Back to Dashboard
LiteSOCAPI Docs
v1.0

LiteSOC API

Lightweight Security Observability for Modern Apps

LiteSOC is a lightweight security observability tool that helps you track, analyze, and respond to security events in your application. With a single API endpoint, you can capture authentication events, admin actions, data access, and security incidents.

Fast Integration

Single endpoint, no SDK required. Works with any language.

Geo-IP Detection

Automatic location tracking and impossible travel detection.

25+ Event Formats

Automatic normalization from legacy formats to our standard schema.

Authentication

All API requests require authentication using an API key. Include your API key in thex-api-keyheader with every request.

HTTP Header
x-api-key: lsoc_your_api_key_here

Quick Start

Send your first security event in under a minute:

1

Get your API key

Copy your key from Dashboard → Settings → API

2

Send an event

POST to the collect endpoint:

Endpoint
POST https://litesoc.io/api/v1/collect
3

View in Dashboard

Events appear in real-time on your dashboard

IP Address Tracking

IP Field Reference

FieldSourceUsed For
user_ipYou send thisGeo-IP, Impossible Travel, Brute Force
server_ipAuto-detectedAudit trail only

How to Extract User IP

Most web frameworks provide helpers, but behind a reverse proxy (nginx, Cloudflare), you need to check headers:

JavaScript
// Common pattern for extracting real user IP
function getUserIP(request) {
  return (
    request.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
    request.headers['x-real-ip'] ||
    request.connection?.remoteAddress ||
    '127.0.0.1'
  );
}

Event Normalizer

LiteSOC accepts 25+ event formats and automatically normalizes them to our standard schema. This means you can migrate from existing logging systems without changing your event names.

Example Normalizations
Send any of these formats—they'll be normalized automatically
user.login.failedauth.login_failed
permission.deniedauthz.access_denied
privilege.escalationadmin.privilege_escalation
rate_limit.exceededsecurity.rate_limit_exceeded

Standard Events

LiteSOC defines 20 standard security events organized into 5 categories. Events marked as criticaltrigger instant alerts on all plans.

auth.login_success

User successfully authenticated

info
auth.login_failed

Failed authentication attempt

warning
auth.logout

User session ended

info
auth.password_reset

Password reset requested or completed

info
auth.mfa_enabled

Multi-factor authentication activated

info
auth.mfa_disabled

Multi-factor authentication deactivated

warning

authz.access_denied⚡ Instant Alert

User denied access to a resource

critical
authz.role_changed⚡ Instant Alert

User role or permissions modified

critical
authz.permission_granted

New permission assigned to user

info

admin.user_created

New user account created

info
admin.user_deleted

User account removed

warning
admin.privilege_escalation⚡ Instant Alert

User gained elevated permissions

critical
admin.settings_changed

System or organization settings modified

info
admin.api_key_created

New API key generated

info

data.export

Data exported from the system

info
data.bulk_delete⚡ Instant Alert

Large-scale data deletion

critical
data.sensitive_access⚡ Instant Alert

Access to sensitive or private data

critical

security.suspicious_activity⚡ Instant Alert

Anomalous or suspicious behavior detected

critical
security.rate_limit_exceeded

API rate limit hit

warning
security.ip_blocked

IP address blocked due to suspicious activity

warning

Code Examples

Copy-paste examples for popular frameworks. All examples show how to properly extract and forward the end-user's IP address.

typescript
// lsoc.ts - TypeScript SDK wrapper
interface Actor {
  id?: string;
  email?: string;
}

interface TrackEventOptions {
  event: string;
  actor: Actor;
  userIP: string;
  metadata?: Record<string, unknown>;
}

const LSOC_API_KEY = process.env.LSOC_API_KEY!;
const LSOC_ENDPOINT = 'https://litesoc.io/api/v1/collect';

export async function trackEvent({
  event,
  actor,
  userIP,
  metadata = {},
}: TrackEventOptions): Promise<{ status: string; quota: { remaining: number } }> {
  const response = await fetch(LSOC_ENDPOINT, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': LSOC_API_KEY,
    },
    body: JSON.stringify({
      event,
      actor,
      user_ip: userIP,
      metadata,
    }),
  });

  if (!response.ok) {
    throw new Error(`LiteSOC API error: ${response.status}`);
  }

  return response.json();
}

// Extract user IP from headers (works with Express, Fastify, etc.)
export function getUserIP(headers: Record<string, string | string[] | undefined>): string {
  const forwarded = headers['x-forwarded-for'];
  if (forwarded) {
    const ip = Array.isArray(forwarded) ? forwarded[0] : forwarded.split(',')[0];
    return ip.trim();
  }
  
  const realIP = headers['x-real-ip'];
  if (realIP) {
    return Array.isArray(realIP) ? realIP[0] : realIP;
  }
  
  return '127.0.0.1';
}

// Usage example
await trackEvent({
  event: 'auth.login_success',
  actor: { id: 'user_123', email: 'user@example.com' },
  userIP: getUserIP(req.headers),
  metadata: { method: 'oauth', provider: 'google' },
});

Response Codes

CodeStatusDescription
202AcceptedEvent queued for processing
400Bad RequestInvalid JSON or missing required fields
401UnauthorizedMissing or invalid API key
403ForbiddenMonthly event limit reached or account suspended
429Too Many RequestsRate limit exceeded, retry after cooldown

Example Responses

JSON
{
  "status": "queued",
  "quota": {
    "remaining": 4999,
    "limit": 5000
  }
}

Plan Features

LiteSOC offers three tiers with progressively more powerful threat detection capabilities.

Free
$0/mo
For side projects and testing
5,000 events/month
Basic brute force detection
Critical event alerts
Email notifications
ProPopular
$29/mo
For growing teams
100,000 events/month
Impossible Travel detection
Geo-Anomaly detection
Slack & Discord webhooks
Strict brute force (5 attempts)
Enterprise
$99/mo
For security-conscious orgs
Unlimited events
Custom Threat Models
IP Whitelisting (CIDR support)
SAML/OIDC Single Sign-On
Compliance audit logs
Priority support

Threat Detection

LiteSOC automatically analyzes your security events to detect threats in real-time.

Brute Force Detection
All Plans
Detects repeated failed login attempts from the same IP. Free plan triggers at 20 failures in 15 minutes; Pro/Enterprise triggers at 5 failures in 5 minutes.
Impossible Travel
Pro+
Detects when a user logs in from two geographically distant locations within an impossibly short timeframe (e.g., NYC to Tokyo in 10 minutes).
Geo-Anomaly Detection
Pro+
Alerts when a user logs in from a new country for the first time, or from high-risk regions. Learns your organization's normal geographic patterns.
Custom Threat Models
Enterprise
Build your own detection rules. Define conditions like "5+ data.export events from the same user in 10 minutes" and get custom alerts with your chosen severity.
Critical Event Alerts
All Plans
Instant notifications for high-severity events like admin.privilege_escalation,data.bulk_delete, andsecurity.suspicious_activity.

Enterprise SSOEnterprise

Configure SAML 2.0 or OIDC-based Single Sign-On for your organization. Enterprise SSO allows your team members to authenticate using your identity provider (IdP) such as Okta, Azure AD, Google Workspace, or OneLogin.

Setting Up SAML SSO
  1. Navigate to Dashboard → Settings → SSO
  2. Enter your Identity Provider Metadata URL (e.g., https://your-idp.com/app/metadata.xml)
  3. Configure the SSO domain (your company email domain like company.com)
  4. Copy the SP Entity ID and ACS URL to your IdP configuration
  5. Enable SSO and test with a team member
SSO Login Flow

When SSO is enabled, users with matching email domains will see a "Login with Enterprise SSO" button on the login page. The flow automatically detects the SSO domain from the email address.

// Automatic domain detection on login
user@company.comSSO enabledRedirect to IdP

Audit LogsPro & Enterprise

Comprehensive audit logging tracks all administrative actions and security-relevant events across your organization. Essential for compliance (SOC 2, GDPR, HIPAA) and security investigations.

Tracked Actions

Organization

  • settings.updated
  • billing.plan_changed
  • api_key.regenerated

Security

  • sso.enabled
  • ip_whitelist.updated
  • retention.changed
Compliance Export

Export audit logs as CSV for compliance reporting and external analysis. Navigate to Dashboard → Settings → Audit Logs and use the export functionality.

Exports include: timestamp, actor (user email), action type, IP address, user agent, and detailed metadata for each event.

IP WhitelistingEnterprise

Restrict API access to specific IP addresses or CIDR ranges. This provides an additional layer of security by ensuring events can only be sent from known, trusted infrastructure.

CIDR Notation Support

Configure IP whitelists using individual IPs or CIDR notation for entire ranges:

192.168.1.100 // Single IP
10.0.0.0/24 // 256 IPs (10.0.0.0 - 10.0.0.255)
172.16.0.0/16 // 65,536 IPs (172.16.0.0 - 172.16.255.255)
10.0.0.0/8 // Entire 10.x.x.x range
Configuration
  1. Go to Dashboard → Settings → Security
  2. Enable IP Whitelisting
  3. Add your trusted IPs or CIDR ranges (one per line)
  4. Save changes — API requests from non-whitelisted IPs will be rejected with 403 Forbidden

⚠️ Ensure you include all IPs where your application runs, including CI/CD servers and staging environments.