Public developer area for Security Center.

<?php
function medpov_security_api(string $endpoint, string $apiKey, string $siteId, string $action, array $params = [], string $method = 'GET'): array
{
    $method = strtoupper($method);
    $url = $endpoint . '?action=' . rawurlencode($action);

    $headers = [
        'Authorization: Bearer ' . $apiKey,
        'Accept: application/json',
    ];
    if ($siteId !== '') $headers[] = 'X-MEDPOV-Site-ID: ' . $siteId;

    $body = null;
    if ($method === 'GET' && $params) {
        $url .= '&' . http_build_query($params);
    } elseif ($params) {
        $headers[] = 'Content-Type: application/json';
        $body = json_encode($params, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    }

    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_TIMEOUT => 20,
        CURLOPT_CONNECTTIMEOUT => 8,
    ]);

    if ($body !== null) {
        curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    }

    $raw = curl_exec($ch);
    $error = curl_error($ch);
    $status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);

    if ($raw === false || $raw === '') {
        return ['ok' => false, 'status' => $status, 'message' => $error ?: 'Empty API response'];
    }

    $json = json_decode($raw, true);
    if (!is_array($json)) {
        return ['ok' => false, 'status' => $status, 'message' => 'Invalid JSON response', 'raw' => $raw];
    }

    $json['_http_status'] = $status;
    return $json;
}

$endpoint = 'https://example.com/security-center/admin/api/remote-access.php';
$apiKey = 'mpsec_YOUR_API_KEY';
$siteId = 'site_xxxxxxxxx'; // Discover with GET action=sites (without this header).

$overview = medpov_security_api($endpoint, $apiKey, $siteId, 'overview');
$ipProfile = medpov_security_api($endpoint, $apiKey, $siteId, 'ip-profile', ['ip' => '8.8.8.8', 'refresh' => 1]);
$block = medpov_security_api($endpoint, $apiKey, $siteId, 'block-ip', [
    'ip' => '203.0.113.45',
    'minutes' => 1440,
    'reason' => 'Remote confirmed abusive traffic',
], 'POST');

const endpoint = 'https://example.com/security-center/admin/api/remote-access.php';
const apiKey = process.env.MEDPOV_SECURITY_API_KEY;
const siteId = process.env.MEDPOV_SECURITY_SITE_ID;

async function securityApi(action, params = {}, method = 'GET') {
  const url = new URL(endpoint);
  url.searchParams.set('action', action);

  const options = {
    method,
    headers: {
      Authorization: `Bearer ${apiKey}`,
      Accept: 'application/json'
    }
  };
  if (siteId) options.headers['X-MEDPOV-Site-ID'] = siteId;

  if (method === 'GET') {
    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, String(value)));
  } else {
    options.headers['Content-Type'] = 'application/json';
    options.body = JSON.stringify(params);
  }

  const res = await fetch(url, options);
  const data = await res.json();
  if (!res.ok || data.ok === false) throw new Error(data.message || `API error ${res.status}`);
  return data;
}

const overview = await securityApi('overview');
const mapBoth = await securityApi('map', { mode: 'both', live_range: 'live', include_curve_points: 1 });
const critical = await securityApi('events', { risk: 'CRITICAL', resolved: 0, limit: 20 });