https://aegiswhite.com/_next/static/chunks/9223-6d981f03c590007a.js

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[9223],{39223:(e,t,o)=>{o.d(t,{hp:()=>u,Ld:()=>p});let n=JSON.parse('{"baseUrlNote":"All endpoints are relative to your portal domain, the same domain your customers use, for example https://yourbrand.portal.aegiswhite.com or your custom portal domain. Your API key is bound to that domain: calls to any other portal domain are rejected with 403 TENANT_MISMATCH.","portTiers":{"critical":[{"port":3306,"label":"MySQL"},{"port":5432,"label":"PostgreSQL"},{"port":27017,"label":"MongoDB"},{"port":6379,"label":"Redis"},{"port":3389,"label":"RDP"},{"port":5900,"label":"VNC"},{"port":23,"label":"Telnet"},{"port":445,"label":"SMB"},{"port":139,"label":"NetBIOS"}],"high":[{"port":22,"label":"SSH (assume no key auth)"},{"port":21,"label":"FTP"},{"port":25,"label":"SMTP"},{"port":110,"label":"POP3"},{"port":143,"label":"IMAP"},{"port":8080,"label":"HTTP Alt"},{"port":8443,"label":"HTTPS Alt"}],"medium":[{"port":8000,"label":"Common dev port"},{"port":3000,"label":"Node.js"},{"port":5000,"label":"Flask"},{"port":9000,"label":"PHP-FPM"},{"port":4000,"label":"Development"},{"port":5001,"label":"Development"}]},"domainLeakSeverities":{"employees":"critical","customers":"high","third_parties":"medium"},"firewallFormats":["iptables","nftables","ufw","firewalld"],"module":{"version":"1.9.0","fields":[{"key":"api_url","label":"Aegis API URL","type":"text","default":"https://portal.aegiswhite.com","description":"The base URL for the Aegis API (e.g., https://portal.aegiswhite.com). A full API URL ending in /api/v1 is also accepted and trimmed back to the base URL."},{"key":"api_key","label":"API Key","type":"password","default":"","description":"Your Aegis API key for authentication"},{"key":"debug_mode","label":"Debug Mode","type":"yesno","default":"no","description":"Enable verbose logging for troubleshooting"},{"key":"bcc_admin_emails","label":"BCC Admin on Customer Actions","type":"yesno","default":"no","description":"Send a copy of customer action confirmation emails to the system admin email address"},{"key":"sandbox_mode","label":"Sandbox Mode","type":"yesno","default":"yes","description":"Enable sandbox mode for testing. No real scans will be performed."},{"key":"sandbox_scenario","label":"Sandbox Scenario","type":"dropdown","default":"warnings","description":"Select the mock scan result scenario for testing (warnings = web ports, clean = no issues, critical = database ports)","options":["warnings","clean","critical"]},{"key":"upgrade_url","label":"Customer Upgrade URL","type":"text","default":"","description":"URL where customers manage or upgrade their plan. Sent to the portal with the pricing sync and used for customer plan links whenever a product cart link is not available. Leave blank to use your client area URL."},{"key":"endpoint_creation_mode","label":"Endpoint Creation Mode","type":"dropdown","default":"any","description":"Controls whether customers can add any IP/hostname or only IPs from their active WHMCS products","options":["any","whmcs_only"]},{"key":"domain_learn_more_url","label":"Domain Monitoring Learn More URL","type":"text","default":"","description":"URL shown on the \\"Domain Monitoring is not active\\" page (e.g., a marketing or docs page). Leave blank to hide the button entirely."}]},"downloads":{"moduleZip":"https://portal.aegiswhite.com/downloads/aegis-whmcs-module.zip","firewallAgent":"https://portal.aegiswhite.com/downloads/aegis-firewall-agent.sh"},"scanSources":[{"source":"nmap","description":"Active scans across the full port range, run by the platform\'s scanning service on demand and on schedule.","provenance":"app/Models/Scan.php docblock; app/Jobs/DispatchNmapScanJob.php"},{"source":"shodan","description":"Passive internet-wide exposure data and continuous monitor alerts per IP.","provenance":"app/Models/Scan.php docblock; app/Services/ShodanApiClient.php"}],"alertStatuses":["open","acknowledged","resolved","false_positive"],"alertStatusesProvenance":"app/Http/Controllers/Api/AlertController.php index() validation","alertSeverities":["critical","high","medium","low"],"alertSeveritiesProvenance":"app/Http/Controllers/Api/AlertController.php index() validation; config/risk-scoring.php","remediationPlatforms":["ufw","iptables","aws_sg","gcp_fw","azure_nsg","generic"],"remediationPlatformsProvenance":"app/Http/Controllers/Api/AlertController.php remediation() validation","digestFrequencies":["immediate","hourly","daily","weekly"],"digestFrequenciesProvenance":"app/Models/User.php docblock (digest_frequency)","notificationChannels":[{"channel":"Email","description":"On by default for every account."},{"channel":"Slack","description":"Connected per account via Slack OAuth; alert messages include interactive buttons."},{"channel":"Telegram","description":"Connected per account with a bot token pairing."}],"notificationChannelsProvenance":"app/Models/User.php notification preference fields; routes/web.php SlackOAuthController, SlackInteractionController","domainLeakCategories":[{"category":"employees","meaning":"Credentials on your own domain\'s mailboxes (staff accounts)."},{"category":"customers","meaning":"Credentials of users who registered on your services with the monitored domain."},{"category":"third_parties","meaning":"Credentials exposed through unrelated third-party sites."}],"domainLeakCategoriesProvenance":"app/Models/DomainLeakAlert.php SEVERITY_MAP + category docblocks"}'),a={slug:["api"],title:"API Overview",description:"Base URL, authentication, response envelopes, rate limits and conventions for the AegisWhite REST API.",track:"api",blocks:[{kind:"p",text:"The AegisWhite REST API is the same interface our WHMCS module is built on. Everything the module does, your own integration can do. Use it to provision monitoring from any billing system, embed security data in your own dashboards, or automate customer sign-in."},{kind:"cards",items:[{title:"Endpoint Reference",text:"Browse every operation with parameters, examples, error codes and code samples — or download the OpenAPI 3.1 document for your own tooling.",href:"/docs/api/reference"}]},{kind:"h2",text:"Base URL"},{kind:"p",text:n.baseUrlNote},{kind:"code",language:"text",title:"Base URL",code:"https://{your-portal-domain}/api/v1"}

1,{kind:"callout",tone:"info",text:"Your portal domain and API key are shown together in the portal under **WHMCS Integration** settings. Use exactly that pairing."},{kind:"h2",text:"Authentication"},{kind:"p",text:"Authenticate with a bearer token: your **partner API key**, generated in the portal (Settings → WHMCS Integration). The key authenticates as your whole partner account, so treat it like a root credential: store it server-side, never in client-side code, and regenerate it immediately if it leaks. It is shown only once at generation time."},{kind:"code",language:"text",title:"Request headers",code:"Authorization: Bearer {your-api-key}\nContent-Type: application/json\nAccept: application/json"},{kind:"p",text:"On the endpoints that read or change customer-level data, pass `whmcs_customer_id` to scope the call to one customer. The API refuses cross-customer access on those calls with `403 Access denied`."},{kind:"h2",text:"Response envelopes"},{kind:"p",text:"The provisioning, SSO, alerts, domain-monitoring and sandbox groups wrap results in a `success` envelope. The Allowed Ports and Endpoints groups return standard Laravel resource envelopes (`data` / `links` / `meta`) instead. The response example on each operation in the [Endpoint Reference](/docs/api/reference) shows the exact shape it returns."},{kind:"code",language:"json",title:"Success envelope",code:'{\n  "success": true,\n  "data": { },\n  "meta": {\n    "version": "v1",\n    "timestamp": "2026-07-12T09:30:00+00:00"\n  }\n}'},{kind:"code",language:"json",title:"Error envelope",code:'{\n  "success": false,\n  "error": {\n    "code": "ENDPOINT_NOT_FOUND",\n    "message": "No endpoint with that ID belongs to your account.",\n    "details": { }\n  },\n  "meta": {\n    "version": "v1",\n    "timestamp": "2026-07-12T09:30:00+00:00"\n  }\n}'},{kind:"p",text:'Validation failures return `422` with `"status": "error"`, a `message`, and an `errors` map of field names to problems.'},{kind:"h2",text:"Errors every endpoint can return"},{kind:"table",headers:["Status","Meaning"],rows:[["401","Missing or invalid API key (`Unauthenticated.`)."],["422","Request validation failed. See the `errors` map."],["429","Rate limit exceeded. Retry after the `Retry-After` header."]]},{kind:"p",text:"The provisioning and SSO groups additionally verify the key/domain pairing on every call: `403 TENANT_MISMATCH` means the API key does not belong to the portal domain you called (check your base URL), and `403 ACCOUNT_SUSPENDED` means your partner account is suspended."},{kind:"h2",text:"Rate limits"},{kind:"p",text:"Provisioning, SSO, alerts, domain-monitoring and firewall-ingest endpoints allow **60 requests per minute per API key**. Endpoints without a stricter limit fall back to the platform default of 100 requests per minute. Sandbox endpoints are not rate limited. `429` responses include a `Retry-After` header. Back off and retry."},{kind:"h2",text:"Versioning"},{kind:"p",text:"The current API version is `v1`, carried in every path and echoed in the `meta.version` of enveloped responses. Backwards-incompatible changes will ship under a new version prefix."},{kind:"h2",text:"Sandbox mode"},{kind:"p",text:"With sandbox mode enabled on your account, send `X-Aegis-Sandbox: true` on provisioning calls to simulate them end-to-end: no real scans run. See the Sandbox section of the [Endpoint Reference](/docs/api/reference) for scenario control, and the [WHMCS troubleshooting guide](/docs/whmcs/troubleshooting) for the module-driven flow."},{kind:"h2",text:"Health check"},{kind:"p",text:"Verify connectivity and your base URL with the unauthenticated health endpoint before wiring credentials:"},{kind:"code",language:"bash",title:"GET /api/v1/health",code:"curl https://{your-portal-domain}/api/v1/health"},{kind:"code",language:"json",title:"Response — 200",code:'{\n  "success": true,\n  "status": "ok",\n  "timestamp": "2026-07-12T09:30:00+00:00",\n  "meta": {\n    "version": "v1"\n  }\n}'}]};function i(e){return n.portTiers[e].map(e=>"".concat(e.port).concat(e.label?" (".concat(e.label,")"):"")).join(", ")}function s(){return{kind:"table",headers:["Severity","Triggered by"],rows:[["**Critical**","Exposed data stores and remote access: ports ".concat(i("critical"),".")],["**High*

1*","Unencrypted or commonly attacked services: ports ".concat(i("high"),".")],["**Medium**","Application and development servers: ports ".concat(i("medium"),".")],["**Low**","Standard web ports (80, 443) and anything not in a higher tier."]]}}function r(){return{kind:"table",headers:["Category","Severity","What it means"],rows:n.domainLeakCategories.map(e=>["`".concat(e.category,"`"),"**".concat(n.domainLeakSeverities[e.category],"**"),e.meaning])}}let d=[{slug:["partners","getting-started"],title:"Getting Started",description:"From partner registration to your first monitored endpoint: approval, the onboarding wizard, and where your API key lives.",track:"partners",blocks:[{kind:"p",text:"AegisWhite is sold through partners: you resell security monitoring to your own customers under your own brand, at your own prices. This guide takes you from a fresh registration to a working, branded portal."},{kind:"h2",text:"Create and activate your account"},{kind:"steps",items:[{title:"Register",text:"Sign up at [portal.aegiswhite.com/partner/register](https://portal.aegiswhite.com/partner/register) with your company details."},{title:"Verify your email",text:"Click the verification link we send you. Unverified registrations are never activated."},{title:"Wait for approval",text:"New partner accounts are reviewed before activation. You will be notified by email. Until then the portal shows a pending screen."},{title:"Complete the onboarding wizard",text:"On first login a five-step checklist walks y

1ou through account details, branding, your portal domain, WHMCS connection and a test provision."}]},{kind:"h2",text:"Your portal domain"},{kind:"p",text:"Every partner gets a dedicated portal domain (a subdomain of `portal.aegiswhite.com`, or your own custom domain once configured; see [White-Label Setup](/docs/partners/white-label)). Your customers sign in there, and your API calls go there too: the API is served from **your** portal domain, not a shared central host."},{kind:"h2",text:"Your API key"},{kind:"p",text:"The onboarding wizard issues your partner API key, and you can regenerate it any time under **Settings → WHMCS Integration**. The key is shown **once**. Store it in your WHMCS module configuration (or your own integration) immediately. Regenerating invalidates the previous key."},{kind:"callout",tone:"info",text:"New accounts start in **sandbox mode**, so you can test provisioning end-to-end without real scans. It switches off when onboarding completes. See [Troubleshooting & Sandbox](/docs/whmcs/troubleshooting)."},{kind:"h2",text:"Where to go next"},{kind:"cards",items:[{title:"White-Label Setup",text:"Brand the portal and emails as your own.",href:"/docs/partners/white-label"},{title:"WHMCS Module",text:"Install the addon and start selling.",href:"/docs/whmcs/installation"},{title:"Monitoring & Alerts",text:"How scanning, alerts and Allowed Ports work.",href:"/docs/partners/monitoring"},{title:"API Reference",text:"Integrate without WHMCS.",href:"/docs/api"}]}]},{slug:["partners","white-label"],title:"White-Label Setup",description:"Branding, custom domains and your own SMTP: make the portal and every email your customers see carry your brand.",track:"partners",blocks:[{kind:"p",text:"Everything your customers touch can carry your brand. Branding lives under **Settings → Branding**; domains and mail settings have their own sections in the admin area."},{kind:"h2",text:"Branding settings"},{kind:"table",headers:["Setting","Notes"],rows:[["Service name","Shown everywhere in place of the default product name."],["Logo","PNG or SVG, up to 2 MB; shown in the portal header and emails."],["Favicon","PNG or ICO."],["Colors","Primary, accent and call-to-action colors; hover and contrast shades are derived automatically."],["Alert colors","You can inherit alert severity colors from your palette. Critical always stays red for safety."],["Font family","Applied portal-wide."],['"Powered by" attribution',"Optional footer credit; off means fully unbranded."],["Email sender","From-name and from-address, plus company name, address, support email/URL and unsubscribe text used in email footers."]]},{kind:"p",text:"The branding page includes a live **email template preview** and a test-send button, so you can check the result before a customer ever sees it."},{kind:"h2",text:"Custom domains"},{kind:"steps",items:[{title:"Add your domain",text:"Under **Custom Domains**, add the hostname you want the portal to live on (for example `security.yourbrand.com`)."},{title:"Point DNS at us",text:"Create the CNAME record shown on the domain page, then run the built-in DNS verification."},{title:"Provision SSL",text:"One click issues a certificate for the domain and activates it. Your customers (and your API calls) can then use the new domain."}]},{kind:"h2",text:"Send email from your own domain"},{kind:"p",text:"By default, notification email is delivered by the platform using your branded sender details. If you want mail to originate from your own infrastructure, add your SMTP credentials under **Mail Settings**. There is a connection test and a test-send so you can verify delivery before switching over."},{kind:"callout",tone:"warning",text:"After changing sender domains, watch your first real alert deliveries: SPF/DKIM records for your domain must cover whichever route you chose, or customer mail servers may reject alerts."}]},{slug:["partners","customers"],title:"Managing Customers",description:"How customer accounts are created, suspended and restored, how plan changes work, and how to see the portal as a customer sees it.",track:"partners",blocks:[{kind:"p",text:"Your customers each get their own login to your branded portal and see only their own endpoints, domains and alerts. Customer accounts are usually created automatically the first time you provision a service for them (via WHMCS or the API); you can also create them manually in the portal."},{kind:"h2",text:"The customer list"},{kind:"p",text:"The **Customers** section lists every account with its services and status, and exports to CSV for reporting. From a customer's page you can create services, change plans and manage lifecycle."},{kind:"h2",text:"Lifecycle"},{kind:"table",headers:["Action","Effect"],rows:[["Suspend","Sign-in blocked and monitoring paused; nothing is deleted."],["Unsuspend","Restores access and resumes monitoring."],["Terminate","Ends the customer relationship; their services stop and the account is closed."],["Restore","Brings back a terminated customer if you need to undo."]]},{kind:"p",text:"If you bill through WHMCS, let the module drive these transitions from your billing events (unpaid → suspend, cancelled → terminate) so billing and monitoring never disagree. See [Products & Provisioning](/docs/whmcs/products-provisioning)."},{kind:"h2",text:"Plan changes"},{kind:"p",text:"Upgrades take effect immediately. Downgrades are checked against the customer's current usage first. A customer using 8 domain slots can't drop to a 5-slot plan until they remove domains."},{kind:"h2",text:"View as customer"},{kind:"p",text:"Use **View as customer** (masquerade) on any customer to see exactly what they see, invaluable for support. Masquerade sessions are read-only for destructive actions, and every masquerade is recorded."}]},{slug:["partners","monitoring"],title:"Monitoring, Alerts & Allowed Ports",description:"How endpoints are scanned, how findings become alerts, what the severity levels mean, and how Allowed Ports keep the noise down.",track:"partners",blocks:[{kind:"h2",text:"Endpoints and groups"},{kind:"p",text:"An **endpoint** is one monitored server, identified by IP address (hostnames are resolved when added). Endpoints belong to a customer, can be paused and resumed individually or in bulk, and can be organized into **groups** with one-click scan-all. Scan history per endpoint exports to CSV."},{kind:"h2",text:"How scanning works"},{kind:"table",headers:["Source","What it does"],rows:n.scanSources.map(e=>["`".concat(e.source,"`"),e.description])},{kind:"p",text:"Scanning is continuous: background discovery runs on a schedule that scales with the customer's plan, and full scans verify findings. Customers (and you) can also trigger an on-demand scan per endpoint, subject to a per-endpoint cooldown."},{kind:"h2",text:"From open port to alert"},{kind:"list",ordered:!0,items:["A scan finds the endpoint's open ports.","Each open port is checked against the customer's **Allowed Ports** rules.","Every open port with no matching rule raises an alert (duplicates are suppressed: an existing open alert is updated, not repeated).","When a later scan shows the port closed, the alert **resolves itself**."]},{kind:"h2",text:"Severity levels"},{kind:"p",text:"Severity comes from what the exposed port implies, escalated further when banners reveal outdated software:"},s(),{kind:"p",text:"Alerts move through the statuses `open` → `acknowledged` → `resolved` (or `false_positive`), and every alert carries a plain-language explanation plus copy-paste remediation commands for common firewalls."},{kind:"h2",text:"Allowed Ports"},{kind:"p",text:"**Allowed Ports** rules declare which ports are supposed to be open, so expected services never alert. A rule covers a port or range plus protocol, applies to one endpoint or globally, requires a written justification, and can expire. Creating a rule that matches an open alert resolves that alert automatically; rules can be bulk-imported and exported as CSV."}

1,{kind:"callout",tone:"info",text:"Alert emails include one-click links to view, allow the port, or acknowledge. Customers can act without signing in first."},{kind:"h2",text:"The firewall map"},{kind:"p",text:"For each customer you can visualize firewall connectivity as an interactive map: which endpoints accept what, focus views per endpoint, and reachability analysis. Feed it by pasting firewall rules in the portal, or install the collector script (downloadable from the portal) which submits `iptables`/`nftables`/`ufw`/`firewalld` dumps on a schedule via the [Firewall Ingest API](/docs/api/reference#tag/firewall-ingest)."}]},{slug:["partners","domain-monitoring"],title:"Domain Monitoring",description:"Watch customer domains for leaked credentials and dark-web mentions, and understand the category severities.",track:"partners",blocks:[{kind:"p",text:"Domain monitoring watches a customer's domain for **leaked credentials** (from a breach-intelligence dataset) and **dark-web mentions**. It is sold in domain slots: a customer's subscription quantity sets how many domains they can monitor."},{kind:"h2",text:"What a finding means"},r(),{kind:"p",text:"Findings arrive as domain alerts of type `credential_leak` or `dark_web_mention`. Each alert counts how many newly-affected accounts appeared and links to the underlying records, including password-strength context where available."},{kind:"h2",text:"Working an alert"},{kind:"list",ordered:!0,items:["**Acknowledge** the alert so it is marked as seen.","Force password resets (or other cleanup) for the affected accounts.","**Resolve** the alert once handled. An alert must be acknowledged before it can be resolved."]},{kind:"h2",text:"Free lookup tools"},{kind:"p",text:"The portal also includes a free one-time **domain search** and a **breach check** for emails, usernames or domains, useful during sales conversations to show a prospect their current exposure before they buy monitoring."}]},{slug:["partners","notifications-billing"],title:"Notifications & Billing",description:"Alert channels and digest schedules, plus wholesale invoices, your partner balance and revenue reporting.",track:"partners",blocks:[{kind:"h2",text:"Notification channels"},{kind:"table",headers:["Channel","Notes"],rows:n.notificationChannels.map(e=>[e.channel,e.description])},{kind:"p",text:"Each user chooses a digest frequency (".concat(n.digestFrequencies.map(e=>"`".concat(e,"`")).join(", "),") so alerts arrive one-by-one or bundled. Manual scan results can notify immediately regardless of the digest setting.")},{kind:"h2",text:"Wholesale billing"},{kind:"p",text:"You buy monitoring at wholesale and charge your customers whatever you like. The **Billing** section lists your wholesale invoices with PDF downloads and pay-now, and your **Balance** page tracks earnings and lets you request withdrawals."},{kind:"h2",text:"Revenue reporting"},{kind:"p",text:"The **Revenue** dashboard charts your monthly recurring revenue against wholesale cost per product and customer (fed by the `mrr` you pass when provisioning). Monthly reports and CSV exports are built in."},{kind:"callout",tone:"info",text:"Pass `mrr` on every provision call (the WHMCS module does this automatically). Without it, revenue reports only know your costs, not your margins."}]}],l=[...d,{slug:["whmcs","installation"],title:"Installation",description:"Requirements, download and activation for the AegisWhite WHMCS addon module.",track:"whmcs",blocks:[{kind:"p",text:"The WHMCS addon module (current version **".concat(n.module.version,"**) connects your WHMCS installation to your monitoring portal: it provisions services automatically from your order flow, and gives your customers a security dashboard inside your existing client area.")},{kind:"h2",text:"Requirements"},{kind:"list",items:["WHMCS 8.0 or newer","PHP 8.1 or newer with the `curl`, `json`, `pdo_mysql`, `openssl` and `mbstring` extensions","Outbound HTTPS from your WHMCS server to your portal domain"]},{kind:"h2",text:"Install the module"},{kind:"steps",items:[{title:"Download",text:"Get the module zip from your partner dashboard, or directly: [aegis-whmcs-module.zip](".concat(n.downloads.moduleZip,").")},{title:"Upload",text:"Extract the archive into your WHMCS installation so the module lives at `modules/addons/aegis/`."},{title:"Activate",text:"In the WHMCS admin area go to **Configuration → System Settings → Addon Modules**, activate *Aegis Security Monitoring*, and grant access to the admin roles that should manage it."},{title:"Configure",text:"Enter your portal URL and API key. See [Configuration](/docs/whmcs/configuration) for every field."},{title:"Test",text:"Use the module's **Test API** button to confirm connectivity, then run a sandbox provision before going live."}]}

1,{kind:"callout",tone:"info",text:"Upgrading? Overwrite `modules/addons/aegis/` with the new files. The module migrates its own database tables on next load. Your configuration is kept."}]},{slug:["whmcs","configuration"],title:"Configuration",description:"Every module setting, its default and what it does, generated from the module itself.",track:"whmcs",blocks:[{kind:"p",text:"Module settings live in the WHMCS admin under **Configuration → Addon Modules → Aegis Security Monitoring → Configure**."},{kind:"table",headers:["Setting","Type","Default","What it does"],rows:n.module.fields.map(e=>["**".concat(e.label,"** (`").concat(e.key,"`)"),e.options?"one of: ".concat(e.options.join(", ")):e.type,""===e.default?"—":"`".concat(e.default,"`"),e.description])},{kind:"h2",text:"The two settings that matter most"},{kind:"p",text:"**Aegis API URL** must be your portal domain, the same domain your customers use. Your API key is bound to that domain; pointing the module at a different portal host fails with `TENANT_MISMATCH`."},{kind:"p",text:"**API Key** comes from your portal under **Settings → WHMCS Integration**. It is revealed once when generated. If you lose it, regenerate (the old key stops working immediately)."},{kind:"callout",tone:"warning",text:"**Sandbox Mode** ships enabled so new installs cannot trigger real scans by accident. Turn it off when you go live. While it is on, provisioning is simulated and customers see mock scan data."}]},{slug:["whmcs","products-provisioning"],title:"Products & Provisioning",description:"Map WHMCS products to monitoring services and let order/lifecycle hooks provision everything automatically.",track:"whmcs",blocks:[{kind:"h2",text:"Map your products"},{kind:"p",text:"On the module's **Products** tab, enable each WHMCS product that should carry monitoring and map it to a product type:"},{kind:"table",headers:["Product type","What gets provisioned"],rows:[["`endpoint`","One monitored endpoint per service, using the service's dedicated IP (hosting/server products)."],["`port_monitoring`","A port-monitoring subscription on a plan tier (`starter`, `professional`, `business`), for standalone monitoring products."],["`domain_monitoring`","A domain-monitoring subscription with a slot quantity. Customers then add the domains themselves."]]},{kind:"h2",text:"Automatic provisioning"},{kind:"p",text:"Once mapped, the module hooks your normal WHMCS lifecycle (accepting an order, payment, module create, package changes, suspend/unsuspend/terminate) and mirrors each event to the monitoring platform. Provisioning is idempotent: retrying a hook never creates duplicates. Plan upgrades and downgrades flow through automatically when a service's package changes."},{kind:"p",text:"Under the hood these hooks call the [Provisioning API](/docs/api/reference#tag/provisioning). Anything the module does automatically, you can also do directly."},{kind:"h2",text:"Admin tools"},{kind:"list",items:["**Dashboard**: provisioning metrics, success rate and endpoint counts at a glance.","**Endpoints**: every monitored service with per-service provision / suspend / resume / terminate buttons; manually-created endpoints are labeled.","**Tools**: bulk provisioning for existing customers, retry for failed provisions, manual IP entry, and **Sync** to reconcile WHMCS services against the platform.","**Logs**: every API call the module makes, with request and response payloads (secrets are never logged)."]},{kind:"callout",tone:"info",text:"Rolling the module out to an existing customer base? Map the products, then use **Tools → Bulk provisioning** once. It walks your active services and provisions each one."}]},{slug:["whmcs","client-area"],title:"The Client Area",description:"What your customers see inside WHMCS: dashboard, endpoints, security issues, domain monitoring and Allowed Ports.",track:"whmcs",blocks:[{kind:"p",text:"Customers with an active monitoring service get a **Security** section in your WHMCS client area: no separate login, your branding throughout. It has five pages:"},{kind:"table",headers:["Page","What it shows"],rows:[["**Dashboard**","Issue c

1ounts by severity, how many endpoints are protected, and the most recent findings."],["**Endpoints**","Their monitored servers: add, edit, delete, and trigger an on-demand scan. Endpoint detail shows the latest scan, open issues, and which ports appeared or disappeared."],["**Security Issues**",'Alert list and detail with plain-language explanations, copy-paste fix commands per firewall platform, an *"I\'ve Fixed This"* resolve button and one-click *Allow this port*.'],["**Domain Monitoring**","Monitored domains with credential-leak and dark-web findings, and the acknowledge/resolve workflow."],["**Allowed Ports**","The customer's Allowed Ports rules: create, edit and delete, with justification fields."]]},{kind:"h2",text:"Single sign-on to the full portal"},{kind:"p",text:"A **View Security Dashboard** button takes the customer from WHMCS into your branded portal without a second login (the module mints an [SSO token](/docs/api/reference#tag/sso) and redirects). The portal adds the richer views: scan history, the firewall map, notification preferences."},{kind:"h2",text:"Two settings shape this experience"},{kind:"list",items:["**Endpoint Creation Mode**: `any` lets customers add any IP or hostname; `whmcs_only` restricts them to IPs from their active WHMCS products.",'**Customer Upgrade URL**: where "upgrade your plan" buttons send customers (usually your WHMCS cart); leave blank for a neutral message.']},{kind:"p",text:"Writing help material for your customers? The [Customer Guide](/docs/customers/dashboard) is written brand-neutrally so you can link or adapt it as your own."}]},{slug:["whmcs","troubleshooting"],title:"Troubleshooting & Sandbox",description:"Test connectivity, read the module logs, decode common API errors, and use sandbox mode safely.",track:"whmcs",blocks:[{kind:"h2",text:"First checks"},{kind:"list",items:["**Test API** (module admin) calls the health endpoint with your configured URL and key. Run it after any configuration change.","**Logs** (module admin) record every API call with payloads. Enable **Debug Mode** temporarily for more detail."]},{kind:"h2",text:"Common errors"},{kind:"table",headers:["Error","Cause and fix"],rows:[["`TENANT_MISMATCH` (403)","The API key does not belong to the domain in *Aegis API URL*. Set the URL to **your** portal domain, the one shown next to the key in portal settings."],["`Unauthenticated.` (401)","Missing or stale API key. Regenerate in the portal and update the module config."],["`ACCOUNT_SUSPENDED` (403)","Your partner account is suspended. Contact support."],["`ENDPOINT_LIMIT_EXCEEDED` / `DOMAIN_LIMIT_EXCEEDED` (403)","The customer's plan is full. Upgrade the plan or free a slot, then retry from **Tools**."],["`DNS_RESOLUTION_FAILED` (422)","A hostname the customer added does not resolve. Have them use the IP directly."],["`RATE_LIMITED` (429)","Manual scans have a per-endpoint cooldown; the response says how long to wait. The module surfaces this to customers automatically."]]},{kind:"h2",text:"Sandbox mode"},{kind:"p",text:"With **Sandbox Mode** on, the module sends `X-Aegis-Sandbox: true` on provisioning calls, so everything is simulated: no scans run and no wholesale charges accrue. Pick the mock scenario in the module settings: `clean` (no issues), `warnings` (web ports) or `critical` (database ports). Your test customers see matching mock results."},{kind:"p",text:"Sandbox auto-disables when your onboarding completes; it can be re-enabled from the portal for later testing. The [Sandbox API](/docs/api/reference#tag/sandbox) exposes the same controls for custom integrations."},{kind:"h2",text:"Still stuck?"},{kind:"p",text:"Collect the relevant module log entries (they include request IDs) and [contact us](/contact). Partner support responds fast."}]},{slug:["customers","dashboard"],title:"Your Security Dashboard",description:"What the security dashboard shows and where to find it, a guide you can share with your own customers.",track:"customers",blocks:[{kind:"callout",tone:"info",title:"For partners",text:"This guide (and the rest of the Customer Guide track) is written brand-neutrally, so you can link your customers straight to it, or copy and adapt it under your own brand."},{kind:"p",text:"Your security dashboard continuously watches your servers and domains and turns what it finds into clear, fixable **security issues**. You will find it in your hosting provider's client area under **Security**, or via the *View Security Dashboard* button."},{kind:"h2",text:"What you see"},{kind:"list",items:["**Issue counts by severity**: how many open findings you have, from critical down to low.","**Protected endpoints**: how many of your servers are being monitored.","**Recent issues**: the newest findings, each linking to a full explanation and fix."]},{kind:"h2",text:"The golden path"},{kind:"steps",items:[{title:"Add your servers",text:"Each server you add is scanned automatically from then on."},{title:"Allow what you expect",text:"Tell the dashboard which ports are supposed to be open (your website, your mail server) so they never alarm."},{title:"Fix what alerts",text:"Everything else that shows up gets an explanation and copy-paste fix commands."}]}]},{slug:["customers","endpoints-scans"],title:"Endpoints & Scans",de

1scription:"Adding servers to monitoring, how scanning works, and how to read scan results.",track:"customers",blocks:[{kind:"p",text:"An **endpoint** is one server being monitored, identified by its IP address. Add one with its IP (or hostname, which is resolved when you save) and a nickname so you recognize it later."},{kind:"h2",text:"When scans happen"},{kind:"list",items:["**Automatically**: your servers are checked continuously in the background; you never have to schedule anything.","**On demand**: every endpoint has a *Scan now* button. Manual scans have a short cooldown between runs, shown on the page."]},{kind:"h2",text:"Reading a scan result"},{kind:"table",headers:["Field","Meaning"],rows:[["Open ports","Every port on the server that answered from the public internet."],["New ports","Ports open now that were not open in the previous scan, worth a look."],["Closed ports","Ports that were open before and are closed now."],["Detected services","What appears to be running (web server, database, mail…), inferred from ports and banners."]]},{kind:"callout",tone:"success",text:"An open port is not automatically a problem. A web server is *supposed* to answer on 443. Ports you expect belong in [Allowed Ports](/docs/customers/allowed-ports); everything else raises an issue."}]},{slug:["customers","security-issues"],title:"Security Issues",description:"What an issue means, how severities are ranked, and the fix-and-resolve workflow with ready-made commands.",track:"customers",blocks:[{kind:"p",text:"A **security issue** (alert) means a scan found a port open to the internet that you have not marked as expected. Each issue explains, in plain language, what the port is, why it matters, and exactly how to close it."},{kind:"h2",text:"Severity levels"},s(),{kind:"h2",text:"Fixing an issue"},{kind:"steps",items:[{title:"Open the issue",text:"Read the explanation. It says what is exposed and what the risk is."},{title:"Choose your platform",text:"Fix commands are generated for your firewall: ".concat(n.remediationPlatforms.map(e=>"`".concat(e,"`")).join(", "),". Copy, review, run.")},{title:"Mark it fixed",text:"Click **I've Fixed This**. If a later scan still finds the port open, the issue comes back, so you know for sure."}]},{kind:"callout",tone:"warning",text:"Closing some ports can lock you out (SSH, remote desktop). When a fix is risky, the commands come with a warning. Read it before you run anything."},{kind:"h2",text:"Issues resolve themselves too"},{kind:"p",text:"If a scan finds a previously-alerted port closed, the issue is resolved automatically. And if the port was actually supposed to be open, use **Allow this port** on the issue. That creates an Allowed Ports rule and resolves the issue in one step."}]},{slug:["customers","allowed-ports"],title:"Allowed Ports",description:"Declare the ports that are supposed to be open so expected services never raise alarms.",track:"customers",blocks:[{kind:"p",text:'**Allowed Ports** are your "this is fine" list: the services you run on purpose. Anything on the list never raises a security issue; anything off the list does. A good list is what makes every alert you receive worth reading.'},{kind:"h2",text:"What a rule contains"},{kind:"table",headers:["Field","Meaning"],rows:[["Port / range","One port (443) or a range (8000–8100)."],["Protocol","TCP, UDP, or both."],["Scope","One specific server, or all of your servers."],["Justification","A sentence on why the port is open. Future-you (and your audits) will thank you."],["Expiry","Optional: the rule stops applying after a date, great for temporary services."]]},{kind:"h2",text:"Two ways to add one"},{kind:"list",items:["From the **Allowed Ports** page: create a rule from scratch.","From an open issue: **Allow this port** pre-fills the rule and resolves the issue in one click."]},{kind:"callout",tone:"info",text:"Deleting a rule does not close the port. It just means the port will raise an issue again on the next scan."}]},{slug:["customers","domain-monitoring"],title:"Domain Monitoring",description:"Leaked credentials and dark-web mentions for your domain: what the findings mean and what to do about them.",track:"customers",blocks:[{kind:"p",text:"Domain monitoring watches your domain against leaked credential records and dark-web sources. When credentials tied to your domain show up somewhere they should not be, you get an alert."},{kind:"h2",text:"Reading a finding"},r(),{kind:"p",text:"There are two kinds of findings: **credential leaks** (actual leaked usernames/passwords, counted per category above) and **dark-web mentions** (posts or listings that reference your domain)."},{kind:"h2",text:"What to do when an alert arrives"},{kind:"steps",items:[{title:"Acknowledge it",text:"Marks the finding as seen and stops reminder nudges."},{title:"Reset the affected passwords",text:"Employee accounts first. They unlock the most. Enable two-factor authentication where you can."},{title:"Resolve the alert",text:"Once handled, mark it resolved. (Alerts must be acknowledged before they can be resolved.)"}]}

1,{kind:"callout",tone:"info",text:"Leaks are found in public and criminal data sets. An alert does not mean your server was hacked. It usually means someone reused a password on a site that got breached, or caught malware on their own device."}]},a,{slug:["api","reference"],title:"Endpoint Reference",description:"Every /api/v1 operation with parameters, request and response examples, error codes and ready-to-run code samples in your language.",track:"api",standalone:!0}],c={partners:"Partner Guide",whmcs:"WHMCS Module",customers:"Customer Guide",api:"API Reference"},u=["partners","whmcs","customers","api"].map(e=>({track:e,title:c[e],items:l.filter(t=>t.track===e).map(e=>({slug:e.slug,title:e.title,description:e.description}))})).filter(e=>e.items.length>0);function p(e){let t=u.flatMap(e=>e.items),o=t.findIndex(t=>t.slug.join("/")===e.join("/"));return -1===o?{}:{prev:o>0?t[o-1]:void 0,next:o<t.length-1?t[o+1]:void 0}}}}]);