers/{router_id}/transient-forwarding
List all active port forwards for a given router.



# Retrieve a list of routers
Source: https://docs.sdx.altostrat.io/api-reference/developers/sites/retrieve-a-list-of-routers

sdx-api/openapi.json get /api/routers
Returns a list of MikroTik routers belonging to the team associated with the bearer token.



# Retrieve OEM information
Source: https://docs.sdx.altostrat.io/api-reference/developers/sites/retrieve-oem-information

sdx-api/openapi.json get /api/routers/{router_id}/oem
Provides manufacturer data (model, CPU, OS license, etc.) for a given router.



# Retrieve router metadata
Source: https://docs.sdx.altostrat.io/api-reference/developers/sites/retrieve-router-metadata

sdx-api/openapi.json get /api/routers/{router_id}/metadata
Gets freeform metadata (like name, timezone, banner, etc.) for a specific router.



# Synchronous MikroTik command execution
Source: https://docs.sdx.altostrat.io/api-reference/developers/synchronous-api/synchronous-mikrotik-command-execution

sdx-api/openapi.json post /api/synchronous/{router_id}
Real-time RouterOS commands for read or quick ops (not recommended for major config changes).



# Adopt a site via runbook token (RouterOS device handshake)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/device-adoption/adopt-a-site-via-runbook-token-routeros-device-handshake

sdx-api/spa/mikrotik.json post /adopt/{id}
Used by new devices to adopt themselves into the system, returning a script that installs scheduler, backups, etc. Uses `heartbeat` + `runbook` middleware. The {id} is a base62-encoded UUID token for the runbook/policy.



# Retrieve the initial bootstrap script
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/device-adoption/retrieve-the-initial-bootstrap-script

sdx-api/spa/mikrotik.json get /{id}
Displays the main bootstrap code for a new device. Typically includes logic for installing a future poll route, etc. Uses `bootstrap` + `runbook` middleware. The {id} is a base62-encoded runbook token.



# Send heartbeat from device
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/heartbeat/send-heartbeat-from-device

sdx-api/spa/mikrotik.json post /poll
Devices post heartbeat (status) data here. Subject to the `site-auth` middleware, which authenticates via Bearer token that decrypts to a Site model. This route is heavily used by MikroTik scripts.



# Count sites for multiple customers (internal)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/internal/count-sites-for-multiple-customers-internal

sdx-api/spa/mikrotik.json post /site/internal-count
Accepts an array of customer UUIDs and returns a site count grouping. For internal usage only.



# Fetch all sites (detailed) for a given customer (internal)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/internal/fetch-all-sites-detailed-for-a-given-customer-internal

sdx-api/spa/mikrotik.json get /site/internal/{customer_id}
Internal route to return all site data for a given customer in a non-minimal format. Protected by `internal` middleware.



# Fetch minimal site data for a given customer (internal)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/internal/fetch-minimal-site-data-for-a-given-customer-internal

sdx-api/spa/mikrotik.json get /site/internal/lite/{customer_id}
Returns only site IDs (and maybe minimal fields) for a given customer. Protected by `internal` middleware.



# List online sites (internal route)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/internal/list-online-sites-internal-route

sdx-api/spa/mikrotik.json get /site/internal/online
Returns a list of site IDs that have `has_pulse = 1`. For internal use, no customer scoping enforced here except the 'internal' usage may be missing or implied.



# Create a new job for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/job-management/create-a-new-job-for-a-site

sdx-api/spa/mikrotik.json post /site/{site}/job
Queues up a job (script) to run on the device. Requires `job:create` scope. The job is triggered whenever the device polls next.



# Delete a pending job
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/job-management/delete-a-pending-job

sdx-api/spa/mikrotik.json delete /site/{site}/job/{job}
Removes a job if it has not started yet. Requires `job:delete` scope. If job has started, returns error 429 or similar.



# List jobs for a given site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/job-management/list-jobs-for-a-given-site

sdx-api/spa/mikrotik.json get /site/{site}/job
Returns a site’s job queue. Excludes certain ephemeral jobs. Requires `job:view` scope.



# Show a job on a specific site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/job-management/show-a-job-on-a-specific-site

sdx-api/spa/mikrotik.json get /site/{site}/job/{job}
View a single job’s details. Requires `job:view` scope.



# Update a job status (done/fail/busy)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/job-management/update-a-job-status-donefailbusy

sdx-api/spa/mikrotik.json put /job/{job}
Typically called by devices to mark a job as started (busy), completed (done), or failed (fail). Only available via `notify` middleware for polling scripts.



# Get runbook details (bootstrap script info)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/runbook/get-runbook-details-bootstrap-script-info

sdx-api/spa/mikrotik.json get /runbook/{id}
Fetch details about a runbook/policy. Part of an internal or authenticated route. The ID is a simple UUID, not base62.



# Notify about scheduler deletion
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/scheduler/notify-about-scheduler-deletion

sdx-api/spa/mikrotik.json get /notify/delete
A GET route that the MikroTik device calls to notify that the bootstrap scheduler is being removed from the device. Under `delete` middleware. If a site was pending delete, this might finalize it.



# SFTP config fetch route
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/sftpbackup/sftp-config-fetch-route

sdx-api/spa/mikrotik.json get /servers/{siteId}/users/{username}/config
Used to handle SFTP credentials for backups. The `username` is typically the site’s ID; the `Password` header is checked by the controller.



# Delete a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/delete-a-site

sdx-api/spa/mikrotik.json delete /site/{site}
Triggers site deletion flow, which may queue jobs to remove from system, remove scheduler, etc. Requires `site:delete` scope.



# Get minimal version info for a single site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/get-minimal-version-info-for-a-single-site

sdx-api/spa/mikrotik.json get /site-version/{site}
Returns basic data about the site’s board model, software version, etc. Uses the model binding for {site}.



# List all sites
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/list-all-sites

sdx-api/spa/mikrotik.json get /site
Authenticated route returning a full site listing. Filters out sites with `delete_completed_at`. Requires scope `site:view`.



# List minimal site data for authenticated user
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/list-minimal-site-data-for-authenticated-user

sdx-api/spa/mikrotik.json get /site-minimal
Returns site ID, name, and `has_pulse`. Possibly cached for 60 minutes. Requires `site:view` scope.



# List recently accessed sites
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/list-recently-accessed-sites

sdx-api/spa/mikrotik.json get /site/recent
Returns up to 5 recent sites for the authenticated user. Filtered by ownership. Also uses heartbeat cache to determine last-seen info.



# Manually create a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/manually-create-a-site

sdx-api/spa/mikrotik.json post /site/manual/create
Bypasses the adopt flow, simply creating a site with the given ID, name, runbook, etc.  Used for manual input.  Possibly restricted or internal use only.



# Returns past 24h missed heartbeat data for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/returns-past-24h-missed-heartbeat-data-for-a-site

sdx-api/spa/mikrotik.json get /site/mikrotik-stats/{site}
Computes how many checkins were expected vs. actual in the last 24h, grouping by hour. Returns % missed and total downtime. Requires `site:view` scope.



# Show one site’s detail
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/show-one-site’s-detail

sdx-api/spa/mikrotik.json get /site/{site}
Returns extended site details with siteInfo, may also store the site in user’s recent sites. Requires `site:view`.



# Update site fields (name, lat/lng, address, etc.)
Source: https://docs.sdx.altostrat.io/api-reference/spa/async/site-management/update-site-fields-name-latlng-address-etc

sdx-api/spa/mikrotik.json patch /site/{site}
Allows partial updates to a site’s metadata. Requires `site:update`.



# List backups for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/backups/site-backups/list-backups-for-a-site

sdx-api/spa/backups.json get /{site}/
Retrieves an array of available RouterOS backups for the specified site. Requires `backup:view` scope.



# Request a new backup for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/backups/site-backups/request-a-new-backup-for-a-site

sdx-api/spa/backups.json post /{site}/
Enqueues a backup request for the specified site. Requires `backup:create` scope.



# Retrieve a specific backup file
Source: https://docs.sdx.altostrat.io/api-reference/spa/backups/site-backups/retrieve-a-specific-backup-file

sdx-api/spa/backups.json get /{site}/{file}
Shows the contents of the specified backup file. By default returns JSON with parsed metadata. If header `X-Download` is set, it downloads raw data. If `x-highlight` is set, highlights syntax. If `x-view` is set, returns raw text in `text/plain`. Requires `backup:view` scope.



# Retrieve subnets from latest backup
Source: https://docs.sdx.altostrat.io/api-reference/spa/backups/site-backups/retrieve-subnets-from-latest-backup

sdx-api/spa/backups.json get /{site}/subnets
Parses the most recent backup for the specified site, returning discovered local subnets. Requires `backup:view` scope.



# Show diff between two backup files
Source: https://docs.sdx.altostrat.io/api-reference/spa/backups/site-backups/show-diff-between-two-backup-files

sdx-api/spa/backups.json get /{site}/{from}/{to}
Returns a unified diff between two backup files. By default returns the diff as `text/plain`. If `X-Download` header is set, you can download it as a file. If `x-highlight` is set, it highlights the diff in a textual format. Requires `backup:view` scope.



# Attach a BGP Policy to a Site
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/attach-a-bgp-policy-to-a-site

sdx-api/spa/bgp-dns-filter.json post /bgp/{site_id}



# Create a new BGP feed policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/create-a-new-bgp-feed-policy

sdx-api/spa/bgp-dns-filter.json post /bgp/policy



# Delete a BGP feed policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/delete-a-bgp-feed-policy

sdx-api/spa/bgp-dns-filter.json delete /bgp/policy/{id}



# Detach BGP Policy from a Site
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/detach-bgp-policy-from-a-site

sdx-api/spa/bgp-dns-filter.json delete /bgp/{site_id}



# Get BGP-based service counts
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/get-bgp-based-service-counts

sdx-api/spa/bgp-dns-filter.json get /bgp/service-counts



# List all BGP feed policies
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/list-all-bgp-feed-policies

sdx-api/spa/bgp-dns-filter.json get /bgp/policy



# List available IP lists for BGP feed
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/list-available-ip-lists-for-bgp-feed

sdx-api/spa/bgp-dns-filter.json get /bgp/category



# Retrieve a BGP feed policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/retrieve-a-bgp-feed-policy

sdx-api/spa/bgp-dns-filter.json get /bgp/policy/{id}



# Update a BGP feed policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/bgp/update-a-bgp-feed-policy

sdx-api/spa/bgp-dns-filter.json put /bgp/policy/{id}



# List all safe-search configuration entries
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/categories/list-all-safe-search-configuration-entries

sdx-api/spa/bgp-dns-filter.json get /category/safe_search



# List categories (and top applications)
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/categories/list-categories-and-top-applications

sdx-api/spa/bgp-dns-filter.json get /category



# Get aggregated service usage for all customers
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/misc/get-aggregated-service-usage-for-all-customers

sdx-api/spa/bgp-dns-filter.json get /all-customer-services



# Get service usage for a single customer
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/misc/get-service-usage-for-a-single-customer

sdx-api/spa/bgp-dns-filter.json get /customer-services/{customer_id}



# Retrieve all blackhole IP addresses for BGP blackholes
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/misc/retrieve-all-blackhole-ip-addresses-for-bgp-blackholes

sdx-api/spa/bgp-dns-filter.json get /dnr-blackhole-ips



# Retrieve all blackhole IP addresses for known applications
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/misc/retrieve-all-blackhole-ip-addresses-for-known-applications

sdx-api/spa/bgp-dns-filter.json get /blackhole-ips



# Create a new DNS policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/policies/create-a-new-dns-policy

sdx-api/spa/bgp-dns-filter.json post /policy



# Delete an existing DNS policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/policies/delete-an-existing-dns-policy

sdx-api/spa/bgp-dns-filter.json delete /policy/{id}



# List all DNS content-filtering policies
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/policies/list-all-dns-content-filtering-policies

sdx-api/spa/bgp-dns-filter.json get /policy



# Retrieve a specific DNS policy by ID
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/policies/retrieve-a-specific-dns-policy-by-id

sdx-api/spa/bgp-dns-filter.json get /policy/{id}



# Update an existing DNS policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/policies/update-an-existing-dns-policy

sdx-api/spa/bgp-dns-filter.json put /policy/{id}



# Attach a DNS Policy to a Site
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/tunnels/attach-a-dns-policy-to-a-site

sdx-api/spa/bgp-dns-filter.json post /dns/{site_id}



# Detach DNS Policy from a Site
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/tunnels/detach-dns-policy-from-a-site

sdx-api/spa/bgp-dns-filter.json delete /dns/{site_id}



# Get DNS-based service counts
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/tunnels/get-dns-based-service-counts

sdx-api/spa/bgp-dns-filter.json get /service-counts



# List all tunnels
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/tunnels/list-all-tunnels

sdx-api/spa/bgp-dns-filter.json get /tunnel



# Retrieve a specific tunnel by ID
Source: https://docs.sdx.altostrat.io/api-reference/spa/bgp-dns-filter/tunnels/retrieve-a-specific-tunnel-by-id

sdx-api/spa/bgp-dns-filter.json get /tunnel/{id}



# Create a new Auth Integration
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/create-a-new-auth-integration

sdx-api/spa/captive-portal.json post /auth-integrations



# Delete a specific Auth Integration
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/delete-a-specific-auth-integration

sdx-api/spa/captive-portal.json delete /auth-integrations/{auth_integration}



# List all IDP Integrations
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/list-all-idp-integrations

sdx-api/spa/captive-portal.json get /auth-integrations



# Partially update a specific Auth Integration
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/partially-update-a-specific-auth-integration

sdx-api/spa/captive-portal.json patch /auth-integrations/{auth_integration}



# Replace a specific Auth Integration
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/replace-a-specific-auth-integration

sdx-api/spa/captive-portal.json put /auth-integrations/{auth_integration}



# Retrieve a specific Auth Integration
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/idp-integrations/retrieve-a-specific-auth-integration

sdx-api/spa/captive-portal.json get /auth-integrations/{auth_integration}



# Create a new captive portal Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/create-a-new-captive-portal-instance

sdx-api/spa/captive-portal.json post /instances



# Delete a specific captive portal Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/delete-a-specific-captive-portal-instance

sdx-api/spa/captive-portal.json delete /instances/{instance}



# List all captive portal Instances
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/list-all-captive-portal-instances

sdx-api/spa/captive-portal.json get /instances



# Partially update a specific captive portal Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/partially-update-a-specific-captive-portal-instance

sdx-api/spa/captive-portal.json patch /instances/{instance}



# Replace a specific captive portal Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/replace-a-specific-captive-portal-instance

sdx-api/spa/captive-portal.json put /instances/{instance}



# Retrieve a specific captive portal Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/retrieve-a-specific-captive-portal-instance

sdx-api/spa/captive-portal.json get /instances/{instance}



# Upload an image (logo or icon) for a specific Instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/instances/upload-an-image-logo-or-icon-for-a-specific-instance

sdx-api/spa/captive-portal.json post /instances/{instance}/images/{type}



# Create a new walled garden entry for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/create-a-new-walled-garden-entry-for-a-site

sdx-api/spa/captive-portal.json post /walled-garden/{site}



# Delete a specific walled garden entry under a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/delete-a-specific-walled-garden-entry-under-a-site

sdx-api/spa/captive-portal.json delete /walled-garden/{site}/{walledGarden}



# List all walled garden entries for a specific site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/list-all-walled-garden-entries-for-a-specific-site

sdx-api/spa/captive-portal.json get /walled-garden/{site}



# Partially update a specific walled garden entry under a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/partially-update-a-specific-walled-garden-entry-under-a-site

sdx-api/spa/captive-portal.json patch /walled-garden/{site}/{walledGarden}



# Replace a specific walled garden entry under a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/replace-a-specific-walled-garden-entry-under-a-site

sdx-api/spa/captive-portal.json put /walled-garden/{site}/{walledGarden}



# Retrieve a specific walled garden entry under a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/captive-portal/walled-garden/retrieve-a-specific-walled-garden-entry-under-a-site

sdx-api/spa/captive-portal.json get /walled-garden/{site}/{walledGarden}



# Server check-in for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/checkin/server-check-in-for-a-site

sdx-api/spa/control-plane.json post /site-checkin
Called by a server to claim or update itself as the active server for a particular site (via the tunnel username).



# Create (rotate) new credentials
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/credentials/create-rotate-new-credentials

sdx-api/spa/control-plane.json post /{site}/credentials
Generates a new username/password pair for the site, deletes any older credentials. Requires `apicredentials:create` scope.



# List site API credentials
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/credentials/list-site-api-credentials

sdx-api/spa/control-plane.json get /{site}/credentials
Returns the API credentials used to connect to a site. Requires `apicredentials:view` scope.



# (Internal) Fetch management IPs for multiple sites
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/internal/internal-fetch-management-ips-for-multiple-sites

sdx-api/spa/control-plane.json post /internal/management-ips
Given an array of site IDs, returns a map of site_id => management IP (tunnel IP).



# (Internal) Get site credentials
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/internal/internal-get-site-credentials

sdx-api/spa/control-plane.json get /{site}/internal-credentials
Returns the latest credentials for the specified site, typically used by internal services. Not user-facing.



# Assign sites to a policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/assign-sites-to-a-policy

sdx-api/spa/control-plane.json post /policies/{id}/sites
Sets or moves multiple site IDs onto the given policy. Requires `cpf:create` or `cpf:update` scope.



# Create a policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/create-a-policy

sdx-api/spa/control-plane.json post /policies
Creates a new policy for the authenticated user. Requires `cpf:create` scope.



# Delete a policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/delete-a-policy

sdx-api/spa/control-plane.json delete /policies/{id}
Removes a policy if it is not the default policy. Sites that used this policy get moved to the default policy. Requires `cpf:delete` scope.



# List policies
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/list-policies

sdx-api/spa/control-plane.json get /policies
Retrieves all policies for the authenticated user.  Requires `cpf:view` scope.



# Show a single policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/show-a-single-policy

sdx-api/spa/control-plane.json get /policies/{id}
Retrieves details of the specified policy, including related sites. Requires `cpf:view` scope.



# Update a policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/update-a-policy

sdx-api/spa/control-plane.json put /policies/{id}
Update the specified policy. Sites not in the request may revert to a default policy.  Requires `cpf:update` scope.



# Validate a policy
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/policies/validate-a-policy

sdx-api/spa/control-plane.json get /policy-validate/{policy}
Check basic policy details to ensure it's valid.



# Execute commands on a site (internal sync)
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/router-commands/execute-commands-on-a-site-internal-sync

sdx-api/spa/control-plane.json post /{site}/sync/execute
Sends an execution script or command to the management server for the site. Similar to /sync but specifically for custom script execution.



# Print or run commands on a site (internal sync)
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/router-commands/print-or-run-commands-on-a-site-internal-sync

sdx-api/spa/control-plane.json post /{site}/sync
Send an API command to the management server to print or list resources on the router, or run a custom command.



# Re-send bootstrap scheduler script
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/scheduler/re-send-bootstrap-scheduler-script

sdx-api/spa/control-plane.json post /{site}/resend-scheduler
Forces re-sending of a scheduled script or runbook to the router. Often used if the script fails to be applied the first time.



# Check the management server assigned to a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/check-the-management-server-assigned-to-a-site

sdx-api/spa/control-plane.json get /{site}/management-server
Returns the IP/hostname of the server currently managing the site. Requires authentication.



# Create a new Site
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/create-a-new-site

sdx-api/spa/control-plane.json post /site/create
Creates a new site resource with the specified ID, policy, and other information.



# Create site for migration
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/create-site-for-migration

sdx-api/spa/control-plane.json post /site/create-for-migration
Creates a Site for system migrations, then runs additional background jobs (tunnel assignment, credentials creation, policy update).



# List all site IDs
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/list-all-site-ids

sdx-api/spa/control-plane.json get /site_ids
Returns minimal site data for every site in the system (ID and tunnel IP).



# List site IDs by Customer
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/list-site-ids-by-customer

sdx-api/spa/control-plane.json get /site_ids/{customerid}
Returns a minimal array of sites for a given customer, including the assigned tunnel IP if available.



# Perform a site action
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/perform-a-site-action

sdx-api/spa/control-plane.json post /{site}/action
Sends an SNS-based request to the router for various special actions (reboot, clear firewall, etc.).



# Retrieve site note
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/retrieve-site-note

sdx-api/spa/control-plane.json get /{site}/note
Fetch current note from an external metadata microservice. Requires authentication and site ownership.



# Set site note
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/sites/set-site-note

sdx-api/spa/control-plane.json post /{site}/note
Update or create site metadata with a 'note' field, stored in an external metadata microservice.



# Create a transient access for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-access/create-a-transient-access-for-a-site

sdx-api/spa/control-plane.json post /{site}/transient-accesses
Generates a temporary NAT access to Winbox/SSH. Requires `transientaccess:create` scope.



# List active transient accesses for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-access/list-active-transient-accesses-for-a-site

sdx-api/spa/control-plane.json get /{site}/transient-accesses
Returns all unexpired, unrevoked transient access records for the site. Requires `transientaccess:view` scope.



# Revoke a transient access
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-access/revoke-a-transient-access

sdx-api/spa/control-plane.json delete /{site}/transient-accesses/{id}
Marks it as expired/revoked and triggers config removal. Requires `transientaccess:delete` scope.



# Show one transient access
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-access/show-one-transient-access

sdx-api/spa/control-plane.json get /{site}/transient-accesses/{id}
Returns a single transient access record. Requires `transientaccess:view` scope.



# Create a transient port-forward
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-forward/create-a-transient-port-forward

sdx-api/spa/control-plane.json post /{site}/transient-forward
Creates a short-lived NAT forwarding rule to a destination IP/port behind the router.



# List site transient port forwards
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-forward/list-site-transient-port-forwards

sdx-api/spa/control-plane.json get /{site}/transient-forward
Returns all active NAT port-forwards for a site. Not access-limited, but presumably requires a certain scope.



# Revoke a transient port-forward
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-forward/revoke-a-transient-port-forward

sdx-api/spa/control-plane.json delete /{site}/transient-forward/{id}
Marks the port-forward as expired and removes the NAT rule from the management server.



# Show one transient port-forward
Source: https://docs.sdx.altostrat.io/api-reference/spa/cpf/transient-forward/show-one-transient-port-forward

sdx-api/spa/control-plane.json get /{site}/transient-forward/{id}
Returns details about a specific transient port-forward rule by ID.



# Create a new scan schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/create-a-new-scan-schedule

sdx-api/spa/cve-scans.json post /scheduled
Creates a new schedule for CVE scans on specified sites. Requires `cve:create` scope or similar.



# Delete a scan schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/delete-a-scan-schedule

sdx-api/spa/cve-scans.json delete /scheduled/{scanSchedule}
Requires `cve:delete` scope or similar.



# Get scan status for a schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/get-scan-status-for-a-schedule

sdx-api/spa/cve-scans.json get /{scanSchedule}/status
Returns partial data about the schedule's latest scan in progress or completed. Requires `cve:view` scope.



# List all scan schedules
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/list-all-scan-schedules

sdx-api/spa/cve-scans.json get /scheduled
Returns all the scan schedules belonging to the authenticated user. Requires `cve:view` scope or similar.



# Show details for a single scan schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/show-details-for-a-single-scan-schedule

sdx-api/spa/cve-scans.json get /scheduled/{scanSchedule}
Requires `cve:view` scope or similar.



# Start a scan for a schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/start-a-scan-for-a-schedule

sdx-api/spa/cve-scans.json get /scheduled/{scanSchedule}/invoke
Manually invokes a scan for this schedule. Sets schedule status to 'starting'. Requires `cve:update` or similar.



# Stop a scan for a schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/stop-a-scan-for-a-schedule

sdx-api/spa/cve-scans.json delete /scheduled/{scanSchedule}/invoke
Stops any active site scans for this schedule. Sets schedule status to 'stopping'. Requires `cve:update` or similar.



# Update a scan schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scan-schedules/update-a-scan-schedule

sdx-api/spa/cve-scans.json put /scheduled/{scanSchedule}
Requires `cve:update` scope or similar.



# List CVE Scans
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scans/list-cve-scans

sdx-api/spa/cve-scans.json get /
Lists all scans for the authenticated user. Requires `cve:view` scope.



# Show a single CVE scan
Source: https://docs.sdx.altostrat.io/api-reference/spa/cve/scans/show-a-single-cve-scan

sdx-api/spa/cve-scans.json get /{scan_id}
Returns details about the specified scan. Requires `cve:view` scope.



# Alias for listing recent or ongoing faults
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/alias-for-listing-recent-or-ongoing-faults

sdx-api/spa/faults.json get /
Identical to `GET /recent`. **Requires** `fault:view` scope.



# Generate a new short-lived fault token
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/generate-a-new-short-lived-fault-token

sdx-api/spa/faults.json post /token
Creates a token that can be used to retrieve unresolved or recently resolved faults without requiring ongoing authentication. **Requires** `fault:create` or possibly `fault:view` (depending on usage).



# List all faults for a given site ID
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/list-all-faults-for-a-given-site-id

sdx-api/spa/faults.json get /site/{site}
Returns all faults recorded for a particular site. **Requires** `fault:view` scope.



# List recent or ongoing faults
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/list-recent-or-ongoing-faults

sdx-api/spa/faults.json get /recent
**Requires** `fault:view` scope.

Returns a paginated list of faults filtered by query parameters, typically those unresolved or resolved within the last 10 minutes if `status=recent` is used. For more flexible filtering see query parameters below.



# List top 10 WAN faults in last 14 days
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/list-top-10-wan-faults-in-last-14-days

sdx-api/spa/faults.json get /top10wan
Retrieves the top 10 most active WAN tunnel (type=wantunnel) faults in the last 14 days. **Requires** `fault:view` scope.



# Retrieve currently active (unresolved) faults via internal token
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/retrieve-currently-active-unresolved-faults-via-internal-token

sdx-api/spa/faults.json post /fault/internal_active
Available only via internal API token. Expects `type` in the request body (e.g. `site` or `wantunnel`) and returns all unresolved faults of that type.



# Retrieve faults using short-lived token
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/retrieve-faults-using-short-lived-token

sdx-api/spa/faults.json get /fault/token/{token}
Retrieves a set of unresolved or recently resolved faults for the customer associated with the given short-lived token. No other authentication needed. **Public** endpoint, token-based.



# Retrieve internal fault timeline for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/faults/faults/retrieve-internal-fault-timeline-for-a-site

sdx-api/spa/faults.json post /fault/internal
Available only via internal API token (`internal` middleware). Typically used for analyzing fault timelines. Requires fields `start`, `end`, `type`, and `site_id` in the request body.



# Filter and retrieve log events
Source: https://docs.sdx.altostrat.io/api-reference/spa/logs/log-events/filter-and-retrieve-log-events

sdx-api/spa/logs.json post /{log_group_name}
Returns filtered log events from CloudWatch for the requested log group and streams. Requires `logs:view` scope.



# Global ARP search across user’s sites
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/arp/global-arp-search-across-user’s-sites

sdx-api/spa/metrics.json post /arps
Search ARP data across multiple sites belonging to the current user. Requires `inventory:view` scope.



# (Internal) ARP entries for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/arp/internal-arp-entries-for-a-site

sdx-api/spa/metrics.json get /internal/arp/{site}
Returns ARP data for the site, or 204 if none exist. No Bearer token needed, presumably uses internal token.



# List ARP entries for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/arp/list-arp-entries-for-a-site

sdx-api/spa/metrics.json post /arps/{site}
Lists ARP entries for the specified site with optional pagination. Requires `inventory:view` scope.



# Update an ARP entry
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/arp/update-an-arp-entry

sdx-api/spa/metrics.json put /arps/{site}/{arpEntry}
Allows updating group/alias for an ARP entry. Requires `inventory:update` scope.



# Get BGP usage/logs from last ~2 days
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/content/get-bgp-usagelogs-from-last-~2-days

sdx-api/spa/metrics.json get /bgp-report/{site}
Generates a BGP usage report for the site (TCP/UDP traffic captured). Possibly uses blackhole IP analysis. Requires `site` middleware.



# Get DNS usage/logs from last ~2 days
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/content/get-dns-usagelogs-from-last-~2-days

sdx-api/spa/metrics.json get /dns-report/{site}
Returns top categories, apps, source IPs from DNS logs. Possibly uses blackhole IP analysis. Requires `site` middleware.



# Get SNMP interface metrics
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/interfaces/get-snmp-interface-metrics

sdx-api/spa/metrics.json post /interfaces/{interface}/metrics
Returns detailed interface metric data within a specified date range. Requires `site` and `interface` resolution plus relevant scopes.



# (Internal) List site interfaces
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/interfaces/internal-list-site-interfaces

sdx-api/spa/metrics.json get /internal/interfaces/{site}
Same as /interfaces/{site}, but for internal use.



# (Internal) Summarized interface metrics
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/interfaces/internal-summarized-interface-metrics

sdx-api/spa/metrics.json post /internal/interfaces/{interface}/metrics
Calculates average and max in/out in MBps or similar for the date range. Possibly used by other microservices.



# List SNMP interfaces for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/interfaces/list-snmp-interfaces-for-a-site

sdx-api/spa/metrics.json get /interfaces/{site}
Returns all known SNMP interfaces on a site. Requires `site` middleware.



# Get 24h heartbeat or check-in data for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/mikrotikstats/get-24h-heartbeat-or-check-in-data-for-a-site

sdx-api/spa/metrics.json get /mikrotik-stats/{site}
Returns info about missed heartbeats from mikrotik checkins within the last 24 hours. Requires `site` middleware.



# Get last checkin time for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/mikrotikstats/get-last-checkin-time-for-a-site

sdx-api/spa/metrics.json get /last-seen/{site}
Returns how long ago the last MikrotikStats record was inserted. Requires `site` middleware.



# Get raw Mikrotik stats from the last 8 hours
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/mikrotikstats/get-raw-mikrotik-stats-from-the-last-8-hours

sdx-api/spa/metrics.json get /mikrotik-stats-all/{site}
Returns stats such as CPU load, memory for the last 8 hours. Requires `site` middleware.



# List syslog entries for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/syslog/list-syslog-entries-for-a-site

sdx-api/spa/metrics.json get /syslogs/{site}
Returns syslog data for a given site. Requires 'site' middleware and typically `inventory:view` scope or similar.



# Get ping stats for a WAN tunnel
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/get-ping-stats-for-a-wan-tunnel

sdx-api/spa/metrics.json post /wan-tunnels/{tunnel}/ping-stats
Retrieves a time-series of ping metrics for the specified WAN tunnel. Requires 'tunnel' middleware, plus date range input.



# Get tunnels ordered by average jitter or packet loss
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/get-tunnels-ordered-by-average-jitter-or-packet-loss

sdx-api/spa/metrics.json get /tunnel-order
Aggregates last 24h data from ping_stats and returns an array sorted by either 'mdev' or 'packet_loss'. Typically used to see worst/best tunnels. Requires user’s WAN data scope.



# (Internal) List WAN Tunnels for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/internal-list-wan-tunnels-for-a-site

sdx-api/spa/metrics.json get /wan-tunnels-int/{site}
Similar to /wan-tunnels/{site}, but does not require Bearer. Possibly uses an internal token or no auth. Returns 200 or 204 if no tunnels found.



# (Internal) Retrieve summarized ping stats for a tunnel
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/internal-retrieve-summarized-ping-stats-for-a-tunnel

sdx-api/spa/metrics.json post /wan-tunnels/{tunnel}/int-ping-stats
Given a site and tunnel, returns average or max stats in the date range. Possibly used by internal microservices.



# List WAN tunnels for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/list-wan-tunnels-for-a-site

sdx-api/spa/metrics.json get /wan-tunnels/{site}
Returns all WAN Tunnels associated with that site ID. Requires `site` middleware.



# Multi-tunnel or aggregated ping stats
Source: https://docs.sdx.altostrat.io/api-reference/spa/metrics/tunnels/multi-tunnel-or-aggregated-ping-stats

sdx-api/spa/metrics.json post /wan/ping-stats
Retrieves a chart-friendly data series for one or multiple tunnels. Possibly used by a front-end chart. This is a single endpoint returning timestamps and data arrays. Requires date range, optional tunnel list.



# Create a new notification group
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/create-a-new-notification-group

sdx-api/spa/notifications.json post /
Creates a group with name, schedule, topics, recipients, and sites. Requires `notification:create` scope.



# Delete a notification group
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/delete-a-notification-group

sdx-api/spa/notifications.json delete /{group}
Removes the group, its recipients, site relationships, and topic references. Requires `notification:delete` scope.



# Example Ably webhook endpoint
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/example-ably-webhook-endpoint

sdx-api/spa/notifications.json get /notifications/ably/hook
Used for testing. Returns request data. Does not require user scope.



# List all notification groups for the customer
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/list-all-notification-groups-for-the-customer

sdx-api/spa/notifications.json get /
Retrieves all groups belonging to the authenticated customer. Requires `notification:view` scope.



# Show a specific notification group
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/show-a-specific-notification-group

sdx-api/spa/notifications.json get /{group}
Retrieve the detail of one group by ID. Requires `notification:view` scope.



# Update a notification group
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/groups/update-a-notification-group

sdx-api/spa/notifications.json put /{group}
Update name, schedule, recipients, and other properties. Requires `notification:update` scope.



# List all topics
Source: https://docs.sdx.altostrat.io/api-reference/spa/notifications/topics/list-all-topics

sdx-api/spa/notifications.json get /topics
Returns all possible topics that can be attached to a notification group.



# Delete a generated SLA report
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-reports/delete-a-generated-sla-report

sdx-api/spa/reports.json delete /sla/reports/{id}
Deletes the JSON data object from S3 (and presumably the PDF). Requires `sla:run` scope.



# List generated SLA reports
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-reports/list-generated-sla-reports

sdx-api/spa/reports.json get /sla/reports
Lists recent SLA JSON results objects in S3 for the user. Requires `sla:run` scope to view generated reports.



# Create a new SLA schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/create-a-new-sla-schedule

sdx-api/spa/reports.json post /sla/schedules
Creates a new SLA report schedule object in DynamoDB and sets up CloudWatch event rules (daily/weekly/monthly). Requires `sla:create` scope.



# Delete an SLA schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/delete-an-sla-schedule

sdx-api/spa/reports.json delete /sla/schedules/{id}
Deletes a single SLA schedule from DynamoDB and removes CloudWatch events. Requires `sla:delete` scope.



# Get a single SLA schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/get-a-single-sla-schedule

sdx-api/spa/reports.json get /sla/schedules/{id}
Retrieves a single SLA schedule by UUID from DynamoDB. Requires `sla:view` scope.



# List all SLA schedules
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/list-all-sla-schedules

sdx-api/spa/reports.json get /sla/schedules
Fetches SLA reporting schedules from DynamoDB for the authenticated user. Requires `sla:view` scope.



# Manually run an SLA schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/manually-run-an-sla-schedule

sdx-api/spa/reports.json post /sla/schedules/{id}/run
Triggers a single SLA schedule to run now, with specified date range. Requires `sla:run` scope. This is done by posting `from_date` and `to_date` in the body.



# Update an SLA schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/reports/sla-schedules/update-an-sla-schedule

sdx-api/spa/reports.json put /sla/schedules/{id}
Updates a single SLA schedule and re-configures the CloudWatch event rule(s). Requires `sla:update` scope.



# Retrieve a specific schedule (internal)
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/internal/retrieve-a-specific-schedule-internal

sdx-api/spa/schedules.json get /internal/schedules/{schedule}
This route is for internal usage. It requires a special token in the
`X-Bearer-Token` header (or `Authorization: Bearer <token>`), validated
by the `internal` middleware.




# Create a new schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/schedules/create-a-new-schedule

sdx-api/spa/schedules.json post /schedules



# Delete an existing schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/schedules/delete-an-existing-schedule

sdx-api/spa/schedules.json delete /schedules/{schedule}



# List all schedules
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/schedules/list-all-schedules

sdx-api/spa/schedules.json get /schedules



# Retrieve a specific schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/schedules/retrieve-a-specific-schedule

sdx-api/spa/schedules.json get /schedules/{schedule}



# Update an existing schedule
Source: https://docs.sdx.altostrat.io/api-reference/spa/schedules/schedules/update-an-existing-schedule

sdx-api/spa/schedules.json put /schedules/{schedule}



# Generate RouterOS script via AI prompt
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/ai-generation/generate-routeros-script-via-ai-prompt

sdx-api/spa/scripts.json post /gen-ai
Calls an OpenAI model to produce a RouterOS script from the user’s prompt. Returns JSON with commands, error, destructive boolean, etc. Throttled to 5 requests/minute. Requires `script:create` scope.



# Create a new community script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/community-scripts/create-a-new-community-script

sdx-api/spa/scripts.json post /community-scripts
Registers a new script from a GitHub raw URL (.rsc) and optional .md readme URL. Automatically triggers background jobs to fetch code, parse README, and create an AI description.



# List community scripts
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/community-scripts/list-community-scripts

sdx-api/spa/scripts.json get /community-scripts
Returns a paginated list of community-contributed scripts with minimal info. No authentication scope is specifically enforced in code, but presumably behind `'auth'` or `'api'` guard.



# Raw readme.md content
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/community-scripts/raw-readmemd-content

sdx-api/spa/scripts.json get /community-scripts/{id}.md
Fetches README from GitHub and returns as text/plain, if `readme_url` is set.



# Raw .rsc content of a community script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/community-scripts/raw-rsc-content-of-a-community-script

sdx-api/spa/scripts.json get /community-scripts/{id}.rsc
Fetches the script content from GitHub and returns as text/plain.



# Show a single community script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/community-scripts/show-a-single-community-script

sdx-api/spa/scripts.json get /community-scripts/{id}
Provides script details including name, description, user info, repo info, etc.



# Authorize a scheduled script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/authorize-a-scheduled-script

sdx-api/spa/scripts.json put /scheduled/{scheduledScript}/authorize/{token}
Sets `authorized_at` if provided token matches `md5(id)`. Requires `script:authorize` scope. Fails if already authorized.



# Create a new scheduled script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/create-a-new-scheduled-script

sdx-api/spa/scripts.json post /scheduled
Requires `script:create` scope. Specifies a script body, description, launch time, plus sites and notifiable user IDs. Also sets whether backups should be made, etc.



# Delete or cancel a scheduled script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/delete-or-cancel-a-scheduled-script

sdx-api/spa/scripts.json delete /scheduled/{scheduledScript}
If script not authorized & not started, it's fully deleted. Otherwise sets `cancelled_at`. Requires `script:delete` scope.



# Immediately run the scheduled script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/immediately-run-the-scheduled-script

sdx-api/spa/scripts.json put /scheduled/{scheduledScript}/run
Requires the script to be authorized. Dispatches jobs to each site. Requires `script:run` scope.



# List all scheduled scripts
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/list-all-scheduled-scripts

sdx-api/spa/scripts.json get /scheduled
Lists scripts that are scheduled for execution. Requires `script:view` scope. Includes site relationships and outcome data.



# Request authorization (trigger notifications)
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/request-authorization-trigger-notifications

sdx-api/spa/scripts.json get /scheduled/{scheduledScript}/authorize
Sends a WhatsApp or other message to configured notifiables to authorize the script. Requires `script:update` scope.



# Run scheduled script test
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/run-scheduled-script-test

sdx-api/spa/scripts.json put /scheduled/{scheduledScript}/run-test
Sends the script to the configured `test_site_id` only. Requires `script:run` scope.



# Script execution progress
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/script-execution-progress

sdx-api/spa/scripts.json get /scheduled/{scheduledScript}/progress
Returns which sites are pending, which have completed, which have failed, etc. Requires `script:view` scope.



# Show a single scheduled script’s details
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/show-a-single-scheduled-script’s-details

sdx-api/spa/scripts.json get /scheduled/{scheduledScript}
Returns a single scheduled script with all relationships (sites, outcomes, notifications). Requires `script:view` scope.



# Update a scheduled script
Source: https://docs.sdx.altostrat.io/api-reference/spa/scripts/scheduled-scripts/update-a-scheduled-script

sdx-api/spa/scripts.json put /scheduled/{scheduledScript}
Edits a scheduled script’s fields, re-syncs sites and notifiables. Requires `script:update` scope.



# Create a new VPN instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/create-a-new-vpn-instance

sdx-api/spa/vpn.json post /instances
Provisions a new VPN instance, automatically deploying a server. Requires `vpn:create` scope.



# Delete a VPN instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/delete-a-vpn-instance

sdx-api/spa/vpn.json delete /instances/{instance}
Tears down the instance. Requires `vpn:delete` scope.



# Fetch bandwidth usage
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/fetch-bandwidth-usage

sdx-api/spa/vpn.json get /instances/{instance}/bandwidth
Returns the bandwidth usage metrics for the instance's primary server. Requires `vpn:view` scope.



# List all VPN instances
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/list-all-vpn-instances

sdx-api/spa/vpn.json get /instances
Returns a list of instances the authenticated user has created. Requires `vpn:view` scope.



# Show details for a single VPN instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/show-details-for-a-single-vpn-instance

sdx-api/spa/vpn.json get /instances/{instance}
Retrieves a single instance resource by its ID. Requires `vpn:view` scope.



# Update a VPN instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/instances/update-a-vpn-instance

sdx-api/spa/vpn.json put /instances/{instance}
Allows modifications to DNS, routes, firewall, etc. Requires `vpn:update` scope.



# Internal instance counts per customer
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/internal/internal-instance-counts-per-customer

sdx-api/spa/vpn.json post /vpn/internal/instance-counts
Used internally to retrieve aggregated peer or instance usage counts. Requires an internal token (not standard Bearer).



# Create a new peer on an instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/peers/create-a-new-peer-on-an-instance

sdx-api/spa/vpn.json post /instances/{instance}/peers
Adds a client peer or site peer to the instance. Requires `vpn:create` scope.



# Delete a peer
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/peers/delete-a-peer

sdx-api/spa/vpn.json delete /instances/{instance}/peers/{peer}
Removes a peer from the instance. Requires `vpn:delete` scope.



# List all peers under an instance
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/peers/list-all-peers-under-an-instance

sdx-api/spa/vpn.json get /instances/{instance}/peers
Lists all VPN peers (clients or site-peers) attached to the specified instance. Requires `vpn:view` scope.



# Show a single peer
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/peers/show-a-single-peer

sdx-api/spa/vpn.json get /instances/{instance}/peers/{peer}
Returns detail about a single peer for the given instance. Requires `vpn:view` scope.



# Update a peer
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/peers/update-a-peer

sdx-api/spa/vpn.json put /instances/{instance}/peers/{peer}
Update subnets, route-all, etc. Requires `vpn:update` scope.



# List available server regions
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/servers/list-available-server-regions

sdx-api/spa/vpn.json get /servers/regions
Retrieves a list of possible Vultr (or other provider) regions where a VPN instance can be deployed.



# Server build complete callback
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/servers/server-build-complete-callback

sdx-api/spa/vpn.json get /vpn/servers/{server}/heartbeat
Called by the server itself upon final provisioning. Signed route with short TTL. Updates IP, sets DNS records, etc.



# Get site subnets
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/sites/get-site-subnets

sdx-api/spa/vpn.json get /site/{id}/subnets
Retrieves potential subnets from the specified site (used for configuring a site-to-site VPN peer).



# Download WireGuard config as a QR code
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/vpn-client-tokens/download-wireguard-config-as-a-qr-code

sdx-api/spa/vpn.json get /vpn/instances/{instance}/peers/{peer}.svg
Returns the config in a QR code SVG. Signed route with short TTL. Requires the peer to be a client peer.



# Download WireGuard config file
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/vpn-client-tokens/download-wireguard-config-file

sdx-api/spa/vpn.json get /vpn/instances/{instance}/peers/{peer}.conf
Returns the raw WireGuard client config for a peer (type=client). Signed route with short TTL. Requires the peer to be a client peer.



# Retrieve ephemeral client config references
Source: https://docs.sdx.altostrat.io/api-reference/spa/vpn/vpn-client-tokens/retrieve-ephemeral-client-config-references

sdx-api/spa/vpn.json get /vpn/client
Uses a client token to retrieve a short-lived reference for WireGuard config or QR code download. The token is validated by custom client-token auth. Returns a JSON with config_file URL, QR code URL, etc.



# Create WAN failover for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/failover/create-wan-failover-for-a-site

sdx-api/spa/wan-failover.json post /{site_id}/failover
Sets up a new failover resource for the site if not already present, plus some default tunnels. Requires `wan:create` scope.



# Delete WAN failover
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/failover/delete-wan-failover

sdx-api/spa/wan-failover.json delete /{site_id}/failover/{id}
Deletes failover from DB, tears down related tunnels, and unsubscribes. Requires `wan:delete` scope.



# Get failover info for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/failover/get-failover-info-for-a-site

sdx-api/spa/wan-failover.json get /{site_id}/failover
Retrieves the failover record for a given site, if any. Requires `wan:view` scope.



# List failover services for current user
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/failover/list-failover-services-for-current-user

sdx-api/spa/wan-failover.json get /service-counts
Returns minimal array of failover objects (id, site_id) for user. Possibly used to see how many failovers they have.



# Set tunnel priorities for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/failover/set-tunnel-priorities-for-a-site

sdx-api/spa/wan-failover.json post /{site_id}/failover/priorities
Updates the `priority` field on each tunnel for this failover. Requires `wan:update` scope.



# Update tunnel gateway (router callback)
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/gateway/update-tunnel-gateway-router-callback

sdx-api/spa/wan-failover.json post /{site_id}/tunnel/{tunnel_id}/gateway
Allows a router script to update the gateway IP after DHCP/PPP changes. Typically uses X-Bearer-Token or similar, not standard BearerAuth. No standard scope enforced.



# List count of failovers per customer
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/services/list-count-of-failovers-per-customer

sdx-api/spa/wan-failover.json get /services_all
Returns an object mapping customer_id => count (how many site failovers).



# List site IDs for a customer (failover services)
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/services/list-site-ids-for-a-customer-failover-services

sdx-api/spa/wan-failover.json get /services/{customer_id}
Returns an array of site IDs that have failover records for the given customer.



# List tunnels for a site (unauth? or partial auth?)
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/services/list-tunnels-for-a-site-unauth?-or-partial-auth?

sdx-api/spa/wan-failover.json get /services/{site_id}/tunnels
Returns array of Tunnels for the given site if any exist. Possibly used by external or different auth flow.



# Create a new tunnel
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/create-a-new-tunnel

sdx-api/spa/wan-failover.json post /{site_id}/tunnel
Creates a new WAN tunnel record for the site. Requires `wan:create` scope.



# Delete a tunnel
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/delete-a-tunnel

sdx-api/spa/wan-failover.json delete /{site_id}/tunnel/{id}
Removes the tunnel from the DB and notifies system to remove config. Requires `wan:delete` scope.



# Detect eligible gateways for an interface
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/detect-eligible-gateways-for-an-interface

sdx-api/spa/wan-failover.json post /{site_id}/tunnel/gateways
Find potential gateway IP addresses for the given interface. Requires `wan:view` scope.



# Get router interfaces
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/get-router-interfaces

sdx-api/spa/wan-failover.json get /{site_id}/tunnel/interfaces
Lists valid router interfaces for a site. Possibly from router print. Requires `wan:view` scope.



# List all tunnels for current user
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/list-all-tunnels-for-current-user

sdx-api/spa/wan-failover.json get /tunnels
Returns all Tunnels for the authenticated user’s customer_id. Requires `wan:view` scope.



# List tunnels for a site
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/list-tunnels-for-a-site

sdx-api/spa/wan-failover.json get /{site_id}/tunnel
Returns all Tunnels associated with this site’s failover. Requires `wan:view` scope.



# Show a single tunnel
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/show-a-single-tunnel

sdx-api/spa/wan-failover.json get /{site_id}/tunnel/{id}
Returns details of the specified tunnel. Requires `wan:view` scope.



# Update tunnel properties
Source: https://docs.sdx.altostrat.io/api-reference/spa/wan-failover/tunnel/update-tunnel-properties

sdx-api/spa/wan-failover.json put /{site_id}/tunnel/{id}
Modifies name, gateway, interface, or SLA references on the tunnel. Requires `wan:update` scope.



# Test a Slack or MS Teams webhook
Source: https://docs.sdx.altostrat.io/api-reference/spa/webhooks/integrations/test-a-slack-or-ms-teams-webhook

sdx-api/spa/webhooks.json post /test
Sends a test message to the specified Slack or MS Teams webhook URL. **Requires** valid JWT authentication with appropriate scope (e.g., `webhook:test` or similar).



# Content Filtering
Source: https://docs.sdx.altostrat.io/core-concepts/content-filtering

Manage and restrict access to undesirable or harmful content across your network.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-light.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-dark.png" />
</Frame>

**Content Filtering** allows you to **block or restrict** websites and services based on categories (e.g., adult content, streaming media, social networking). This ensures your network stays aligned with your **Acceptable Use Policies**.

## Key Features

* **Category-Based Blocking**
  Block access to large groups of undesirable sites (e.g., adult content, illegal activities).
* **SafeSearch & Restricted Mode**
  Enforce Google SafeSearch, Bing SafeSearch, and YouTube Restricted Mode to filter out explicit material.
* **Filtering Avoidance Prevention**
  Prevent access to known proxy or anonymizer domains.
* **Detailed Traffic Statistics**
  Review logs and analytics to understand which categories or domains are being blocked.

***

## Creating a Content Filter Policy

<Steps>
  <Step title="Navigate to the Content Filter Policy Page">
    From your Altostrat **Dashboard**, go to <strong>Policies → Content Filtering</strong>. Click <strong>Add</strong> or <strong>+ New</strong> to start creating a new policy.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-dark.jpg" />
    </Frame>

    Click <strong>Add</strong> or <strong>+ New</strong> to start creating a new policy.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Configure the Policy Settings">
    Provide a <strong>Policy Name</strong> (e.g., "Block Adult & Streaming").

    * **Choose Categories**: Select categories of undesirable sites. You can expand or collapse category groups to pick sub-categories.
    * **SafeSearch Settings**: Enable SafeSearch for Google and Bing search engines, and set YouTube Restricted Mode.
    * **Custom Domains**: Manually allow or block specific domains (e.g., whitelist your corporate site or blacklist known proxies).

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Finalize & Apply the Policy">
    Click <strong>Save</strong> or <strong>Add</strong>. To apply it immediately:

    * Navigate to your <strong>Sites</strong>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-dark.jpg" />
    </Frame>

    * Select a site
    * Under <strong>Content Filter Policy</strong>, choose the newly created policy

    <Note>
      Allow a few moments for changes to propagate to the router. If the router is behind NAT, ensure the [Management VPN](/management/management-vpn) is configured correctly.
    </Note>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step3-dark.jpg" />
    </Frame>
  </Step>
</Steps>

***

## Editing a Content Filtering Policy

<Steps>
  <Step title="Open the Content Filter Policies Page">
    Navigate to <strong>Policies → Content Filtering</strong> in Altostrat.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Select the Policy">
    Click on the policy you want to edit to open its configuration pane.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Editing-CPF-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Editing-CPF-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Update Categories or Domains">
    Toggle categories on or off, adjust SafeSearch settings, or add/remove custom domains.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Editing-CPF-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Editing-CPF-Step3-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Save Changes">
    Changes will automatically propagate to any sites using this policy.
  </Step>
</Steps>

***

## Removing a Content Filtering Policy

<Warning>
  Deleting a policy removes its configuration from any sites that use it. These sites will revert to having no content filter or fall back to a default policy if one exists.
</Warning>

<Steps>
  <Step title="Navigate to Content Filtering">
    Under <strong>Policies → Content Filtering</strong>, locate the policy you want to remove.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Content-Filtering-Step1_1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Delete the Policy">
    Select the policy, then click the <strong>Trash</strong> or <strong>Remove</strong> icon. Confirm your decision in the dialog box.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Deleting-CPF-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Content-Filtering/Deleting-CPF-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

To **completely disable** Content Filtering on specific sites, either switch them to a different policy or remove their association with the feature entirely.

***

## Best Practices

* **Start Broad, Refine Gradually**: Begin by blocking major content categories, then fine-tune with exceptions as needed.
* **Regularly Review Logs**: Monitor which domains are being blocked or allowed, and adjust your policy accordingly.
* **Combine with Other Security**: Implement a comprehensive approach by enabling [Security Essentials](/core-concepts/security-essentials).
* **Educate Users**: Ensure employees and guests understand your Acceptable Use Policies to minimize confusion and resistance.


# Control Plane
Source: https://docs.sdx.altostrat.io/core-concepts/control-plane

Configure inbound management services (WinBox, SSH, API) and firewall rules at scale in Altostrat.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Control-Plane-Black.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Control-Plane-White.png" />
</Frame>

Altostrat's **Control Plane Policies** define how MikroTik devices handle inbound connections for critical management services such as **WinBox**, **SSH**, and **API**. By centralizing firewall rules and trusted networks, you ensure consistent security across all routers under a given policy.

## Default Policy

When you sign up, Altostrat automatically creates a **Default Control Plane Policy** for basic protection. This policy includes:

* **Trusted Networks** (e.g., private IP ranges like 10.x, 192.168.x)
* **WinBox**, **API**, and **SSH** enabled on default ports
* **Custom Input Rules** toggled on or off

<Note>
  The IP address `154.66.115.255/32` may be added by default as a trusted address for Altostrat's Management API.
</Note>

## Creating a Control Plane Policy

<Steps>
  <Step title="Navigate to Control Plane Policies">
    Under <strong>Policies</strong>, select <strong>Control Plane</strong>. You'll see a list of existing policies, including the default one.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-dark.jpg" />
    </Frame>

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Add a New Policy">
    Click <strong>+ Add Policy</strong>. Give your policy a descriptive name (e.g., "Strict Admin Access").

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Configure Trusted Networks">
    Add or remove IP addresses or CIDR ranges that you consider trusted. For example: <code>192.168.0.0/16</code>.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step3-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Toggle Custom Input Rules">
    Decide whether your MikroTik firewall input rules should take precedence. If set to <strong>ON</strong>, your custom rules will be applied first.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step4-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step4-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Enable/Disable Services">
    Under <strong>IP Services</strong>, specify ports for WinBox, SSH, and API. These services must remain <strong>enabled</strong> if you plan to manage devices via Altostrat's API.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step5-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step5-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Select Sites">
    Assign the policy to specific sites if desired. You can also assign it later. Click <strong>Add</strong> to finalize.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step6-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step6-dark.jpg" />
    </Frame>
  </Step>
</Steps>

## Editing a Control Plane Policy

<Steps>
  <Step title="Locate the Policy">
    Navigate to <strong>Policies → Control Plane</strong>. Click on the policy to open its settings.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Editing-Control-Plane-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Editing-Control-Plane-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Adjust Trusted Networks or Services">
    Add or remove CIDRs, toggle whether Custom Input Rules override Altostrat's default drop rules, and modify ports for WinBox, API, and SSH.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Editing-Control-Plane-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Editing-Control-Plane-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Apply Changes">
    Changes will propagate automatically to any sites using this policy. Allow a short period for routers to update.
  </Step>
</Steps>

## Removing a Control Plane Policy

<Warning>
  Deleting a policy from an active site may disrupt management access if no other policy is assigned.
</Warning>

<Steps>
  <Step title="Find the Policy">
    In <strong>Policies → Control Plane</strong>, locate the policy you wish to remove.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Creating-Control-Plane-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Delete the Policy">
    Click the <strong>Trash</strong> icon and confirm the action. If any routers depend on this policy for inbound admin services, assign them another policy first.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Deleting-Control-Plane-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Control-Plane/Deleting-Control-Plane-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

## Best Practices

* **Maintain Essential Services**: Keep WinBox, SSH, and API enabled if you plan to manage devices through Altostrat.
* **Limit Trusted Networks**: Restrict access to reduce exposure.
* **Regular Review**: Review and update policies as your network changes.
* **Security Layering**: Combine with [Security Essentials](/core-concepts/security-essentials) for a comprehensive security approach.


# Notification Groups
Source: https://docs.sdx.altostrat.io/core-concepts/notification-groups

Define groups of users, schedules, and alert types for more targeted notifications.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Notification-Group-Black.png" />

  <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Notification-Group-White.png" />
</Frame>

A **Notification Group** is a way to organize who receives alerts, **when** they receive them, and for **which events**. This helps ensure relevant teams get the notifications they need while avoiding unnecessary notifications for others.

## Setting Up a Notification Group

<Steps>
  <Step title="Access Notification Groups">
    Go to <strong>Notifications → Notification Groups</strong> in the Altostrat Portal.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Add a New Group">
    Click <strong>Add</strong> or <strong>+ New</strong> to create a new Notification Group. Provide a <strong>Group Name</strong>.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step2-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step2_2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step2_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Select Users or Roles">
    Choose who should receive alerts—either individual users or an entire role (e.g., "NOC Team"). Only selected users will receive notifications tied to this group.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step3-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step3-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Define a Business Hours Policy">
    If desired, link a policy specifying time windows for sending alerts (to reduce off-hours messages).

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step4-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step4-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Pick Notification Topics">
    Select which types of notifications are relevant (e.g., <em>Heartbeat Failures</em>, <em>Security Alerts</em>, <em>WAN Failover</em>).

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step5-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step5-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Assign to Sites (Optional)">
    If alerts should only apply to specific sites, limit them here. Otherwise, the group will cover all sites by default.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step6-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step6-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Save Group">
    Confirm your settings. The new group will now be active.
  </Step>
</Steps>

***

## Editing a Notification Group

<Steps>
  <Step title="Find the Group">
    Under <strong>Notifications → Notification Groups</strong>, locate the group you want to modify.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Change Settings">
    Adjust the group's name, add or remove users, modify the Business Hours Policy, or expand/restrict topics.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Auto-Save">
    Most changes save automatically. Users may need to log out and log back in to see updates in some cases.
  </Step>
</Steps>

***

## Removing a Notification Group

<Warning>
  Deleting a group means its members will no longer receive those alerts. Ensure critical notifications are covered by another group if needed.
</Warning>

<Steps>
  <Step title="Open Notification Groups">
    In <strong>Notifications → Notification Groups</strong>, select the group to remove.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Creating-Notification-Group-Step1-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Editing-Notification-Group-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Delete">
    Click the <strong>Trash</strong> icon. Confirm your choice in the dialog.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Deleting-Notification-Group-Step2-light.jpg" />

      <img className="hidden dark:block" height="500" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notification-Group/Deleting-Notification-Group-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

If the group was tied to certain **Business Hours Policies** or **Alert Topics**, you might need to reassign them to another group to maintain coverage.

***

## Tips & Best Practices

* **Segment Based on Function**: Create separate groups for Security Teams, NOC Teams, Management, etc.
* **Use Business Hours Policies**: Reduce alert fatigue by only notifying off-hours for critical events.
* **Review Groups Regularly**: Ensure each group's membership and topics remain relevant.
* **Combine with Integrations**: Forward alerts to Slack or Microsoft Teams if needed—see [Integrations](/integrations/integrations-overview).


# Notifications
Source: https://docs.sdx.altostrat.io/core-concepts/notifications

Define, manage, and route alerts for important network events in Altostrat.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notifications/Notifications-Black.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Notifications/Notifications-White.png" />
</Frame>

Altostrat **Notifications** keep you informed about key events—like **Network Outages**, **SLA Breaches**, and **Security Issues**—so you can react quickly. Customize notifications to ensure the right teams or individuals get the right alerts at the right time.

## Why Notifications Matter

* **Proactive Issue Management:**
  Address potential problems before they escalate into major outages.
* **Improved Network Uptime:**
  Quick response to alerts shortens downtime.
* **Enhanced Security:**
  Security-related notifications highlight suspicious activity, enabling quick risk mitigation.
* **Customizable:**
  Assign notifications to specific users or groups based on their roles.

## Notification Types

Here are common notifications sent by Altostrat:

| **Type**                | **Description**                                                                    |
| ----------------------- | ---------------------------------------------------------------------------------- |
| **SLA Reports**         | Alerts you when agreed Service Level Agreements (uptime, latency) aren't met       |
| **Heartbeat Failures**  | Informs administrators when a device stops sending health signals                  |
| **WAN Failover Events** | Indicates connectivity issues or automatic failover events that affect the network |
| **Security Alerts**     | Notifies you about malicious IP blocks, intrusion attempts, or suspicious traffic  |

***

## Setting Up Notifications

{/* <Steps>
    <Step title="Navigate to Notifications">
        From your Altostrat Dashboard, go to the <strong>Notifications</strong> section. This page displays an overview of existing notification rules.
    </Step>
    <Step title="Create or Edit a Notification Rule">
        Click <strong>Add</strong> or <strong>New Notification</strong> to create a rule. Define conditions such as <em>Fault Type</em>, <em>SLA Breach</em>, or <em>Security Trigger</em>.
    </Step>
    <Step title="Choose Recipients">
        Select specific users, roles, or <strong>Notification Groups</strong> who should receive these alerts. You can configure delivery methods including <em>Email</em> or <em>SMS</em> (subject to [Supported SMS Regions](/resources/supported-sms-regions)).
    </Step>
    <Step title="Save & Verify">
        Review and confirm the notification settings. If possible, test by simulating a trigger (e.g., forcing a Heartbeat Failure). Recipients should receive a test alert when everything is configured correctly.
    </Step>
  </Steps> */}

<Steps>
  <Step title="Guide">
    You can follow this guide in order to set up your notifications.

    [Setting Up Notitications](/core-concepts/notification-groups)
  </Step>
</Steps>

## Customizing Alerts

* **Business Hour Policies:** Receive notifications only during specified times
* **Targeted Alerts:** Direct SLA or Security notifications to relevant teams
* **Limit Redundancy:** Prevent notification fatigue by avoiding duplicate messages

***

## Best Practices

* **Review Regularly:** Ensure your notification settings align with current organizational needs
* **Use Notification Groups:** Organize recipients by function (e.g., NOC Team, Security Team)
* **Integrate with Other Tools:** Connect notifications with external services (e.g., Slack, Microsoft Teams) for streamlined workflows

If you experience issues or need to configure advanced behavior, consult the [Notification Groups](/core-concepts/notification-groups) page or review the [Orchestration Log](/management/orchestration-log) for troubleshooting assistance.


# Roles & Permissions
Source: https://docs.sdx.altostrat.io/core-concepts/roles-and-permissions

Control user access levels in Altostrat through roles, permissions, and fine-grained capabilities.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Role-Icon-black.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Role-Icon-white.png" />
</Frame>

Altostrat uses **Roles** to group **Permissions**, determining who can view, create, update, or delete resources in your organization.

## System Roles vs. Custom Roles

* **System Roles**: Predefined roles (e.g., Administrator) with typical permissions
* **Custom Roles**: User-defined roles with precise permission settings for advanced control

## Permissions Overview

Permissions are grouped by category (Teams, Sites, Security, etc.). When assigned to a role, any user with that role inherits these capabilities.

Here's a detailed look at key permission categories:

<AccordionGroup>
  <Accordion title="Teams Permissions">
    | **Permission**     | **Explanation**                  |
    | ------------------ | -------------------------------- |
    | Teams View         | View team-related information    |
    | Teams Create       | Create new teams                 |
    | Teams Update       | Update existing team information |
    | Teams Delete       | Delete teams                     |
    | Teams Invite Users | Invite other users to a team     |
    | Teams Remove Users | Remove users from a team         |
  </Accordion>

  <Accordion title="Sites Permissions">
    | **Permission** | **Explanation**                          |
    | -------------- | ---------------------------------------- |
    | Site View      | View site-related information            |
    | Site Create    | Create new sites                         |
    | Site Update    | Update existing sites                    |
    | Site Delete    | Delete sites                             |
    | Site Action    | Perform actions on a site (e.g., reboot) |
  </Accordion>

  <Accordion title="Security Permissions">
    | **Permission**  | **Explanation**                                |
    | --------------- | ---------------------------------------------- |
    | Security View   | View security configurations and rules         |
    | Security Create | Create new security policies or configurations |
    | Security Update | Update existing security configurations        |
    | Security Delete | Delete security configurations                 |
  </Accordion>
</AccordionGroup>

> **Additional categories** include **WAN**, **Jobs**, **Notifications**, and more. Assign these permissions based on your organizational needs.

## Creating a Role

<Steps>
  <Step title="Open Roles & Permissions">
    Navigate to **Settings → Roles & Permissions** in the Altostrat Dashboard. You'll see a list of existing roles.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Add a New Role">
    Click **+ Add**. Enter a descriptive name (e.g., "NOC Ops") that reflects the role's responsibilities.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Choose Permissions">
    From the permissions list, select the appropriate checkboxes (e.g., `Teams View`, `Site View`, `Site Action`) for this role.

    {/* Images */}
  </Step>

  <Step title="Save">
    Click **Save** to create the role. It's now ready for user assignment.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step3-dark.jpg" />
    </Frame>
  </Step>
</Steps>

## Editing a Role

<Steps>
  <Step title="Select the Role">
    In **Roles & Permissions**, find and click the role name you want to modify.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Modify Permissions">
    Adjust permissions by selecting or deselecting checkboxes. For example, add site action permissions or remove security privileges as needed.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Save Changes">
    Click **Update ->** to apply your changes. All users with this role will receive the updated permissions. Users may need to refresh their page or log in again to see the changes.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step3-dark.jpg" />
    </Frame>
  </Step>
</Steps>

## Deleting a Role

<Warning>
  Deleting a role immediately revokes all associated permissions from users who have that role.
</Warning>

<Steps>
  <Step title="Locate the Role">
    Go to **Settings → Roles & Permissions** and find the role you want to delete.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Creating-Role-Step1-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Editing-Role-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Delete the Role">
    Click the menu icon (three dots) or trash icon next to the role name. Confirm the deletion. Ensure affected users have alternative roles assigned if they need to maintain certain permissions.

    <Note>
      You may need to scroll to the side of the page if there are roles with a lot of permissions.
    </Note>

    <Frame>
      <video autoPlay muted playsInline loop allowfullscreen className="block dark:hidden" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Deleting-Role-Step2-light.mp4" controls />

      <video autoPlay muted playsInline loop allowfullscreen className="hidden dark:block" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Roles-and-Permissions/Deleting-Role-Step2-dark.mp4" controls />
    </Frame>
  </Step>
</Steps>

## Best Practices

* **Start with System Roles**: Use predefined roles when first setting up your permissions structure
* **Create Custom Roles**: Develop specialized roles for specific teams (e.g., "Security Ops," "Support Agents")
* **Conduct Regular Audits**: Review and update role permissions to maintain security
* **Apply Least Privilege**: Grant only the minimum permissions necessary for users to perform their tasks


# Security Essentials
Source: https://docs.sdx.altostrat.io/core-concepts/security-essentials

Core security features in Altostrat, from blocking malicious traffic to proactive monitoring.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Security-Essentials-Black.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Security-Essentials-White.png" />
</Frame>

Altostrat's **Security Essentials** feature helps you block or restrict **malicious traffic** and **undesirable content**, improving overall **network resilience**.

## Key Features

* **Blocking Known Malicious IPs**
  Auto-updated lists of IPs associated with threats (e.g., botnets)
* **Intrusion Prevention**
  Detection and mitigation of suspicious traffic patterns
* **MikroTik Firewall Integration**
  Seamless interaction with MikroTik firewall rules to reduce attack surface
* **Logging & Alerts**
  Comprehensive monitoring of security events for rapid incident response

***

## Default Policy

When you first sign up, Altostrat creates a default **Security Essentials** policy. This policy includes critical block lists such as:

* **RFC 1918** IP Ranges
* **Team Cymru FullBogons**
* **FireHOL Level 1**
* **Emerging Threats Block IPs**

You can customize or replace this default policy at any time.

***

## Creating a Security Essentials Policy

<Steps>
  <Step title="Go to Security Essentials">
    Navigate to <strong>Policies → Security Essentials</strong> to view existing policies, including the default one.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Add a New Policy">
    Click <strong>Add</strong> or <strong>+ New</strong>. Enter a policy name (e.g., "High Security").

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Select Block Lists or Features">
    Choose from available lists such as <strong>Team Cymru FullBogons</strong>, <strong>Compromised IPs</strong>, and <strong>AlienVault OTX</strong>.
    Enable or disable features based on your security requirements.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step3-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Save and Apply">
    Confirm your policy changes:

    * Assign the policy to a site from the site's overview
    * The router will update automatically via the [Management VPN](/management/management-vpn)
  </Step>
</Steps>

***

## Editing a Security Essentials Policy

<Steps>
  <Step title="Open Security Essentials">
    Access the Altostrat portal and navigate to <strong>Policies → Security Essentials</strong>.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Pick a Policy to Edit">
    Select an existing policy. Toggle block lists on or off, or add new ones as needed.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Editing-Security-Policy-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Editing-Security-Policy-Step2-dark.jpg" />
    </Frame>

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Editing-Security-Policy-Step2_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Editing-Security-Policy-Step2_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Changes Propagate Automatically">
    Sites using this policy will receive updates after a brief synchronization period.
  </Step>
</Steps>

***

## Removing a Security Essentials Policy

<Warning>
  Removing a security policy from a site may expose it to threats if no alternative protection is in place.
</Warning>

<Steps>
  <Step title="Locate the Policy">
    Navigate to <strong>Policies → Security Essentials</strong> and find the policy you want to delete.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Creating-Security-Policy-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Delete">
    Click the <strong>Remove</strong> or <strong>Trash</strong> icon and confirm your choice.
    Sites using this policy will no longer enforce the associated block lists.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Removing-Security-Policy-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Security-Essentials/Removing-Security-Policy-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

***

## Best Practices

* **Monitor Logs**: Regularly check the [Orchestration Log](/management/orchestration-log) for security-related events or anomalies
* **Combine with Content Filtering**: Implement [Content Filtering](/core-concepts/content-filtering) to block unwanted website categories
* **Regularly Audit Policies**: Review your block lists and settings periodically as new threats emerge
* **Educate Users**: Maintain a strong **human** firewall to complement technical security measures


# Teams
Source: https://docs.sdx.altostrat.io/core-concepts/teams

Organize users into teams for resource ownership and collaboration in Altostrat.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Team-Light.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Team-Dark.png" />
</Frame>

## Introduction

In Altostrat, a **Team** is a structured group of users collaborating to manage devices, sites, and associated resources. Teams form the backbone of **resource ownership** and let you easily control **who** can see and change **what**.

### Resource Ownership

* **All resources** (like sites, policies, scripts) belong to a **team**.
* Only members of that team can interact with its resources (view, update, or delete), depending on their [Roles & Permissions](/core-concepts/roles-and-permissions).

### Collaboration

* Teams enable groups working on the **same projects** to share device access and policy controls.
* For instance, a **NoC Team** might manage daily operations, while a **Security Team** focuses on threat monitoring and policy enforcement.

### Flexibility

* A single user can join **multiple teams**, useful for large organizations with overlapping duties.
* Teams can also represent **departments**, **projects**, or **clients**.

## Creating a Team

1. **Navigate to Settings → Teams**
   From your Altostrat dashboard, select **Teams** to open the **Team Overview** page.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step1-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step1-dark.jpg" />
</Frame>

<br />

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Team-Overview-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Team-Overview-dark.jpg" />
</Frame>

2. **Click +New**

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step2-dark.jpg" />
</Frame>

3. Provide a **Team Name** that fits your business context (e.g., “NoC Team,” “Security,” or “Project X”), and then click on **Add ->**.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step3-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Creating-Team-Step3-dark.jpg" />
</Frame>

4. **Owner & Defaults**
   By default, the user creating the team is the owner and is automatically added to the team.
5. **Invite Additional Members** (optional)
   See [Users](/core-concepts/users) to learn how to add or invite people into this team.

## Editing a Team

1. **Select the Team**
   In **Team Overview**, click on the team you want to update.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Editing-Team-Step1-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Editing-Team-Step1-dark.jpg" />
</Frame>

2. **Update Team Info**
   Modify the **Team Name**, add or remove **members**, or adjust settings like the **Site Limit**.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Editing-Team-Step2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Editing-Team-Step2-dark.jpg" />
</Frame>

3. **Auto-Save**
   Changes typically save automatically, so no extra button is required.
4. **Check Roles**
   Members' capabilities also hinge on their [Roles & Permissions](/core-concepts/roles-and-permissions).

## Removing a Team

<Warning>
  Deleting a team also removes all resources owned by that team unless they are transferred elsewhere first.
</Warning>

1. **Open the Team**
   From the **Team Overview**, choose the team you wish to remove.
2. **Click the Trash Icon**;
   A confirmation dialog will appear.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Deleting-Team-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Deleting-Team-dark.jpg" />
</Frame>

3. **Confirm Deletion**

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Confirm-Deletion-Team-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Teams/Confirm-Deletion-Team-dark.jpg" />
</Frame>

If you're sure, proceed. The team and its resources will be deleted permanently.
Double-check that you've migrated any vital devices or sites to another team beforehand.


# Users
Source: https://docs.sdx.altostrat.io/core-concepts/users

Manage portal and notification users, and understand how resource access is granted in Altostrat.

## Introduction

Altostrat manages access to resources through **users** and **teams**. Each user has a profile that determines their **roles**, **notification preferences**, and **team membership**.

## Types of Users

| **Type**              | **Can Log In** | **Receives Notifications** | **Own Resources** |
| --------------------- | -------------: | -------------------------: | ----------------: |
| **Portal User**       |        **Yes** |                    **Yes** |           **Yes** |
| **Notification User** |         **No** |                    **Yes** |            **No** |

### Portal User

* Has an **Altostrat** account with a username/password (or SSO).
* Can log in, view and manage resources, and receive notifications.
* A portal user can also **own** resources if they belong to a team that holds resources.

### Notification User

* **Cannot log in** to Altostrat.
* Receives alerts (e.g., SLA breaches, network outages).
* Ideal for stakeholders who only need updates but don’t manage devices.

## Creating a User

There are two ways to create a user in Altostrat:

1. **User Self-Registration**

* The person goes to [https://auth.altostrat.app](https://auth.altostrat.app) and signs up.
* Once verified, they can join or create a team in your organization.
* See [User Registration](/getting-started/user-registration).

2. **Portal Admin Creates a User**

* An existing portal admin with the right [Roles & Permissions](/core-concepts/roles-and-permissions) can manually create a new user.
* This user can be assigned as either a **Portal User** or a **Notification User**.

## Granting Someone Access to Your Resources

Because **all resources are owned by a team**, you must add the user to the relevant team.

1. **Open Teams**
   Go to **Settings → Teams** and select the team that owns the resources.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step1-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step1-dark.jpg" />
</Frame>

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step1_2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step1_2-dark.jpg" />
</Frame>

2. **Invite or Add User**
   Use the **Invite** or **Add Member** button.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Granting-Access-Step2-dark.jpg" />
</Frame>

3. **Assign a Role**
   The role (with specific permissions) defines what this user can do within the team.

<Note>
  If the user doesn’t appear in the user list, make sure you have privileges to add new users and that the user has
  already [registered](/getting-started/user-registration) or has been created as a new portal user by an admin.
</Note>

## User Management Tasks

### Updating User Details

1. **Navigate to Users**
   From the **Settings** or **Team** page, locate the user.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1-dark.jpg" />
</Frame>

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1_2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1_2-dark.jpg" />
</Frame>

2. **Edit Profile**
   Update attributes like email, display name, or phone number for notifications.
3. **Roles & Permissions**
   If you have the correct role, you can alter the user’s assigned role.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step2-dark.jpg" />
</Frame>

### Deleting or Disabling a User

If a user no longer requires access or notifications:

1. **Locate the User**
   Under **Settings → Users** (or in a specific **Team**).

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Update-User-Step1-dark.jpg" />
</Frame>

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Delete-User-Step1_2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/core-concepts/Users/Delete-User-Step1_2-dark.jpg" />
</Frame>

2. **Delete or Disable**
   Confirm the action. If they have owned resources, you may need to reassign ownership first.

## Email & Phone Verification

To enhance security, Altostrat supports verification processes:

* **Email Verification**: Required for portal logins.
* **Phone Verification**: Can be used for SMS notifications. Must be in [Supported SMS Regions](/resources/supported-sms-regions).

## Best Practices

* **Keep Team Membership** Updated to ensure proper resource access.
* **Use Different Roles** to enforce the principle of least privilege.
* **Regularly Audit** users in your organization to ensure no unnecessary active accounts linger.

With a clear user strategy—combining **portal** and **notification** accounts, plus proper **team membership**—you’ll maintain a secure and efficient environment for everyone using Altostrat.


# Adding a Router
Source: https://docs.sdx.altostrat.io/getting-started/adding-a-router

Follow these steps to onboard your MikroTik router to the Altostrat portal.

## Introduction

Welcome to the guide on connecting your **MikroTik router** to the Altostrat portal. By following these steps, you'll quickly and securely integrate your device for centralized management.

{/*

  ## Video Guide (Optional)

  If you prefer a visual tutorial, watch this **placeholder video** explaining how to add your router.
  <iframe
    width="560"
    height="315"
    src="https://www.youtube.com/embed/placeholder"
    title="YouTube Router Setup Video"
    frameBorder="0"
    allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
    allowFullScreen
    style={{width: '100%', borderRadius: '0.5rem'}}
  ></iframe>
  */}

## Detailed Step-by-Step Guide

### Step 1: Access the Altostrat Portal

1. Log in at [https://sdx.altostrat.app](https://sdx.altostrat.app).
2. Navigate to **Sites** in the main menu.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step1_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step1_dark.jpg" />
</Frame>

### Step 2: Create or Select a Site

1. Click **+ Add** to begin the onboarding process.

{/* 2. Assign a **Site Name** and confirm basic settings. */}

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step2_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step2_dark.jpg" />
</Frame>

### Step 3: Express Deploy

1. On the site's overview page, click **Add Router** (or a similarly labeled button).
2. A pop-up or new page will appear, guiding you through **Express Deploy**.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step3_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step3_dark.jpg" />
</Frame>

### Step 4: View Control Plane Policy

1. Select a **Control Plane Policy** (Default or custom).

> If you only have a default **Control Planee Policy**, it will automatically take you to the next step.

2. A new pop up will open showing the settings for your **Control Plane Policy**

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step4_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step4_dark.jpg" />
</Frame>

> For more info on policies, see [Control Plane Docs](/core-concepts/control-plane).

### Step 5: Review and Accept Changes

1. Preview the router settings that will be applied (e.g., firewall rules, VPN configs).

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step5_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step5_dark.jpg" />
</Frame>

2. Click **Accept** if everything looks correct.

### Step 6: Copy the Bootstrap Command

1. A unique **Bootstrap Command** will be shown.
2. Copy this command to your clipboard.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step6_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step6_dark.jpg" />
</Frame>

### Step 7: Run the Command on Your MikroTik Device

1. Open **Winbox** or **SSH** into the MikroTik CLI.
2. Paste the **Bootstrap Command** and press **Enter**.
3. Wait a few moments for scripts to execute and finalize the onboarding.

{/* Images */}

<Frame>
  ![bootstrap command](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step7.jpg)
</Frame>

### Step 8: Confirm Router Visibility in Altostrat

1. Return to the **Sites** page in Altostrat.
2. Verify that your router is listed and showing **Online**.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step8_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/adding-a-router/getting_started_adding-a-router-step8_dark.jpg" />
</Frame>

If it's **offline** or not visible, verify internet connectivity, recheck the bootstrap command, or consult [Orchestration Logs](/management/orchestration-log).

You've now successfully added your MikroTik router to Altostrat and can begin monitoring or configuring it from the portal. If you need more advanced setup, explore additional docs like [WAN Failover](/management/wan-failover) or [Management VPN](/management/management-vpn).


# Captive Portal Setup
Source: https://docs.sdx.altostrat.io/getting-started/captive-portal-setup

Learn how to configure a Captive Portal instance and enable network-level authentication.

This document outlines the **fundamentals** and a **step-by-step guide** for setting up a Captive Portal in Altostrat. You'll also learn about **custom configurations** you can apply.

<Warning>
  Before proceeding, confirm you have an [IDP Instance](/integrations/identity-providers) configured if you plan to use **OAuth 2.0** authentication (e.g., Google, Microsoft Azure). Otherwise, you won't be able to authenticate users via third-party providers.
</Warning>

## Step 1: Navigate to the Captive Portal Page

1. From your **Dashboard**, select **Captive Portal** (or a similarly named menu option).
2. You'll see an **Overview** or **Get Started** button to create a new Captive Portal instance.
3. Click **Get Started** (or **+ Add**).

![Placeholder: Captive Portal Overview](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/captive-portal-overview-placeholder.jpg)

## Step 2: Create Your Captive Portal Instance

1. Provide a **Name** for the instance, e.g. “Guest Wi-Fi Portal.”
2. Set the **Authentication Strategy** (currently OAuth 2.0 only).
3. Pick the **Identity Provider** you previously configured, or click **+** to create a new one.
4. Click **Next** to confirm and move to customization.

<Note>
  If you haven't created an IDP yet, follow our [Identity Providers](/integrations/identity-providers) guide before continuing.
</Note>

### Captive Portal Customization

After initial setup, you'll be redirected to a **Customization** page where you can:

* **Branding**: Add logos, colors, and messaging.
* **Terms of Use**: Insert disclaimers or acceptable use policies for users to accept before accessing the network.
* **Redirects**: Control where users land post-authentication.
* **Voucher or Coupon Codes**: Issue time-limited or usage-limited codes for guests.

![Placeholder: Captive Portal Customization](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/captive-portal-customization-placeholder.jpg)

## Network Considerations

1. **Firewall Rules**
   Ensure your MikroTik's firewall permits traffic for the Captive Portal flow.
2. **DHCP & DNS**
   Confirm your router provides IP addresses and DNS resolution for guest clients.

## Step 3: Finalizing & Applying the Captive Portal

After you finish customizing:

1. Click **Add** or **Save** to finalize.
2. If your router is behind NAT, verify that the required ports are open or that the [Management VPN](/management/management-vpn) is set up for behind-NAT usage.

### Testing the Captive Portal

1. Connect a **test device** (phone, laptop, etc.) to your Wi-Fi or LAN.
2. When prompted by the Captive Portal, **log in** with the IDP you configured or a local account.
3. Confirm the **authentication** process succeeds, and you're able to browse the permitted network resources.

<Warning>
  For public or guest-facing portals, regularly monitor the captive portal logs to ensure usage is within acceptable limits.
</Warning>

If you run into issues or need advanced behavior (like custom login pages or deeper policy integration), consult additional docs on [Transient Access](/getting-started/transient-access) or [Security Essentials](/core-concepts/security-essentials).


# Initial Configuration
Source: https://docs.sdx.altostrat.io/getting-started/initial-configuration

Learn how to reset, connect, and update your MikroTik device before adding it to Altostrat.

This page walks you through the **initial setup** of your MikroTik device:

* Resetting and clearing existing configurations
* Establishing an Internet connection
* Upgrading to the latest firmware

## Setting up Your Router

<Steps>
  <Step title="Verify Your MikroTik Router Has Power">
    1. **Power On**
       Plug in your MikroTik router and wait 10 – 60 seconds for it to boot up.
    2. **Check Indicators**
       Confirm via LCD panel, LEDs, or beeps that the device is ready.
  </Step>

  <Step title="Physically Connect the Router">
    1. **Ethernet Cable**
       Connect an Ethernet cable from the MikroTik's <strong>ether1</strong> port to your upstream device (e.g., modem or switch).
    2. **Placeholder Image**

    {/* ![Placeholder: Ethernet Connection](../images/ethernet-connection-placeholder.jpg) */}

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/initial-configuration/Initial-Configuration-Step2.png" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/initial-configuration/Initial-Configuration-Step2.png" />
    </Frame>

    <Note>
      Should you need more info, you can refer to this official documentation from MikroTik:
      [https://help.mikrotik.com/docs/spaces/ROS/pages/328151/First+Time+Configuration](https://help.mikrotik.com/docs/spaces/ROS/pages/328151/First+Time+Configuration)
    </Note>
  </Step>

  <Step title="Reset to Factory Settings">
    Choose one of two methods:

    #### Option 1: Reset via LCD Panel

    1. On the front LCD panel, locate <strong>Factory Reset</strong> or equivalent.
    2. Enter the default PIN: <code>1234</code> (if you haven't changed it).

    <Note>
      The device reboots. Look for a displayed IP like <strong>192.168.88.1</strong> (additional IPs can be ignored).
    </Note>

    #### Option 2: Reset via Winbox

    1. Use the <strong>Winbox</strong> utility from [MikroTik docs](https://help.mikrotik.com/docs/display/ROS/WinBox).
    2. Under <strong>System → Reset Configuration</strong>, confirm to wipe the router back to factory defaults.
  </Step>

  <Step title="Establish Internet Access">
    Ensure the router can reach the internet:

    **Check for IP Address**

    * In Winbox, go to <strong>IP → DHCP Client</strong>.
    * If you see <em>ether1</em> with a valid IP (not <code>0.0.0.0</code>), skip to <strong>Confirm Internet Access</strong>.

    #### Get an IP via DHCP

    1. Click <strong>Add New</strong> in the DHCP Client window.
    2. Select <em>ether1</em> for <strong>Interface</strong>.
    3. Check <strong>Use Peer DNS</strong>.
    4. Click <strong>Apply</strong>, then <strong>OK</strong>.
    5. Verify a valid IP appears under <strong>IP Address</strong>.

    #### Confirm Internet Access

    Open a terminal in Winbox:

    ```bash
    ping altostrat.io
    ```

    If you see continuous pings, the router is online.
  </Step>

  <Step title="Update Firmware on MikroTik">
    1. In Winbox, go to <strong>System → Packages</strong>.
    2. Click <strong>Check for Updates</strong>.
    3. Choose <strong>stable</strong> from the <strong>Channel</strong> dropdown.
    4. Click <strong>Check for Updates</strong> again. Compare <em>Installed Version</em> to <em>Latest Version</em>.

    If different, click <strong>Download & Install</strong>.

    <Warning>
      The router reboots after installing firmware. Log back in and check <strong>Packages</strong> to confirm.
    </Warning>

    If an <strong>upgrade</strong> channel is available for a major version jump, select it and repeat the process.

    <Note>
      See MikroTik's <a href="https://help.mikrotik.com/docs/display/ROS/Upgrading+and+installation" target="_blank">official docs</a> for more details.
    </Note>
  </Step>
</Steps>

Your MikroTik router is now ready to connect with Altostrat.
Visit [Adding a Router](/getting-started/adding-a-router) to onboard the router to your Altostrat portal.


# Introduction
Source: https://docs.sdx.altostrat.io/getting-started/introduction

Welcome to Altostrat SDX—your unified platform for MikroTik management and more.

<Frame>
  <video autoPlay muted playsInline className="w-full aspect-video" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/introduction/SDX-Introduction.mp4" />
</Frame>

**Altostrat SDX** is a powerful platform designed for centralized **MikroTik device** configuration, monitoring, and automation. Whether you’re a small business or a large enterprise, Altostrat SDX helps you streamline network operations, improve uptime, and simplify user management.

## Key Benefits

* **Unified Dashboard**
  Manage all sites, devices, and security policies from a single interface.
* **Automated Workflows**
  Use orchestration logs, scripts, and scheduling for hands-free operations.
* **Zero Trust**
  Built-in features like Management VPN, Transient Access, and WAN Failover to reinforce network security.
* **Flexibility & Integrations**
  Tie Altostrat into popular communication (Slack, Teams) and IDP (Google, Azure) platforms.

## Getting Started

Below are a few essential steps to begin your journey with Altostrat SDX.

<CardGroup cols={2}>
  <Card title="Initial Configuration" icon="gear" href="/getting-started/initial-configuration">
    Learn how to reset, connect, and update your MikroTik before adding it to Altostrat.
  </Card>

  <Card title="User Registration" icon="user-plus" href="/getting-started/user-registration">
    Create a new Altostrat account or invite additional team members.
  </Card>
</CardGroup>

<CardGroup cols={2}>
  <Card title="Add Your First Router" icon="network-wired" href="/getting-started/adding-a-router">
    Securely onboard a MikroTik router and configure management basics.
  </Card>

  <Card title="Accessing Remotely" icon="door-open" href="/getting-started/remote-winbox-login">
    Use WinBox or Transient Access to reach devices behind NAT or in the cloud.
  </Card>
</CardGroup>

## Make It Yours

Once you have a basic setup, explore more advanced features to tailor Altostrat SDX to your exact needs.

<CardGroup cols={2}>
  <Card title="Content Filtering" icon="globe" href="/core-concepts/content-filtering">
    Restrict or allow specific categories of websites across your network.
  </Card>

  <Card title="Security Essentials" icon="shield-halved" href="/core-concepts/security-essentials">
    Block malicious IPs, enable intrusion detection, and automate firewall rules.
  </Card>

  <Card title="WAN Failover" icon="arrows-turn-to-dots" href="/management/wan-failover">
    Combine multiple internet links for high availability and quick failover.
  </Card>

  <Card title="Integrations" icon="puzzle-piece" href="/integrations/integrations-overview">
    Connect Slack, Teams, or external IDPs like Google or Azure for logins and alerts.
  </Card>
</CardGroup>

Enjoy managing your MikroTik devices with **Altostrat SDX**—the simplest way to keep your network secure, resilient, and easy to maintain.


# Remote WinBox Login
Source: https://docs.sdx.altostrat.io/getting-started/remote-winbox-login

How to securely access your MikroTik router using WinBox, even behind NAT.

This guide explains how to **securely access** your MikroTik router using **WinBox** through the **Management VPN**. Even if your router is behind a NAT firewall, you can establish on-demand access via **Transient Access** credentials.

## Introduction

When you add a MikroTik router to Altostrat, we automatically configure a secure tunnel called the [Management VPN](/management/management-vpn). This VPN enables enables you to create **temporary access** to the router—called **Transient Access**—by generating short-lived credentials for WinBox or SSH. Once they expire, these credentials are automatically revoked, keeping your device secure.

## Requirements

* Your MikroTik router must be **connected** to the Altostrat platform.
* You have **WinBox** installed on your computer.
* Both the **router** and your **computer** must have internet access.

## Step-by-Step Instructions

### 1. Log in to the Altostrat Portal

1. Visit [https://sdx.altostrat.app](https://sdx.altostrat.app) and sign in.
2. Locate **Sites** from the main menu.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step1_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step1_dark.jpg" />
</Frame>

### 2. Select a Site

1. From the **Sites** page, click on the **site** that contains the router you want to access.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step2_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step2_dark.jpg" />
</Frame>

2. Wait for the site overview to load.

### 3. Open Transient Access

1. Click on the **Transient Access** tab (or similarly labeled section).
2. You'll see any existing access sessions listed here.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step3_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step3_dark.jpg" />
</Frame>

### 4. Generate Transient Access Credentials

1. Click **Add** or **New** to generate fresh credentials.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step4_1_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step4_1_dark.jpg" />
</Frame>

2. Choose the **Access Type** (e.g., WinBox) and specify if full admin or read-only is needed.
3. Confirm or edit the **CIDR** or IP range from which you'll connect (defaults to your IP).
4. Set an **expiration** time (e.g., 2 hours).
5. Click **Add ->** to receive a username/password and endpoint.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step4_2_light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step4_2_dark.jpg" />
</Frame>

<Tip>
  Because these credentials expire and are unique, you can share them safely with authorized teammates.
</Tip>

### 5. Copy and Use the Credentials

1. Click **Copy** next to the credential block or manually copy the username/password and endpoint.
2. **Open WinBox** on your PC or Mac.
3. In the **Connect To** field, paste the **endpoint**.
4. Enter the **username** and **password** as displayed in the credentials menu.
5. Click **Connect**.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step5-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step5-dark.jpg" />
</Frame>

Once credentials are validated, WinBox will launch a direct session to your router through the Management VPN.

<Note>
  If you Click on the **Winbox** button next to the **Credentials** button and you have our application installed, the winbox session will automatically launch the Winbox utility.
</Note>

## Revoking Transient Access (Optional)

If you need to remove credentials before they expire:

1. Return to the site's **Transient Access** tab in the Altostrat portal.
2. Locate the session under **Active Credentials**.
3. Click **Revoke** to invalidate them immediately.

{/* Images */}

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step6-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/remote-winbox-login/remote-winbox-login-step6-dark.jpg" />
</Frame>

<Note>
  When revoked, the credentials no longer function, and the NAT session on the regional server is torn down.
</Note>

If you run into issues, check the [Orchestration Log](/management/orchestration-log) to diagnose connection attempts or errors.


# Transient Access
Source: https://docs.sdx.altostrat.io/getting-started/transient-access

Secure, on-demand credentials for MikroTik devices behind NAT firewalls.

<Frame>
  <img className="block dark:hidden" height="100" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/transient-access/timer-lock.png" />

  <img className="hidden dark:block" height="100" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/transient-access/timer-lock-white.png" />
</Frame>

**Transient Access** offers temporary, secure credentials to remotely manage your MikroTik devices via the [Management VPN](/management/management-vpn). Whether you need **WinBox** or **SSH** access, Altostrat issues time-limited logins that automatically expire, ensuring minimal exposure.

## Introduction

When you onboard a router into Altostrat, our system establishes a [Management VPN](/management/management-vpn). **Transient Access** leverages this VPN to grant short-lived credentials for direct router management.
By default, credentials last a few hours, but you can customize them for your use case.

## Key Features

* **Temporary Credentials**
  Each login is unique and auto-revokes upon expiration.
* **Reduced Attack Surface**
  No permanent open ports—transient sessions only exist as needed.
* **Easy Sharing**
  Admins can create credentials for a teammate or a vendor, limiting risk.

![Placeholder: Transient Access Overview](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/transient-access-overview-placeholder.jpg)

## How It Works

1. **Generate Credentials**
   From a site’s **Transient Access** tab, click **Add** to create new logins.
2. **Select Permissions**
   Choose whether users get full admin or read-only.
3. **Set Duration**
   Define how long the credentials remain valid (e.g., 2 hours).
4. **Distribute or Use**
   Copy the username, password, and endpoint into **WinBox** or an **SSH** client.

### Express Onboarding vs. Manual

* **Express**: Altostrat pre-configures your device for transient sessions automatically.
* **Manual**: If you prefer granular control, ensure the router’s firewall and NAT are set up for [Remote WinBox Login](/getting-started/remote-winbox-login) or [Captive Portal Setup](/getting-started/captive-portal-setup).

## Prerequisites

* A **MikroTik** router connected to Altostrat.
* **WinBox** or **SSH** client installed on your local machine.
* Sufficient privileges in the **Altostrat** portal to generate credentials.

## Creating Transient Access

1. **Open Altostrat Portal**
   Login at [https://sdx.altostrat.app](https://sdx.altostrat.app).
2. **Navigate to Sites**
   Select the **site** with the router you want to access.
3. **Transient Access Tab**
   Click **Transient Access** from the site’s overview.
4. **Add Credentials**
   Specify **Access Type** (WinBox or SSH), define **Access Duration**, and set an **IP whitelist** if necessary.
5. **Copy or Share**
   The generated username/password and endpoint can be shared or used immediately.

### Revoking Credentials

In the same tab, locate the **Active Sessions** list. Click **Revoke** next to any session to invalidate those credentials before their expiry.

<Warning>
  Revoking removes the session instantly. The user will lose router access if they’re still logged in.
</Warning>

## Best Practices

* **Short Durations**: Limit time frames to reduce risk.
* **Restricted IP Ranges**: If possible, specify which IP or CIDR can use these credentials.
* **Regularly Check**: Audit active sessions under **Transient Access** to ensure all are valid and necessary.

You can now create secure, time-bound sessions for behind-NAT MikroTik devices without permanently exposing your network. If you need further guidance, consult [Remote WinBox Login](/getting-started/remote-winbox-login) or check the [Management VPN](/management/management-vpn) page for deeper insights.


# User Registration
Source: https://docs.sdx.altostrat.io/getting-started/user-registration

How to create a new user account in Altostrat

<Note>
  If you already have an account and simply want to give someone else access, see [Granting Access to Your
  Resources](/core-concepts/users#granting-someone-access).
</Note>

## Registering as a New User

New users can register for an Altostrat account by visiting the **registration page** and following the on-screen instructions.

* **URL**: [https://auth.altostrat.app/authenticate/register](https://auth.altostrat.app/authenticate/register)
* **Password Policy**: Refer to the [Password Policy](/resources/password-policy) to ensure your chosen password meets the required criteria.

{/* Images */}

<Frame>
  <img className="block dark:hidden" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/user-registration/Register.png" />

  <img className="hidden dark:block" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/getting-started/user-registration/Register.png" />
</Frame>

### Email Verification

1. **Check Your Inbox**
   After registering, you’ll receive an automated email containing a verification link.
2. **Click the Verification Link**
   This confirms your email ownership. You won’t be able to continue until verification is complete.

<Tip>
  Be sure to check your spam or junk folder if you don’t see the verification email within a few minutes.
</Tip>

### Completing Registration

Once your email is verified:

1. **Login** at [https://auth.altostrat.app](https://auth.altostrat.app).
2. **Create or Join an Organization**

* If you’re the first user in your company, you’ll create a new organization.
* If your company already uses Altostrat, someone can invite you to join their existing team.

<Note>
  All resources in Altostrat belong to a team within an organization. Having at least one team is mandatory to manage
  resources like sites, devices, or policies.
</Note>

After you’ve logged in, visit the [Onboarding Docs](/getting-started/adding-a-router) to begin adding devices and configuring your environment.


# Google Cloud Integration
Source: https://docs.sdx.altostrat.io/integrations/google-cloud-integration

Connect Altostrat with Google Cloud for user authentication and secure OAuth 2.0 flows.

![Placeholder: Google Cloud Integration Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/google-cloud-integration-hero-placeholder.jpg)

Use **Google Cloud** as an **identity provider** for Altostrat, allowing users to authenticate with their Google account. This guide shows how to **create a Google Cloud Project**, enable **OAuth 2.0**, and integrate it with Altostrat.

## Prerequisites

* A **Google Cloud** account or existing project.
* Admin rights in **Altostrat** to configure integrations.

## Part 1: Google Cloud Setup

<Steps>
  <Step title="Create or Select a Google Cloud Project">
    1. Go to the [Google Cloud Console](https://console.cloud.google.com/).
    2. Click <strong>Select a Project</strong> or <strong>New Project</strong> if you need a fresh project.
    3. Name the project (e.g., “Altostrat Auth”) and confirm creation.
  </Step>

  <Step title="Enable OAuth Credentials">
    1. In the left-hand menu, choose <strong>APIs & Services → Credentials</strong>.
    2. Click <strong>+ Create Credentials</strong> → <strong>OAuth client ID</strong>.
  </Step>

  <Step title="Configure the Consent Screen">
    If not set up, Google prompts you to configure an <strong>OAuth Consent Screen</strong>.

    * Choose <strong>External</strong> (if public) or <strong>Internal</strong> (if limited to your org’s domain).
    * Fill out app information, then save.
  </Step>

  <Step title="Create OAuth Client ID">
    1. Select <strong>Web application</strong> as the application type.
    2. Under <strong>Authorized redirect URIs</strong>, add:
       <code>[https://auth.altostrat.app/callback](https://auth.altostrat.app/callback)</code>
    3. Click <strong>Create</strong>. Copy the generated <strong>Client ID</strong> and <strong>Client
       Secret</strong>.
  </Step>
</Steps>

<Note>
  If you have specific domain verification or branding requirements, complete those steps in the <strong>OAuth Consent
  Screen</strong> configuration.
</Note>

***

## Part 2: Altostrat Integration

<Steps>
  <Step title="Open Altostrat Integrations">
    From the Altostrat dashboard, go to <strong>Integrations</strong>.
  </Step>

  <Step title="Select Google Cloud">
    Look for a <strong>Google Cloud</strong> or <strong>Google</strong> option. Fill in the <em>Client
    ID</em> and <em>Client Secret</em> from your GCP project.
  </Step>

  <Step title="Enter Callback URL">
    Make sure the callback <code>[https://auth.altostrat.app/callback](https://auth.altostrat.app/callback)</code> matches what you set in Google Cloud.
  </Step>

  <Step title="Save & Test">
    Confirm settings and attempt a test sign-in to verify functionality.
  </Step>
</Steps>

![Placeholder: Google Cloud Integration Setup](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/google-cloud-setup-placeholder.jpg)

***

## Troubleshooting

* **OAuth Errors**
  Ensure your <code>Client ID</code> and <code>Client Secret</code> are correct. Mismatched callback URLs can cause <em>redirect\_uri\_mismatch</em> errors.
* **Consent Screen Issues**
  If users see a warning that the app isn’t verified, finalize the <strong>OAuth consent</strong> process in Google Cloud.
* **Check Orchestration Logs**
  If Altostrat reports authentication errors, check the [Orchestration Log](/management/orchestration-log) or Google Cloud’s <strong>APIs & Services → Credentials</strong> logs for details.

***

## Updating or Removing the Integration

1. **Google Cloud**
   Under <strong>APIs & Services → Credentials</strong>, edit or delete the OAuth client if you need to rotate secrets.
2. **Altostrat**
   In <strong>Integrations</strong>, remove or update the <strong>Google Cloud</strong> entry, which immediately affects user logins via Google.

<Warning>
  Removing this integration will prevent any user relying on Google OAuth from logging in. Make sure you have an
  alternate login method or user in place.
</Warning>


# Identity Providers
Source: https://docs.sdx.altostrat.io/integrations/identity-providers

Configure external OAuth 2.0 or SSO providers like Google, Azure, or GitHub for Altostrat authentication.

![Placeholder: Identity Providers Overview](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/identity-providers-hero-placeholder.jpg)

Altostrat **Identity Provider (IDP)** integrations let users **log in** using their existing accounts—reducing password fatigue and simplifying onboarding. You can configure various **OAuth 2.0** or **SSO** providers to suit your organization’s needs.

## Why Use External IDPs?

* **Single Sign-On (SSO)**: Streamline user authentication with corporate or social accounts.
* **Improved Security**: Leverage well-established providers (e.g., Google, Microsoft Azure) with built-in MFA or domain control.
* **Reduced Overhead**: Fewer credentials to manage means less admin work for your team.

***

## Supported Identity Providers

| **Provider**                | **Description**                                                          |
| --------------------------- | ------------------------------------------------------------------------ |
| **Google Cloud**            | Allow logins with Google accounts (Gmail or corporate Google Workspace). |
| **Microsoft Azure (Entra)** | Use Azure AD credentials; suits environments with Microsoft 365.         |
| **GitHub (IDP)**            | Great for open-source or developer-oriented teams logging in via GitHub. |

If you need another provider, Altostrat supports **generic OAuth 2.0** setups that may work with Okta, Auth0, or other SSO platforms.

***

## Creating an IDP Instance

<Steps>
  <Step title="Open Altostrat Integrations">
    From the dashboard, navigate to <strong>Integrations</strong> → <strong>Identity Providers</strong>.
  </Step>

  <Step title="Add a New IDP">
    Click <strong>Add</strong> or <strong>+ New</strong>. Provide a <strong>Name</strong> (e.g., “GitHub SSO”).
  </Step>

  <Step title="Configure Client Credentials">
    Enter the <em>Client ID</em>, <em>Client Secret</em>, and any required <em>Tenant/Domain</em> details from your
    chosen provider.
    If you’re unsure, see:

    * [Google Cloud Integration](/integrations/google-cloud-integration)
    * [Microsoft Azure Integration](/integrations/microsoft-azure-integration)
    * [GitHub IDP Setup](/integrations/github) (if available)
  </Step>

  <Step title="Callback URL">
    Ensure the callback <code>[https://auth.altostrat.app/callback](https://auth.altostrat.app/callback)</code> is registered in your provider’s console.
  </Step>

  <Step title="Save & Test">
    Click <strong>Save</strong>. Use a test user to attempt an OAuth login. If everything is correct, you’re good to
    go.
  </Step>
</Steps>

***

## Editing or Removing an IDP

<Steps>
  <Step title="Locate the IDP Instance">
    Under <strong>Integrations → Identity Providers</strong>, find the one you want to modify.
  </Step>

  <Step title="Adjust Credentials or Remove">
    Update <em>Client Secret</em> if you rotate it, or remove the IDP if you no longer need it.
  </Step>
</Steps>

<Warning>
  Deleting an IDP prevents any user relying on that method from logging in. Make sure you have alternative access for
  administrative tasks if needed.
</Warning>

***

## Best Practices

* **Multiple IDPs**: You can enable multiple providers so users can choose how to log in.
* **Policy Enforcement**: Ensure you have [Roles & Permissions](/core-concepts/roles-and-permissions) set up for newly created users from any IDP.
* **Failover**: Maintain at least one admin account with native Altostrat credentials in case external IDPs have outages or misconfigurations.

If you encounter issues, check the [Orchestration Log](/management/orchestration-log) or contact [Altostrat Support](/support) for further assistance.


# Integrations Overview
Source: https://docs.sdx.altostrat.io/integrations/integrations-overview

Overview of how Altostrat connects with external platforms for notifications, authentication, and more.

![Placeholder: Integrations Overview Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/integrations-overview-placeholder.jpg)

Altostrat supports **multiple integrations** to enhance your workflow—whether it’s sending notifications via Slack or Microsoft Teams, or handling user logins through external providers like Google or Azure AD.

## Why Integrate?

* **Notifications**: Push alerts to popular messaging platforms so teams get real-time updates.
* **OAuth & SSO**: Allow users to log in with existing corporate or personal accounts (Google, Azure, GitHub, etc.).
* **Streamlined Operations**: Reduce overhead by automating tasks or bridging data across your existing tools.

## Key Integration Categories

1. **Communication Tools**
   Forward critical alerts or changes to Slack, Microsoft Teams, or email distribution lists.
2. **Identity Providers**
   Leverage OAuth 2.0 or third-party SSO for user authentication.
3. **Custom Webhooks**
   For advanced scenarios, push or pull data from your internal services.

***

## Supported Integrations

| **Integration**        | **Description**                                                                    |
| ---------------------- | ---------------------------------------------------------------------------------- |
| **Slack**              | Automatically post alerts to specific channels.                                    |
| **Microsoft Teams**    | Route notifications to dedicated channels for quick collaboration.                 |
| **Google Cloud**       | Use Google credentials for single sign-on or link cloud services for data synergy. |
| **Microsoft Azure**    | Employ Azure AD for user logins or tie in other Azure-based services.              |
| **GitHub (IDP)**       | Let developers or open-source collaborators log in using their GitHub accounts.    |
| **Identity Providers** | Configure OAuth 2.0 connectors for a variety of third-party login services.        |

### Before You Begin

Some integrations—like Slack or Microsoft Teams—require setting up **webhook URLs** or installing an **app**. Identity providers generally need you to **register** an application in their respective portals and supply client secrets to Altostrat.

## Setting Up an Integration

<Steps>
  <Step title="Open Integrations">
    Navigate to <strong>Integrations</strong> in your Altostrat portal or settings menu.
  </Step>

  <Step title="Select the Integration">
    Choose a tool, like <strong>Slack</strong> or <strong>Microsoft Teams</strong>. Follow the on-screen instructions.
  </Step>

  <Step title="Provide Required Info">
    For Slack, you might enter a webhook URL. For Azure AD, fill in <code>Client ID</code>, <code>Client Secret</code>, and <code>Tenant ID</code>.
  </Step>

  <Step title="Save & Test">
    Confirm the details. Send a test notification or try logging in to ensure the integration works.
  </Step>
</Steps>

![Placeholder: Integration Setup](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/integration-setup-placeholder.jpg)

***

## Editing or Removing Integrations

<Steps>
  <Step title="Locate the Integration">
    Under <strong>Integrations</strong>, find the service you want to modify.
  </Step>

  <Step title="Make Changes or Disconnect">
    Edit the settings or remove the connection. Some integrations can be temporarily disabled instead of fully uninstalled.
  </Step>
</Steps>

<Warning>
  Removing an integration can break notifications or user logins that rely on it. Make sure you have backups or alternatives in place.
</Warning>

***

## More Information

* **Slack**: [Slack Integration](/integrations/slack)
* **Microsoft Teams**: [Teams Integration](/integrations/microsoft-teams)
* **Google / Azure / GitHub**: [Identity Providers](/integrations/identity-providers)
* **Check Orchestration Logs**: Use the [Orchestration Log](/management/orchestration-log) if your integration jobs fail or don’t appear as expected.


# Microsoft Azure Integration
Source: https://docs.sdx.altostrat.io/integrations/microsoft-azure-integration

Use Microsoft Entra (Azure AD) for secure user authentication in Altostrat.

![Placeholder: Microsoft Azure Integration Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/microsoft-azure-integration-hero-placeholder.jpg)

Leverage **Microsoft Entra** (formerly **Azure AD**) for user logins in Altostrat. This guide explains how to register an app in the Azure portal, get the **client credentials**, and integrate them into Altostrat for **OAuth 2.0** flows.

## Prerequisites

* **Microsoft Azure** subscription with access to **Entra ID (Azure AD)**.
* Sufficient privileges in **Altostrat** to configure identity providers.

## Part 1: Azure Portal Setup

<Steps>
  <Step title="Log into Azure Portal">
    Go to [https://portal.azure.com](https://portal.azure.com) and sign in.
    Use global search to find <strong>Microsoft Entra ID</strong> or <strong>Azure Active Directory</strong>.
  </Step>

  <Step title="Create App Registration">
    1. In the Entra (Azure AD) overview, click <strong>App registrations</strong>.
    2. Select <strong>+ New registration</strong> to create a new application.
    3. Name the app (e.g., “Altostrat Login”) and choose <em>Supported account types</em>.
    4. Under <em>Redirect URI</em>, pick <strong>Web</strong> and
       enter <code>[https://auth.altostrat.app/callback](https://auth.altostrat.app/callback)</code>.
  </Step>

  <Step title="Register and Note Credentials">
    1. After registering, note the <strong>Application (client) ID</strong> and <strong>Directory (tenant)
       ID</strong>.
    2. Go to <strong>Certificates & secrets</strong> to generate a <strong>Client Secret</strong>. Copy the
       secret’s value immediately.
  </Step>
</Steps>

<Note>
  You won’t be able to view the client secret again after leaving the page. Store it in a safe place.
</Note>

***

## Part 2: Altostrat Configuration

<Steps>
  <Step title="Open Integrations in Altostrat">
    From the Altostrat dashboard, choose <strong>Integrations</strong> → <strong>Microsoft Azure</strong>.
  </Step>

  <Step title="Add Azure Credentials">
    Fill in the <em>Client ID</em> (Application ID), <em>Client Secret</em>, and <em>Tenant ID</em> from your Azure
    app registration.
  </Step>

  <Step title="Save & Test">
    Click <strong>Save</strong>, then perform a test sign-in to ensure Altostrat redirects to Azure and back
    successfully.
  </Step>
</Steps>

![Placeholder: Microsoft Azure Integration Setup](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/microsoft-azure-integration-placeholder.jpg)

***

## Troubleshooting

* **Redirect URI Mismatch**
  Ensure <code>[https://auth.altostrat.app/callback](https://auth.altostrat.app/callback)</code> matches the one in your Azure app.
* **Invalid Client Secret**
  If you see authentication errors, regenerate a new secret in **Certificates & secrets**, then update Altostrat.
* **User Domain Restrictions**
  If you set <em>Single Tenant</em> in Azure, only users from your tenant can log in. For external users, you need <em>Multi-Tenant</em> or <em>Personal Accounts</em> enabled.
* **Check Orchestration Logs**
  Failed logins or token errors appear in the [Orchestration Log](/management/orchestration-log).

***

## Updating or Removing the Integration

1. **Azure Portal**
   Modify or delete the app registration if you need to rotate secrets or allow different account types.
2. **Altostrat**
   In <strong>Integrations</strong>, remove or edit the <strong>Microsoft Azure</strong> entry.
   If removed, users depending on Azure AD **can’t log in** until another method is configured.

<Warning>
  Deleting the integration breaks any user logins that rely on Microsoft Entra credentials. Have a fallback admin
  account if needed.
</Warning>


# Microsoft Teams
Source: https://docs.sdx.altostrat.io/integrations/microsoft-teams

Integrate Altostrat notifications and alerts into Microsoft Teams channels.

![Placeholder: Microsoft Teams Integration Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/microsoft-teams-hero-placeholder.jpg)

By connecting **Microsoft Teams** with Altostrat, you can receive **real-time notifications** directly in your Teams channels—helping your team collaborate faster on critical network events.

## Prerequisites

* A **Microsoft Teams** workspace with permissions to manage connectors or install apps.
* An **Altostrat** account with enough privileges to set up integrations.

## Setting up the Microsoft Teams Webhook

<Steps>
  <Step title="Open Microsoft Teams">
    Launch Microsoft Teams and choose the <strong>channel</strong> you’d like to use for Altostrat notifications.
  </Step>

  <Step title="Manage Channel Connectors">
    Right-click the channel name and select <strong>Manage channel</strong> or go to <strong>Connectors</strong> in the channel settings.
  </Step>

  <Step title="Find Incoming Webhook">
    Search for <strong>Incoming Webhook</strong> and click <strong>Add</strong>. If prompted, confirm installation.
  </Step>

  <Step title="Configure Webhook">
    Name your webhook (e.g., “Altostrat Notifications”) and optionally upload a custom icon.
    Once created, **copy** the generated webhook URL—this is critical for the Altostrat setup.
  </Step>
</Steps>

![Placeholder: Microsoft Teams Webhook](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/microsoft-teams-webhook-placeholder.jpg)

***

## Integrate the Webhook with Altostrat

<Steps>
  <Step title="Open Integrations in Altostrat">
    Go to <strong>Integrations</strong> from the Altostrat dashboard or settings menu.
  </Step>

  <Step title="Select Microsoft Teams">
    Find the <strong>Teams</strong> integration and enter the <em>webhook URL</em> you copied from Microsoft Teams.
  </Step>

  <Step title="Save & Test">
    Click <strong>Save</strong>. Send a test notification from Altostrat to confirm messages appear in the chosen Teams channel.
  </Step>
</Steps>

If the test fails, ensure the webhook URL is correct and that the Teams channel allows external connectors.

***

## Troubleshooting

* **No Message in Teams**
  Double-check the webhook URL and verify external connector settings.
* **Rate Limits**
  Microsoft Teams may have rate limits for messages. Slow down or batch notifications if you encounter errors.
* **Orchestration Logs**
  If alerts are shown as sent in Altostrat but don’t appear in Teams, consult the [Orchestration Log](/management/orchestration-log) for details on message delivery attempts.

***

## Removing or Updating the Integration

1. **Microsoft Teams Channel**
   Remove or reconfigure the Incoming Webhook in the channel’s connector settings.
2. **Altostrat**
   In the <strong>Integrations</strong> tab, remove or edit the <strong>Microsoft Teams</strong> entry.

<Warning>
  Deleting the integration immediately stops all future messages from appearing in Teams. Ensure you have alternative alert methods before disabling.
</Warning>


# Slack
Source: https://docs.sdx.altostrat.io/integrations/slack

Send Altostrat alerts to Slack channels for quick incident collaboration.

![Placeholder: Slack Integration Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/slack-integration-hero-placeholder.jpg)

**Slack Integration** allows Altostrat to post **alerts**, **fault notifications**, and **SLA breach messages** into specified Slack channels, improving collaboration when issues arise.

## Prerequisites

* A **Slack** workspace where you have permission to add apps or configure incoming webhooks.
* An **Altostrat** account with admin rights to set up integrations.

## Setting up the Slack Webhook

<Steps>
  <Step title="Open Slack">
    Choose the <strong>channel</strong> in Slack where you want Altostrat alerts to appear.
  </Step>

  <Step title="Configure Incoming Webhooks">
    Click on the channel name → <strong>Integrations</strong> (or use Slack’s <strong>Apps</strong> directory).
    Search for <strong>Incoming Webhooks</strong> and click <strong>Add</strong>.
  </Step>

  <Step title="Set a Channel & Copy the Webhook URL">
    Assign the webhook to your chosen channel. Slack provides a <strong>Webhook URL</strong>—copy it for the next
    step.
  </Step>
</Steps>

![Placeholder: Slack Webhook Configuration](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/slack-webhook-placeholder.jpg)

***

## Integrating with Altostrat

<Steps>
  <Step title="Navigate to Integrations in Altostrat">
    From the Altostrat dashboard, click <strong>Integrations</strong>.
  </Step>

  <Step title="Add Slack">
    Select <strong>Slack</strong> from the list of integrations. Paste the <em>webhook URL</em> you got from Slack.
  </Step>

  <Step title="Save & Test">
    Click <strong>Save</strong> and send a test notification to verify messages appear in the correct channel.
  </Step>
</Steps>

If the test message doesn’t show up, confirm your webhook URL is correct and that Slack’s **Incoming Webhook** integration is active.

***

## Troubleshooting

* **No Slack Notifications**
  Make sure the Slack channel allows external webhooks and that the pasted URL is correct.
* **Rate Limits**
  Slack might throttle excessive messages. If you see warnings, reduce the alert frequency or batch notifications.
* **Check Orchestration Log**
  See the [Orchestration Log](/management/orchestration-log) for any errors if Altostrat says notifications were sent but Slack never receives them.

***

## Updating or Removing the Integration

1. **Slack**
   Under **Apps** in Slack, remove or reconfigure the webhook if you need a new channel or changed credentials.
2. **Altostrat**
   In <strong>Integrations</strong>, remove or edit the <strong>Slack</strong> entry to stop or reroute notifications.

<Warning>
  Deleting the Slack integration stops all future alerts to Slack. Ensure another notification method is in place if
  you rely on Slack for critical notifications.
</Warning>


# Backups
Source: https://docs.sdx.altostrat.io/management/backups

Manage and schedule configuration backups for MikroTik devices through Altostrat.

![Placeholder: Backups Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/backups-hero-placeholder.jpg)

Regular **configuration backups** are crucial for maintaining recoverability and integrity of your MikroTik devices. Altostrat simplifies this by **automating** and **scheduling** backups, ensuring you always have **recent snapshots** on hand.

## Overview

Altostrat can create **daily backups** of your device configurations, storing them securely. These backups are accessible from the **Backups** page in the Altostrat portal, allowing you to quickly restore or compare configurations.

## Backup Schedules

<Steps>
  <Step title="Frequency">
    By default, backups occur <em>daily</em>. You can customize this in the portal under <strong>Backups →
    Settings</strong>.
  </Step>

  <Step title="Manual Backups">
    You can also trigger one-off backups at any time (e.g., before making major config changes).
  </Step>
</Steps>

***

## Accessing Backups

<Steps>
  <Step title="Open the Site in Altostrat">
    From your <strong>Dashboard</strong>, click <strong>Sites</strong>, then pick the relevant site.
  </Step>

  <Step title="View Config Backups">
    On the site’s overview page, click <strong>Config Backups</strong> (or a similar option). Here, you’ll see a
    list of recent backups.
  </Step>
</Steps>

### Options for Each Backup

* **View**: Inspect the configuration file in plain text or compare it with another backup.
* **Download**: Obtain a local copy for offline storage.
* **Restore**: Apply the backup to revert the router to that configuration.

![Placeholder: Backups List](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/backups-list-placeholder.jpg)

***

## Comparing Backups

Comparisons highlight **differences** between two backup snapshots.

<Steps>
  <Step title="Select Backups to Compare">
    Check two backups from the list. An option to <strong>Compare</strong> should appear.
  </Step>

  <Step title="View the Diff">
    Lines in <span>red</span> indicate a difference in the configuration.
  </Step>
</Steps>

<Note>
  Before restoring an old config, make sure you understand the changes between backups to avoid losing new site data.
</Note>

***

## Restoring a Backup

<Steps>
  <Step title="Locate the Backup">
    In <strong>Config Backups</strong>, click the backup you want to restore.
  </Step>

  <Step title="Confirm the Restore">
    Click <strong>Restore</strong>. Altostrat will push the selected config to the router. Expect a brief service
    interruption.
  </Step>
</Steps>

<Warning>
  Restoring overwrites the current device configuration. If you’re unsure, <em>download</em> the existing config first
  as a safety measure.
</Warning>

***

## Best Practices

* **Schedule Regularly**: Ensure daily or weekly backups to keep your snapshots fresh.
* **Compare Before Restoring**: Review diffs to confirm you’re reverting the correct changes.
* **Download & Archive**: Keep offline copies of critical points in your device’s lifecycle.
* **Check Logs**: Use the [Orchestration Log](/management/orchestration-log) to confirm backup jobs and spot failures or interruptions.


# Device Tags
Source: https://docs.sdx.altostrat.io/management/device-tags

Organize and categorize your MikroTik devices with custom tags in Altostrat.

![Placeholder: Device Tags Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/device-tags-hero-placeholder.jpg)

**Device Tags** help you **categorize** and **filter** MikroTik routers within Altostrat. By assigning one or more labels, you can quickly locate devices by location, function, or status.

## Why Use Tags?

* **Organization**
  Group devices by **region**, **role**, or **environment** (e.g., “Branch APs,” “Datacenter Core,” “Testing Lab”).
* **Filtering**
  In the **Sites** view, filter devices by tag to see only those relevant to your current task.
* **Multi-Tag**
  A single device can carry **multiple tags** if it belongs to multiple categories.

## Adding Tags

<Steps>
  <Step title="Navigate to Sites">
    From the <strong>Dashboard</strong>, click <strong>Sites</strong>. You’ll see a list of all registered devices.
  </Step>

  <Step title="Edit Tags">
    Hover over a site (or device) entry to reveal an <strong>Add Tag</strong> or <strong>Edit Tags</strong> button.
  </Step>

  <Step title="Create or Assign Tags">
    In the pop-up or sidebar, type the name of a new tag or select from existing ones. Choose a color if desired. Confirm to apply.
  </Step>
</Steps>

![Placeholder: Adding Device Tags](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/device-tags-adding-placeholder.jpg)

***

## Removing or Editing Tags

<Steps>
  <Step title="Open Tags Editor">
    Hover over the site again and select <strong>Edit Tags</strong>.
  </Step>

  <Step title="Remove or Update">
    Click on a tag to remove it, or rename its label if supported (usually by creating a new tag with the desired name).
  </Step>
</Steps>

<Note>
  If no devices remain with a particular tag, Altostrat automatically **deletes** that unused tag from the system.
</Note>

***

## Filtering by Tags

1. **Sites View**
   In the **Sites** list, look for a **Filter by Tag** dropdown or button.
2. **Select the Desired Tag**
   Only devices carrying that tag appear, simplifying device management for large organizations.

![Placeholder: Device Tags Filter](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/device-tags-filter-placeholder.jpg)

***

## Best Practices

* **Use Clear, Meaningful Names**: Keep tags concise yet descriptive (e.g., “Floor-1,” “High-Priority,” “Customer-A”).
* **Combine Tags**: A device can have “NY-Office,” “Production,” and “Firewall” simultaneously.
* **Routine Cleanup**: Remove or rename obsolete tags to maintain clarity and consistency across your environment.
* **Enforce a Tagging Convention**: Decide on a standard format (e.g., location/function, etc.) to keep your docs tidy.


# Faults
Source: https://docs.sdx.altostrat.io/management/faults

Monitor and troubleshoot disruptions or issues in your network via Altostrat.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Faults-Black.png" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Faults-White.png" />
</Frame>

Altostrat **Faults** represent any disruptions or issues at your site—like **loss of connectivity**, **service degradation**, or **hardware failures**. The **Faults Dashboard** helps you **monitor** these in real-time and respond swiftly.

## What Are Faults?

A **Fault** signals a potential network problem, such as:

* **Heartbeat Failures** (router stops reporting)
* **WAN Tunnel Offline** (a monitored interface goes down)
* **Site Rebooted** (unexpected or scheduled device restart)

## How Faults Are Logged

Altostrat automatically detects and logs fault conditions. For example:

* **Heartbeat Checks** run every 30 seconds. If 10 consecutive checks fail, a fault entry is created.
* **Start Time** is backdated to when the first missed heartbeat occurred.
* **End Time** logs when communication is restored.

## Recent Faults Dashboard

<Steps>
  <Step title="Dashboard Overview">
    From your main <strong>Dashboard</strong>, locate the <strong>Recent Faults</strong> tile. This shows any new or ongoing faults in the last 24 hours.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Recent-Faults-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Recent-Faults-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="View Fault Details">
    Click a fault entry to see more info, including timestamps, fault types, and affected devices.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Recent-Faults-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Recent-Faults-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

<Note>If you haven't had any recent faults, the tile will be empty.</Note>

***

## Site-Specific Fault Logs

<Steps>
  <Step title="Open the Site">
    In Altostrat, go to <strong>Sites</strong>, then pick a site you want to investigate.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Site-Specific-Faults-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Site-Specific-Faults-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Select Fault Event Log">
    On the site's overview page, find <strong>Faults</strong> or <strong>Fault Event Log</strong>. Click it to view the site's entire fault history.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Site-Specific-Faults-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/faults/Site-Specific-Faults-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

Here, you can scroll through **historical faults**, including those older than 24 hours.

***

## Interpreting Faults

* **WAN Tunnel Offline**
  Indicates a disruption in the [Management VPN](/management/management-vpn) or a specific WAN interface.
* **Site Rebooted**
  Logged if the router restarts, either by user action or an unexpected power cycle.
* **Site Offline**
  A total loss of communication between the site and Altostrat.

### Downtime Calculations

Each fault also includes **downtime**. If the event overlaps your [Business Hour Policy](/core-concepts/notification-groups), this period is tallied in SLA or uptime reports.

***

## Tips & Troubleshooting

* **Use the Orchestration Log**
  Check the [Orchestration Log](/management/orchestration-log) to see any recent scripts or commands that might have triggered a reboot or changed configs.
* **Investigate WAN**
  If you see frequent **WAN Tunnel Offline** faults, verify your [WAN Failover](/management/wan-failover) settings or ISP connections.
* **Combine with Notifications**
  Tie faults to [Notification Groups](/core-concepts/notification-groups) so the right people get alerted immediately.


# Management VPN
Source: https://docs.sdx.altostrat.io/management/management-vpn

How MikroTik devices connect securely to Altostrat for real-time monitoring and management.

Altostrat's **Management VPN** creates a secure tunnel for **real-time monitoring** and **remote management** of your MikroTik devices—even those behind NAT firewalls. This tunnel uses **OpenVPN** over **TCP 8443**, ensuring stable performance across varied network conditions.

```mermaid
flowchart LR
    A((MikroTik Router)) -->|OpenVPN TCP 8443| B([Regional Servers<br>mgnt.sdx.altostrat.io])
    B --> C([BGP Security Feeds])
    B --> D([DNS Content Filter])
    B --> E([Netflow Collector])
    B --> F([SNMP Collector])
    B --> G([Synchronous API])
    B --> H([System Log ETL])
    B --> I([Transient Access])
```

## How It Works

1. **OpenVPN over TCP**
   Routers connect to `<mgnt.sdx.altostrat.io>:8443`, allowing management-plane traffic to flow securely, even through NAT.
2. **Regional Servers**
   VPN tunnels terminate on regional clusters worldwide for optimal latency and redundancy.
3. **High Availability**
   DNS-based geolocation resolves `mgnt.sdx.altostrat.io` to the closest cluster. Connections automatically reroute during regional outages.

***

## Identification & Authentication

* **Unique UUID**: Each management VPN tunnel is uniquely identified by a v4 UUID, which also appears as the **PPP profile** name on the MikroTik.
* **Authentication**: Certificates are managed server-side—no manual certificate installation is required on the router.

<Note>
  Comments like <code>Altostrat: Management Tunnel</code> often appear in Winbox to denote the VPN interface or PPP profile.
</Note>

## Security & IP Addressing

* **Encryption**: AES-CBC or a similarly secure method is used.
* **Certificate Management**: All certs and key material are hosted centrally by Altostrat.
* **CGNAT Range**: Tunnels use addresses in the `100.64.0.0/10` space, avoiding conflicts with typical private LAN ranges.

***

## Management Traffic Types

Through this tunnel, the router securely transmits:

* **BGP Security Feeds**
* **DNS Requests** for content filtering
* **Traffic Flow (NetFlow)** data
* **SNMP** metrics
* **Synchronous API** calls
* **System logs**
* **Transient Access** sessions for on-demand remote control

Nonessential or user traffic does **not** route through the Management VPN by default, keeping overhead low.

***

## Logging & Monitoring

1. **OpenVPN logs** on Altostrat's regional servers track connection events, data transfer metrics, and remote IP addresses.
2. **ICMP Latency** checks monitor ping times between the router and the regional server.
3. **Metadata** like connection teardown or failures appear in the [Orchestration Log](/management/orchestration-log) for auditing.

***

## Recovery of the Management VPN

If the tunnel is **accidentally deleted** or corrupted:

<Steps>
  <Step title="Go to Site Overview">
    In the Altostrat portal, select your site that lost the tunnel.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Recreate Management VPN">
    Look for a <strong>Recreate</strong> or <strong>Restore Management VPN</strong> button. Clicking it triggers a job to wipe the old config and re-establish the tunnel.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Confirm Connection">
    Wait a few seconds, then check if the router shows as <strong>Online</strong>. The tunnel should reappear under <em>Interfaces</em> in Winbox, typically labeled with the site's UUID.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step3-dark.jpg" />
    </Frame>

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/management-vpn/Recovering-Management-VPN-Step3_2-winbox.jpg" />
    </Frame>
  </Step>
</Steps>

***

## Usage & Restrictions of the Synchronous API

* **Read Operations**: Real-time interface stats and logs flow through this API.
* **Critical Router Tasks**: Certain operations like reboots also pass here.
* **No Full Configuration**: For major config changes, Altostrat uses asynchronous job scheduling to ensure reliability and rollback options.

If you need advanced control-plane manipulation, see [Control Plane Policies](/core-concepts/control-plane) or consult the [Management VPN Logs](/management/orchestration-log) for debugging.


# Managing WAN Failover
Source: https://docs.sdx.altostrat.io/management/managing-wan-failover

Create, reorder, and troubleshoot WAN Failover configurations for reliable multi-link setups.

This page details **advanced management** of WAN Failover, including manual failover, reordering interfaces, and fine-tuning routing distances.

## Setting up WAN Failover

If you haven't already created a WAN Failover configuration, see [WAN Failover](/management/wan-failover).

## Manual Failover and Interface Order

If you ever want to **manually initiate failover**:

1. Return to **WAN Failover** settings.
2. Rearrange interface priority using the **up/down arrows**.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4-dark.jpg" />
</Frame>

3. Confirm the new priority.

<Frame>
  <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4_2-light.jpg" />

  <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4_2-dark.jpg" />
</Frame>

<Warning>
  Brief downtime may occur as the router switches from one interface to another.
</Warning>

***

## Routing Distances

**Routing Distance** determines which default route the router prefers.

<Steps>
  <Step title="Log into Your Router">
    Use <strong>Transient Access</strong> or <strong>WinBox</strong> to open a session.

    If you haven't already used Transient Access, see [Transient Access](/getting-started/transient-access).
  </Step>

  <Step title="View IP Routes">
    Go to <strong>IP → Routes</strong> in WinBox or run <code>ip route print</code> in CLI.

    {/* Images */}

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Routing-Distance-Step2.jpg" />
    </Frame>

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Routing-Distance-Step2-cli.jpg" />
    </Frame>
  </Step>

  <Step title="Modify Distance">
    Double-click on a default route (<code>0.0.0.0/0</code>) and adjust its <strong>distance</strong> value. Lower distance = higher priority.

    {/* Images */}

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Routing-Distance-Step3.jpg" />
    </Frame>

    <Note>
      Do not change internet links to a <strong>0</strong> distance value, as this will have undesired consequences.
    </Note>

    <Note>
      Depending on the Internet medium used, as well as the uplink connection (<strong>DHCP, PPPoE, Static, etc.</strong>) you may not have the option to change the routing distance here, and you will need to change the routing distance on the interface itself.
    </Note>
  </Step>

  <Step title="Apply">
    Save changes. Routes instantly update with the new priorities.
  </Step>
</Steps>

***

## Fine-Tuning WAN Links

1. **Check Orchestration Logs**
   Confirm the router receives and applies changes.
2. **Review Failover Thresholds**
   Some advanced setups let you specify how quickly the router decides a link is “down.”
3. **Monitor Interface Health**
   Inspect SNMP or throughput metrics for anomalies.

***

## Removing WAN Failover

<Steps>
  <Step title="Open WAN Failover">
    In Altostrat, select your site and go to the <strong>WAN Failover</strong> tab.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1-dark.jpg" />
    </Frame>

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Deactivate">
    Click <strong>Deactivate</strong> or <strong>Remove</strong>. Confirm if prompted. The router reverts to single-WAN or default routing.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Removing-WAN-Failover-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Removing-WAN-Failover-Step2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

<Note>
  All interface configurations for WAN Failover will be cleared once you remove this service.
</Note>

***

## Troubleshooting

* **No Failover During Outage**
  Verify your <strong>DHCP</strong> or <strong>static routes</strong> are correctly set.
* **Repeated Flapping**
  If an unstable link rapidly fails and recovers, consider increasing the <em>detection interval</em> or using a more stable primary link.
* **Lost Remote Access**
  If you're forcibly failing over from a remote interface, have a backup connection or use [Transient Access](/getting-started/transient-access) through the Management VPN to restore connectivity.

Use these tips and the info above to manage WAN Failover smoothly and maintain high availability across multiple internet links.


# Orchestration Log
Source: https://docs.sdx.altostrat.io/management/orchestration-log

Track scripts, API calls, and automated tasks performed by Altostrat on your MikroTik devices.

Altostrat's **Orchestration Log** provides **transparent visibility** into the **actions** performed on your MikroTik devices. It captures **scripts**, **API calls**, and **automated tasks**, allowing you to monitor and troubleshoot changes across your network.

## Why the Orchestration Log Matters

* **Audit Trail**
  Keep a record of who did what and when—essential for compliance.
* **Debugging**
  If something goes wrong with a script or API call, you can quickly spot the failure reason.
* **Monitoring Automated Tasks**
  See all scheduled or triggered actions performed by Altostrat's backend on your routers.

## Accessing the Orchestration Log

<Steps>
  <Step title="Open the Site in Altostrat">
    From your <strong>Dashboard</strong>, click on <strong>Sites</strong>, then select the site you want to investigate.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step1-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Navigate to Orchestration Log">
    In the site's overview page, look for the <strong>Orchestration Log</strong> tab or menu option. Click it to open the device's orchestration records.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step2_1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step2_1-dark.jpg" />
    </Frame>

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step2_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/orchestration-log/Accessing-Orchestration-Log-Step2_2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

## Understanding the Log Interface

Each entry in the Orchestration Log typically shows:

* **Description**: Name or purpose of the action, e.g., “Create Configuration Backup” or “Deploy Policy.”
* **Created / Run**: Timestamp when the action was **initiated** and when it was **executed** (if applicable).
* **Status**: Indicates if the action is <em>Pending</em>, <em>Completed</em>, or <em>Failed</em>.

### Expanded Log Entry

Clicking an entry opens **detailed information** about the job:

* **Timestamped Events**: Each step, from job creation to completion.
* **Device Information**: Target device(s), site ID, or associated metadata.
* **Job Context**: JSON payload containing job ID, scripts, API calls, or additional parameters.
* **Status Messages**: “Job created,” “Script downloaded,” “Express execution requested,” etc.

## How to Use the Orchestration Log

1. **Track Automated Jobs**
   Monitor things like firmware updates, backup schedules, or script executions.
2. **Verify Success**
   Ensure tasks completed without errors. Look for <em>Completed</em> or <em>Failed</em> statuses.
3. **Troubleshoot Failures**
   If a script failed, check the <em>Status Message</em> or <em>Job Context</em> for clues.
4. **Copy JSON**
   For deeper analysis, copy the payload and share it with support or store it in your records.

## Best Practices

* **Regularly Check**: Make orchestration log reviews part of your change-management process.
* **Filter by Status**: Look for frequent failures or pending actions that never complete.
* **Combine with Notification Groups**: If you want alerts on specific job failures, create relevant rules in [Notification Groups](/core-concepts/notification-groups).


# Regional Servers
Source: https://docs.sdx.altostrat.io/management/regional-servers

Improve performance and minimize single points of failure with globally distributed clusters.

![Placeholder: Regional Servers Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/regional-servers-hero-placeholder.jpg)

Altostrat’s **regional servers** form a **globally distributed infrastructure** that optimizes routing and reduces latency for routers connecting to the [Management VPN](/management/management-vpn). By **geographically** locating servers in different continents, we ensure minimal single points of failure.

## Purpose of Regional Servers

* **Optimal Routing**: DNS resolves each router to the closest regional server, cutting down on round-trip times.
* **Reduced Latency**: Traffic from your MikroTik device travels a shorter distance before entering Altostrat’s management plane.
* **High Availability**: If one region encounters downtime, DNS reroutes connections to another operational cluster.

## Example DNS Flow

```mermaid
flowchart LR
    A((mgnt.sdx.altostrat.io)) --> B[DNS-based Geo Routing]
    B -->|Resolves Africa region| C(africa.sdx.altostrat.io)
    C --> D[Load Balancer]
    D --> E(afr1.sdx...)
    D --> F(afr2.sdx...)
    D --> G(afr3.sdx...)
    D --> H(afr4.sdx...)
```

## Available Regional Servers

| **Location**                    | **FQDN**                 | **IP Address**   |
| ------------------------------- | ------------------------ | ---------------- |
| 🇩🇪 Frankfurt, Germany         | `europe.altostrat.io`    | `45.63.116.182`  |
| 🇿🇦 Johannesburg, South Africa | `africa.altostrat.io`    | `139.84.235.246` |
| 🇦🇺 Melbourne, Australia       | `australia.altostrat.io` | `67.219.108.29`  |
| 🇺🇸 Seattle, USA               | `usa.altostrat.io`       | `45.77.214.231`  |

*Last updated: 10 May 2024*

## Geographical DNS Routing

<Steps>
  <Step title="DNS Query">
    When a MikroTik router asks for <code>mgnt.sdx.altostrat.io</code>, Altostrat’s DNS determines the nearest regional
    cluster based on the router’s IP geolocation.
  </Step>

  <Step title="Server Assignment">
    The query returns a server address (e.g., <code>europe.altostrat.io</code>) located in Germany for routers in
    nearby regions.
  </Step>

  <Step title="Performance Boost">
    Shorter travel distance = better latency and faster management-plane interactions. During a regional outage, DNS
    automatically resolves to the next available server cluster.
  </Step>
</Steps>

## Best Practices

* **Default Routing**
  Let your MikroTik resolve `mgnt.sdx.altostrat.io` dynamically. Don’t hardcode IPs unless necessary.
* **Failover Awareness**
  If your region is offline, the router automatically reconnects to another operational cluster once DNS updates.
* **Monitor**
  Keep an eye on the [Orchestration Log](/management/orchestration-log) for any server-switching events.

If you have questions about a specific region or plan to deploy in an unlisted area, contact [Altostrat Support](/support) for guidance on expansions or custom routing.


# Short Links
Source: https://docs.sdx.altostrat.io/management/short-links

Simplify long, signed URLs into user-friendly short links for Altostrat notifications and emails.

![Placeholder: Short Links Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/short-links-hero-placeholder.jpg)

Altostrat uses a **URL shortening service** to turn long, signed links into simpler, user-friendly short links. These short links are primarily used in **emails and notifications** to preserve readability.

## Introduction

All Altostrat-generated links contain a **signature** to ensure they haven’t been tampered with. Because these signatures can be lengthy, we employ a **short-link domain** to keep links concise.

## Link Format

The default structure for a short link looks like:

```text
https://altostr.at/{short-code}
```

* **`altostr.at`** is the dedicated short-link domain.
* **`{short-code}`** uniquely maps back to the full, signed URL in Altostrat’s database.

## Using Short Links

<Steps>
  <Step title="Receive a Link">
    You’ll encounter short links in emails, notifications, or shared references from Altostrat. For example, <strong>[https://altostr.at/abc123](https://altostr.at/abc123)</strong>.
  </Step>

  <Step title="Click the Link">
    When clicked, Altostrat verifies the embedded signature to ensure the link remains valid.
  </Step>

  <Step title="Redirect">
    If valid, the short link redirects to the intended long URL. Otherwise, you’ll see an error if the link is expired or tampered with.
  </Step>
</Steps>

## Rate Limits

Altostrat imposes **60 requests per minute per IP address** for short-link requests to:

* **Prevent abuse** (e.g., bots or DDoS attempts).
* **Maintain stability** across the URL shortener service.

The **target link** itself may have separate rate limits, potentially blocking requests if abused.

## Expiry

<Note>
  If no specific expiry is set, short links **automatically expire** after <strong>90 days</strong>.
</Note>

Once expired, the link produces an error if clicked. If you need a permanent link or want to re-share it, generate a fresh short link or direct users to the main portal reference.

## Security

Because each short link references a **signed** long URL:

* **Tamper-Proof**: The signature check prevents malicious rewrites.
* **No Plain-Text Secrets**: Sensitive query parameters stay hidden in the signed link, not the short code.

Should you encounter expired or invalid links, contact [Altostrat Support](/support).


# WAN Failover
Source: https://docs.sdx.altostrat.io/management/wan-failover

Enhance reliability by combining multiple internet mediums for uninterrupted cloud connectivity.

{/* ![Placeholder: WAN Failover Hero](../images/wan-failover-hero-placeholder.jpg) */}

**WAN Failover** lets you **combine multiple internet connections** to ensure stable cloud connectivity, even if one or more links fail. Continuously monitoring each WAN interface, Altostrat automatically reroutes traffic to a healthy link if the primary link goes down.

## Key Benefits

* **Automatic Failover**
  Traffic switches to a backup link within seconds of a primary link failure.
* **Link Monitoring**
  Throughput and SNMP metrics are collected for real-time diagnostics.
* **Interface Prioritization**
  Easily rearrange interfaces to set your preferred connection order.
* **Detailed Traffic Statistics**
  Per-link metrics like latency, packet loss, and jitter help you troubleshoot.

***

## Setting Up WAN Failover

<Steps>
  <Step title="Navigate to the WAN Failover Page">
    From your Altostrat dashboard, go to your site's <strong>WAN Failover</strong> section.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1-dark.jpg" />
    </Frame>

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step1_2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Enable WAN Failover">
    On the WAN Failover overview, click <strong>Enable</strong> or <strong>Add</strong> to activate the service.
    If you see unconfigured interfaces, you can proceed to set them up next.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step2-dark.jpg" />
    </Frame>
  </Step>

  <Step title="Configure Interfaces">
    Each WAN interface represents a network medium (e.g., DSL, fiber, LTE).

    * Click the <strong>gear icon</strong> next to <strong>WAN 1</strong> to set an interface.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step3-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step3-dark.jpg" />
    </Frame>

    * Provide details like <em>gateway IP</em> and <em>physical/logical interface</em> name.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step3_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step3_2-dark.jpg" />
    </Frame>

    * Repeat for <strong>WAN 2</strong>, <strong>WAN 3</strong>, etc., if available.
  </Step>

  <Step title="Save & Prioritize">
    Once interfaces are configured, you can adjust their order to set which link is primary or backup.

    {/* Images */}

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4-dark.jpg" />
    </Frame>

    Click <strong>Confirm Priority</strong> when done.

    <Frame>
      <img className="block dark:hidden" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4_2-light.jpg" />

      <img className="hidden dark:block" height="1000" src="https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/management/wan-failover/Creating-WAN-Failover-Step4_2-dark.jpg" />
    </Frame>
  </Step>
</Steps>

***

## Best Practices

* **Monitor** the [Orchestration Log](/management/orchestration-log) for link failover events.
* **Set Interface Priorities** carefully to avoid redundant failovers.
* **Combine** with [Security Essentials](/core-concepts/security-essentials) to protect each WAN interface.
* **Test** failover occasionally by unplugging or simulating link loss to confirm expected behavior.


# Installable PWA
Source: https://docs.sdx.altostrat.io/resources/installable-pwa

Learn how to install Altostrat's Progressive Web App (PWA) for an app-like experience and offline support.

![Placeholder: Installable PWA Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/installable-pwa-hero-placeholder.jpg)

A **Progressive Web App (PWA)** offers a more **app-like** experience for your documentation or portal, complete with offline caching, background updates, and the ability to **launch** from your device’s home screen or application list.

## What is a PWA?

* **Web + Native Fusion**
  PWAs combine the best of **web pages** with **native app** elements (e.g., offline capabilities).
* **Standalone Interface**
  Once installed, the PWA runs like an app without needing a separate browser tab.
* **Background Updates**
  A service worker checks for fresh content and prompts you to refresh if a new version is available.

***

## Installing the Altostrat PWA

<Steps>
  <Step title="Open Altostrat in a Supported Browser">
    Use <strong>Google Chrome</strong>, <strong>Microsoft Edge</strong>, or any modern browser that supports PWA
    installation. Go to your Altostrat docs or portal URL.
  </Step>

  <Step title="Look for the Install Prompt">
    In your browser’s address bar, you may see an <strong>Install</strong> or <strong>+</strong> icon. It could also
    appear in the browser menu (e.g., <em>Chrome → More Tools → Create shortcut</em>).
  </Step>

  <Step title="Confirm Installation">
    A pop-up will ask if you want to install the app. Click <strong>Install</strong> to add the Altostrat PWA to
    your device.
  </Step>
</Steps>

![Placeholder: PWA Installation Prompt](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/pwa-install-prompt-placeholder.jpg)

### Launching the Installed App

Once installed, the PWA appears alongside other apps on your **home screen** (mobile) or **application list** (desktop). Log in if necessary, and you’ll have an **immersive** experience without a traditional browser UI.

***

## PWA Updates

When the PWA starts, a **service worker** checks for updates:

1. **Background Download**
   If a newer version exists, it silently downloads.
2. **Prompt to Refresh**
   You’ll see a notification or dialog asking to refresh the app. Accepting applies the update.

<Note>
  Authentication usually happens at <code>[https://auth.altostrat.app](https://auth.altostrat.app)</code>. If you’re not logged in, the PWA
  redirects there before returning to the app.
</Note>

***

## Tips & Best Practices

* **Pin It**: On mobile, place the PWA icon on your home screen for quick access.
* **Offline Usage**: Some content may remain accessible offline, depending on how your caching is configured.
* **Uninstalling**: Remove it like any other app—on desktop, right-click the app icon; on mobile, press and hold to uninstall.
* **Account Security**: If using shared devices, remember to log out of the PWA when done.

By installing the **Altostrat PWA**, you get a streamlined, **app-like** interface for documentation, management tasks, and real-time alerts, all within your device’s native environment. If you have issues or need assistance, reach out to [Altostrat Support](/support).


# Password Policy
Source: https://docs.sdx.altostrat.io/resources/password-policy

Requirements for secure user passwords in Altostrat.

![Placeholder: Password Policy Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/password-policy-hero-placeholder.jpg)

Altostrat enforces **strong password requirements** to enhance account security. This document outlines those requirements and details how passwords are **securely stored**.

## Password Requirements

1. **Minimum Length**: At least **8 characters**.
2. **Required Characters**:

* **Uppercase Letter** (A–Z)
* **Lowercase Letter** (a–z)
* **Number** (0–9)
* **Special Character** (e.g., `!`, `@`, `#`, `$`)

3. **Password History**: You cannot reuse any of your **last 3** passwords.

## Secure Storage

Altostrat **never** stores passwords in plain text. Instead, passwords are hashed (using something like **bcrypt**) so:

* **One-Way Hashing**: During login, Altostrat hashes the entered password and compares it to the stored hash.
* **Hash Comparison**: If they match, the user is authenticated.
* **No Plain Text**: Even if the database is compromised, attackers cannot reverse the hashed passwords.

## Best Practices

* **Use Unique Passwords**: Reusing passwords across multiple services puts all accounts at risk.
* **Enable MFA (2FA)** if available for an extra security layer.
* **Password Manager**: Consider using one to generate and store complex passwords.
* **Regular Rotations**: Change passwords periodically, especially after any security incident.

## Changing or Resetting Your Password

1. **Portal Users**

* Go to your account settings in Altostrat.
* Find the **Change Password** option and enter a new one meeting the criteria above.

2. **Forgotten Password**

* Use the **Forgot Password** link at [https://auth.altostrat.app](https://auth.altostrat.app).
* An email with a reset link will be sent. Check spam or junk folders if not received.

<Note>
  If you are required to adhere to a specific organizational policy that is stricter than Altostrat’s defaults, please
  contact your administrator for any additional requirements.
</Note>


# Supported SMS Regions
Source: https://docs.sdx.altostrat.io/resources/supported-sms-regions

List of countries where Altostrat's SMS delivery is enabled, plus any high-risk or unsupported regions.

![Placeholder: Supported SMS Regions Hero](https://mintlify.s3.us-west-1.amazonaws.com/altostratnetworks/images/supported-sms-regions-hero-placeholder.jpg)

<Warning>
  SMS delivery services are not available in all regions. Check the lists below to confirm if your country is
  supported.
</Warning>

Altostrat uses **phone number prefixes** to determine if SMS delivery is allowed. Some countries are **disabled** due to high risk or minimal user volume.

## Supported Regions

<AccordionGroup>
  <Accordion title="North America">
    | **Country Name**                                                | **Number Prefix**      |
    | --------------------------------------------------------------- | ---------------------- |
    | Anguilla                                                        | +1264                  |
    | Ascension                                                       | +247                   |
    | Belize                                                          | +501                   |
    | Cayman Islands                                                  | +1345                  |
    | Curaçao & Caribbean Netherlands (Bonaire, Sint Eustatius, Saba) | +599                   |
    | Dominican Republic                                              | +1849                  |
    | El Salvador                                                     | +503                   |
    | Guadeloupe                                                      | +590                   |
    | Honduras                                                        | +504                   |
    | Mexico                                                          | +52                    |
    | Panama                                                          | +507                   |
    | St Lucia                                                        | +1758                  |
    | Trinidad & Tobago                                               | +1868                  |
    | Virgin Islands, British                                         | +1284                  |
    | Antigua & Barbuda                                               | +1268                  |
    | Bahamas                                                         | +1242                  |
    | Bermuda                                                         | +1441                  |
    | Costa Rica                                                      | +506                   |
    | Dominica                                                        | +1767                  |
    | Greenland                                                       | +299                   |
    | Guatemala                                                       | +502                   |
    | Jamaica                                                         | +1876                  |
    | Montserrat                                                      | +1664                  |
    | Puerto Rico                                                     | +1787                  |
    | St Pierre & Miquelon                                            | +508                   |
    | Turks & Caicos Islands                                          | +1649                  |
    | Virgin Islands, U.S.                                            | +1340                  |
    | Aruba                                                           | +297                   |
    | Barbados                                                        | +1246                  |
    | Canada                                                          | +1                     |
    | Cuba                                                            | +53                    |
    | Dominican Republic (Alt prefixes)                               | +1829, +1809, +1809201 |
    | Grenada                                                         | +1473                  |
    | Haiti                                                           | +509                   |
    | Martinique                                                      | +596                   |
    | Nicaragua                                                       | +505                   |
    | St Kitts & Nevis                                                | +1869                  |
    | St Vincent & the Grenadines                                     | +1784                  |
    | United States                                                   | +1                     |
  </Accordion>

  <Accordion title="Asia">
    | **Country Name**     | **Number Prefix** |
    | -------------------- | ----------------- |
    | Afghanistan          | +93               |
    | Bahrain              | +973              |
    | Brunei               | +673              |
    | East Timor           | +670              |
    | India                | +91               |
    | Iraq                 | +964              |
    | Jordan               | +962              |
    | Kuwait               | +965              |
    | Lebanon              | +961              |
    | Maldives             | +960              |
    | Nepal                | +977              |
    | Turkmenistan         | +993              |
    | Vietnam              | +84               |
    | Armenia              | +374              |
    | Cambodia             | +855              |
    | Georgia              | +995              |
    | Kyrgyzstan           | +996              |
    | Macau                | +853              |
    | Mongolia             | +976              |
    | Philippines          | +63               |
    | Saudi Arabia         | +966              |
    | Syria                | +963              |
    | Thailand             | +66               |
    | United Arab Emirates | +971              |
    | Yemen                | +967              |
    | Bhutan               | +975              |
    | China                | +86               |
    | Hong Kong            | +852              |
    | Iran                 | +98               |
    | Japan                | +81               |
    | Korea (Republic of)  | +82               |
    | Laos                 | +856              |
    | Malaysia             | +60               |
    | Myanmar              | +95               |
    | Qatar                | +974              |
    | Singapore            | +65               |
    | Taiwan               | +886              |
    | Türkiye (Turkey)     | +90               |
    | Uzbekistan           | +998              |
  </Accordion>

  <Accordion title="Europe">
    | **Country Name**                   | **Number Prefix** |
    | ---------------------------------- | ----------------- |
    | Albania                            | +355              |
    | Andorra                            | +376              |
    | Austria                            | +43               |
    | Belarus                            | +375              |
    | Belgium                            | +32               |
    | Bosnia & Herzegovina               | +387              |
    | Bulgaria                           | +359              |
    | Canary Islands                     | +3491             |
    | Croatia                            | +385              |
    | Cyprus                             | +357              |
    | Czech Republic                     | +420              |
    | Denmark                            | +45               |
    | Estonia                            | +372              |
    | Faroe Islands                      | +298              |
    | Finland/Aland Islands              | +358              |
    | France                             | +33               |
    | Germany                            | +49               |
    | Gibraltar                          | +350              |
    | Greece                             | +30               |
    | Guernsey/Jersey                    | +44               |
    | Hungary                            | +36               |
    | Iceland                            | +354              |
    | Ireland                            | +353              |
    | Isle of Man                        | +44               |
    | Italy                              | +39               |
    | Kosovo                             | +383              |
    | Latvia                             | +371              |
    | Liechtenstein                      | +423              |
    | Lithuania                          | +370              |
    | Luxembourg                         | +352              |
    | Malta                              | +356              |
    | Moldova                            | +373              |
    | Monaco                             | +377              |
    | Montenegro                         | +382              |
    | Netherlands                        | +31               |
    | Norway                             | +47               |
    | Poland                             | +48               |
    | Portugal                           | +351              |
    | North Macedonia                    | +389              |
    | Romania                            | +40               |
    | San Marino                         | +378              |
    | Serbia                             | +381              |
    | Slovakia                           | +421              |
    | Slovenia                           | +386              |
    | Spain                              | +34               |
    | Sweden                             | +46               |
    | Switzerland                        | +41               |
    | Turkey Republic of Northern Cyprus | +90               |
    | Ukraine                            | +380              |
    | United Kingdom                     | +44               |
    | Vatican City                       | +379              |
  </Accordion>

  <Accordion title="South America">
    | **Country Name** | **Number Prefix** |
    | ---------------- | ----------------- |
    | Argentina        | +54               |
    | Bolivia          | +591              |
    | Brazil           | +55               |
    | Chile            | +56               |
    | Colombia         | +57               |
    | Ecuador          | +593              |
    | Falkland Islands | +500              |
    | French Guiana    | +594              |
    | Guyana           | +592              |
    | Paraguay         | +595              |
    | Peru             | +51               |
    | Suriname         | +597              |
    | Uruguay          | +598              |
    | Venezuela        | +58               |
  </Accordion>

  <Accordion title="Africa">
    | **Country Name**       | **Number Prefix** |
    | ---------------------- | ----------------- |
    | Angola                 | +244              |
    | Benin                  | +229              |
    | Botswana               | +267              |
    | Burkina Faso           | +226              |
    | Burundi                | +257              |
    | Cameroon               | +237              |
    | Cape Verde             | +238              |
    | Central Africa         | +236              |
    | Chad                   | +235              |
    | Comoros                | +269              |
    | Congo, Dem Rep         | +243              |
    | Djibouti               | +253              |
    | Egypt                  | +20               |
    | Equatorial Guinea      | +240              |
    | Eritrea                | +291              |
    | Ethiopia               | +251              |
    | Gabon                  | +241              |
    | Gambia                 | +220              |
    | Ghana                  | +233              |
    | Guinea                 | +224              |
    | Guinea-Bissau          | +245              |
    | Ivory Coast            | +225              |
    | Kenya                  | +254              |
    | Lesotho                | +266              |
    | Liberia                | +231              |
    | Libya                  | +218              |
    | Madagascar             | +261              |
    | Malawi                 | +265              |
    | Mali                   | +223              |
    | Mauritania             | +222              |
    | Mauritius              | +230              |
    | Morocco/Western Sahara | +212              |
    | Mozambique             | +258              |
    | Namibia                | +264              |
    | Niger                  | +227              |
    | Réunion/Mayotte        | +262              |
    | Rwanda                 | +250              |
    | Sao Tome & Principe    | +239              |
    | Senegal                | +221              |
    | Seychelles             | +248              |
    | Sierra Leone           | +232              |
    | Somalia                | +252              |
    | South Africa           | +27               |
    | South Sudan            | +211              |
    | Sudan                  | +249              |
    | Swaziland (Eswatini)   | +268              |
    | Tanzania               | +255              |
    | Togo                   | +228              |
    | Uganda                 | +256              |
    | Zambia                 | +260              |
  </Accordion>

  <Accordion title="Oceania">
    | **Country Name**                | **Number Prefix** |
    | ------------------------------- | ----------------- |
    | American Samoa                  | +1684             |
    | Australia / Cocos / Xmas Island | +61               |
    | Cook Islands                    | +682              |
    | Fiji                            | +679              |
    | French Polynesia                | +689              |
    | Guam                            | +1671             |
    | Kiribati                        | +686              |
    | Marshall Islands                | +692              |
    | Micronesia                      | +691              |
    | New Caledonia                   | +687              |
    | New Zealand                     | +64               |
    | Niue                            | +683              |
    | Norfolk Island                  | +672              |
    | Northern Mariana Islands        | +1670             |
    | Palau                           | +680              |
    | Papua New Guinea                | +675              |
    | Samoa                           | +685              |
    | Solomon Islands                 | +677              |
    | Tonga                           | +676              |
    | Tuvalu                          | +688              |
    | Vanuatu                         | +678              |
  </Accordion>
</AccordionGroup>

***

## Unsupported Regions & Services

### High-Risk Regions

<AccordionGroup>
  <Accordion title="High-Risk Regions">
    | **Country Name**    | **Number Prefix** | **Region** |
    | ------------------- | ----------------- | ---------: |
    | Algeria             | +213              |     Africa |
    | Bangladesh          | +880              |       Asia |
    | Nigeria             | +234              |     Africa |
    | Tunisia             | +216              |     Africa |
    | Zimbabwe            | +263              |     Africa |
    | Palestine Territory | +970, +972        |       Asia |
    | Russia/Kazakhstan   | +7                |       Asia |
    | Sri Lanka           | +94               |       Asia |
    | Tajikistan          | +992              |       Asia |
    | Oman                | +968              |       Asia |
    | Pakistan            | +92               |       Asia |
    | Azerbaijan          | +994              |       Asia |
  </Accordion>
</AccordionGroup>

### Satellite & International Networks

<AccordionGroup>
  <Accordion title="Satellite/International">
    | **Network**           | **Number Prefix** |
    | --------------------- | ----------------- |
    | Inmarsat Satellite    | +870              |
    | Iridium Satellite     | +881              |
    | International Network | +883, +882        |
  </Accordion>
</AccordionGroup>

<Note>
  Service availability can change. Check periodically for updates or contact [Altostrat Support](/support) if you need
  an unsupported region enabled.
</Note>


# API Authentication
Source: https://docs.sdx.altostrat.io/sdx-api/authentication

Learn how to securely authenticate calls to the Altostrat SDX API using bearer tokens.

# API Authentication

**Description:**
Learn how Altostrat SDX organizes its public Developer API, SPA application APIs, and internal infrastructure endpoints—and how to securely authenticate each one.

**Table of Contents:**

* [Overview](#overview)
* [Developer API Authentication](#developer-api-authentication)
* [SPA Application APIs](#spa-application-apis)
* [Internal Machine-to-Machine APIs](#internal-machine-to-machine-apis)
* [Summary](#summary)

## Overview

The Altostrat SDX platform provides multiple APIs for different use cases:

1. **Developer API (public):**

* Intended for external teams or individual users who want to integrate or build on top of Altostrat’s services.
* Authenticates via bearer tokens (issued to the user’s team), which you include in the Authorization header.

2. **SPA Application APIs:**

* Primarily consumed by Altostrat’s own web app components or official client applications.
* Uses JWT bearer tokens obtained from an OAuth2 process to access protected endpoints.
* Typically not directly called by end-user code, since the SPA device manages its own token flow.

3. **Internal (Machine-to-Machine) APIs:**

* Used within Altostrat’s infrastructure for communication between microservices (e.g., job queues, event triggers).
* These endpoints are not publicly accessible and do not accept user-facing tokens.

## Developer API Authentication

When calling the Developer API, you must include a bearer token in the Authorization header of every request:

```text
Bearer 0000-0000-0000-0000-0000:0000-0000-0000-0000-0000:abc…
```

* Each bearer token is tied to a specific team and can only manage resources owned by that team.
* Requests are limited to 60 requests per minute per token.
* All requests must be in JSON format, and you should include the relevant header:

Example Request:

```shell
GET /api/resource
Authorization: Bearer 0000-0000-0000-0000-0000:0000-0000-0000-0000-0000:abc…
Content-Type: application/json
```

Keep your tokens secure to protect against unauthorized access to your resources.

## SPA Application APIs

* The SPA device or companion software obtains a JWT bearer token via an OAuth2 flow.
* Once authenticated, it includes the JWT in its Authorization: Bearer header for all subsequent calls.
* These tokens are ephemeral and are exchanged or renewed automatically by the SPA environment.

## Internal Machine-to-Machine APIs

* Used by Altostrat’s backend services for tasks such as provisioning, deployments, and other internal orchestration.
* Not publicly documented or accessible outside of Altostrat’s secured infrastructure.
* Typically authenticated by ephemeral, short-lived tokens or credentials that are not exposed to end users.

## Summary

* **Developer API:** For external integrations. Uses an API key that issues a Bearer token.
* **SPA APIs:** Consumed by Altostrat’s Single-Board Appliance; uses JWT from OAuth2 for each session.
* **Internal APIs:** Machine-to-machine endpoints; not publicly exposed.

Refer to each API’s documentation for detailed endpoint references, request/response formats, and usage guidelines.


