Armor
Armor (legal name Armor Defense Inc.) is a cybersecurity company headquartered in Plano, Texas, founded as FireHost in 2009 by Chris Drake and rebranded as Armor as its portfolio expanded from secure cloud hosting into managed security. Armor sells vendor-agnostic, cloud-native managed detection and response (Armor MDR), compliant managed private cloud (Armor Enterprise Cloud), the Armor Agent workload protection agent (formerly Armor Anywhere), and compliance and offensive-security professional services, to more than 1,700 organizations across 40 countries with a 24/7 follow-the-sun SOC operating from Plano, London, Singapore and Pune. Armor publishes a public developer portal at developer.armor.com that serves sixteen machine-readable contracts through ReDoc: four Swagger 2.0 documents for the original v1 Armor Services API on api.armor.com (account management, infrastructure, security and support, 254 operations) and twelve OpenAPI 3.0.3 documents for the v2 platform on *.api.secure-prod.services (accounts, agent management, compliance and CSPM, container security, incident management, infrastructure management, log management, notifications, webhooks, the unified MDR public API, and the ARMOR-PSK and FH-AUTH authentication contracts). Armor also publishes a detailed first-party llms.txt at armor.com/llms.txt and holds SOC 2 Type II, HITRUST CSF, PCI DSS Level 1 Service Provider, ISO 27001, TX-RAMP Level 2, HIPAA and Data Privacy Framework attestations.
Real signal across most facets with visible, nameable gaps — the contract exists but is thin, or the portal is good while governance and commercial terms are absent.
API Evangelist profiles Armor the way a machine reads it — 147 machine-readable artifacts across 70 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Armor scores 50.9/100 (developing), with a separate agent-readiness read of 51/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-08-17 · rubric v0.11.0
Put this on your own site. The badge is drawn live from Armor's current Kin Score — paste it once and it updates itself every time the score is recomputed. It follows your visitor's light or dark setting, and it links back here so anyone who sees it can read the full breakdown.
<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/armor/"
title="Armor on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/armor.svg"
alt="Armor Kin Score — API readiness rating by API Evangelist" width="150" height="150" loading="lazy">
</a>[](https://providers.apievangelist.com/providers/armor/)<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/armor/"
title="Armor on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/armor/card.svg"
alt="Armor Kin Score — API readiness rating by API Evangelist" width="340" height="120" loading="lazy">
</a>More shapes, themes and sizes → · Score as JSON · How badges work
How we profile Armor
Each block below is one kind of artifact we hold for Armor. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 70
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Armor Access Control Lists API
Operations for managing ACLs (deprecated)
Armor Account API
Account management operations
Armor Account Management API
The Account Management API from Armor — 47 operation(s) for account management.
Armor Account Primary Billing API
The AccountPrimaryBilling API from Armor — 1 operation(s) for accountprimarybilling.
Armor Active Response API
The ActiveResponse API from Armor — 1 operation(s) for activeresponse.
Armor Advanced Backup API
The Advanced Backup API from Armor — 38 operation(s) for advanced backup.
Armor AIP - Entity Intelligence API
Threat intelligence data for security entities
Armor AIP - Incident Data API
AI-processed incident data and analytics
Armor Assessments API
Assessment account management
Armor Authentication API
FH-AUTH authentication flow endpoints. ## Flow Overview 1. POST `/auth/authorize` with credentials → receive authorization code 2. POST `/auth/token` with code → receive access ...
Armor Cloud Connections API
Cloud connection management operations
Armor Connector API
Connector management operations
Armor CSPM Connector API
Cloud Security Posture Management cloud connectors
Armor CSPM Control Remediation API
CSPM control remediation information
Armor CSPM Policies API
CSPM policy management
Armor CSPM Policy Controls API
CSPM policy controls management
Armor CSPM Report API
CSPM report operations
Armor CSPM Report Configuration API
CSPM report configuration management
Armor CSPM Resources API
CSPM resource management
Armor CSPM Summary API
CSPM cloud connector summary
Armor CSPM Usage API
CSPM cloud connector usage
Armor Defender - Investigation API
Investigation package and live response operations
Armor Defender - Machine Actions API
Execute and manage actions on Microsoft Defender machines
Armor Defender - Machines API
Microsoft Defender machine/device management
Armor Detection Rules API
Operations for retrieving and managing detection rules
Armor Detections API
The detection resource enables an API customer to build a webhook detection configuration.
Armor EDR API
Endpoint Detection and Response operations
Armor Events API
The event-type resource enables an API user to maintain the event types.
Armor Flow Sources API
Operations for managing flow sources
Armor Health API
Service health and monitoring endpoints
Armor Health Monitoring Status API
Health monitoring status operations
Armor Image API
Image management operations
Armor Infrastructure API
The Infrastructure API from Armor — 35 operation(s) for infrastructure.
Armor JSM - Incidents API
Security incident management
Armor JSM - Metrics API
Metrics aggregation and reporting
Armor JSM - Organizations API
JSM organization management
Armor JSM - Service Requests API
Service request management
Armor Keys API
The Keys API from Armor — 2 operation(s) for keys.
Armor Log Endpoints API
Operations for managing log endpoints
Armor Log Groups API
Operations for managing log groups
Armor Log Sources API
Operations for managing log sources
Armor Malware Configuration API
Malware configuration APIs. These APIs are only available for specific partners.
Armor Meta API
Meta resources and utility operations
Armor Network Services API
The Network Services API from Armor — 23 operation(s) for network services.
Armor Notifications API
The notification resource enables an API customer to build a webhook notification configuration.
Armor Preferences API
The Preferences resource describes a list of user-level preferences.
Armor Registry API
Registry management operations
Armor Reports - MSR API
Monthly Security Report file management and retrieval
Armor Scheduled Tasks API
The tasks resource enables an API customer to schedule, cancel and view agent CLI operations.
Armor Secure Notes API
The secure notes resource allows users to securely store and manage sensitive information such as passwords, credentials, and other confidential data.
Armor Security Analytics API
The Security Analytics API from Armor — 2 operation(s) for security analytics.
Armor Security API
The Security API from Armor — 29 operation(s) for security.
Armor Security Detection Events API
Security detection event operations
Armor Security Detections API
Security detection operations
Armor Security Detections Overview API
Security detections overview operations
Armor Security Incidents API
The Security Incidents API from Armor — 2 operation(s) for security incidents.
Armor Sensor API
Sensor management operations
Armor Support API
The Support API from Armor — 16 operation(s) for support.
Armor Tags API
Tag management operations
Armor TI - Customer Intelligence API
Customer-specific threat intelligence
Armor TI - GraphQL API
Proxy endpoint for OpenCTI GraphQL queries
Armor TI - Threat Actors API
Retrieve threat actor intelligence data
Armor Toolbox API
Infrastructure management toolbox operations
Armor Tours API
The tours resource describes a list of UI tours that help users learn about features in the ARMOR Management Portal. The preferences stored in this resource aid the portal in de...
Armor Trend API
Trend AV report operations
Armor User API
User profile and account information
Armor Utilization API
The Utilization API from Armor — 2 operation(s) for utilization.
Armor VS Exclusions API
Vulnerability scan exclusions management
Armor VS Reports API
Vulnerability scan reports
Armor Vulnerability Scanning API
Vulnerability scanning operations
Scroll within the panel for all 70 ·
Open Collections 71
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
API Collection
OPEN COLLECTIONArmor Log Management Access Control Lists API
OPEN COLLECTIONContainer Security Account API
OPEN COLLECTIONArmor Services Account Management API
OPEN COLLECTIONArmor Services Account Primary Billing API
OPEN COLLECTIONArmor Services Active Response API
OPEN COLLECTIONArmor Services Advanced Backup API
OPEN COLLECTIONMDR Public AIP - Entity Intelligence API
OPEN COLLECTIONMDR Public AIP - Incident Data API
OPEN COLLECTIONArmor Compliance Assessments API
OPEN COLLECTIONArmor FH-AUTH Security Authentication API
OPEN COLLECTIONAccounts Cloud Connections API
OPEN COLLECTIONContainer Security Connector API
OPEN COLLECTIONArmor Compliance CSPM Connector API
OPEN COLLECTIONArmor Compliance CSPM Control Remediation API
OPEN COLLECTIONArmor Compliance CSPM Policies API
OPEN COLLECTIONArmor Compliance CSPM Policy Controls API
OPEN COLLECTIONArmor Compliance CSPM Report API
OPEN COLLECTIONArmor Compliance CSPM Report Configuration API
OPEN COLLECTIONArmor Compliance CSPM Resources API
OPEN COLLECTIONArmor Compliance CSPM Summary API
OPEN COLLECTIONArmor Compliance CSPM Usage API
OPEN COLLECTIONMDR Public Defender - Investigation API
OPEN COLLECTIONMDR Public Defender - Machine Actions API
OPEN COLLECTIONMDR Public Defender - Machines API
OPEN COLLECTIONMDR Public Detection Rules API
OPEN COLLECTIONArmor Webhooks Detections API
OPEN COLLECTIONIncident Management EDR API
OPEN COLLECTIONArmor Webhooks Events API
OPEN COLLECTIONArmor Log Management Flow Sources API
OPEN COLLECTIONMDR Public Health API
OPEN COLLECTIONAgent Management Health Monitoring Status API
OPEN COLLECTIONContainer Security Image API
OPEN COLLECTIONArmor Services Infrastructure API
OPEN COLLECTIONMDR Public JSM - Incidents API
OPEN COLLECTIONMDR Public JSM - Metrics API
OPEN COLLECTIONMDR Public JSM - Organizations API
OPEN COLLECTIONMDR Public JSM - Service Requests API
OPEN COLLECTIONArmor Services Keys API
OPEN COLLECTIONArmor Log Management Log Endpoints API
OPEN COLLECTIONArmor Log Management Log Groups API
OPEN COLLECTIONArmor Log Management Log Sources API
OPEN COLLECTIONAgent Management Malware Configuration API
OPEN COLLECTIONArmor Log Management Meta API
OPEN COLLECTIONArmor Services Network Services API
OPEN COLLECTIONArmor Webhooks Notifications API
OPEN COLLECTIONNotifications Preferences API
OPEN COLLECTIONContainer Security Registry API
OPEN COLLECTIONMDR Public Reports - MSR API
OPEN COLLECTIONAgent Management Scheduled Tasks API
OPEN COLLECTIONAccounts Secure Notes API
OPEN COLLECTIONArmor Services Security Analytics API
OPEN COLLECTIONArmor Services Security API
OPEN COLLECTIONIncident Management Security Detection Events API
OPEN COLLECTIONIncident Management Security Detections API
OPEN COLLECTIONIncident Management Security Detections Overview API
OPEN COLLECTIONArmor Services Security Incidents API
OPEN COLLECTIONContainer Security Sensor API
OPEN COLLECTIONArmor Services Support API
OPEN COLLECTIONAgent Management Tags API
OPEN COLLECTIONMDR Public TI - Customer Intelligence API
OPEN COLLECTIONMDR Public TI - GraphQL API
OPEN COLLECTIONMDR Public TI - Threat Actors API
OPEN COLLECTIONInfrastructure Management Toolbox API
OPEN COLLECTIONAccounts Tours API
OPEN COLLECTIONIncident Management Trend API
OPEN COLLECTIONArmor User API
OPEN COLLECTIONArmor Services Utilization API
OPEN COLLECTIONArmor Compliance VS Exclusions API
OPEN COLLECTIONArmor Compliance VS Reports API
OPEN COLLECTIONArmor Compliance Vulnerability Scanning API
OPEN COLLECTIONScroll within the panel for all 71 ·
MCP Servers 1
Model Context Protocol servers expose these APIs directly to AI agents. We profile them because agent-native access is the fastest-growing way this provider's capabilities actually get used.
Model Context Protocol servers that expose these APIs to AI agents.
armor-mcp.yml
MCP SERVEREvent Specifications 1
Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.
AsyncAPI definitions for this provider's event-driven and streaming APIs.
Armor Webhooks Events
ASYNCAPISecurity Posture 2
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Scopes 1
OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.
OAuth scopes governing access to this provider's APIs.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Resources
Every other property we hold for Armor — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 2
Portal, sign-up, and the first successful call
Documentation 2
Reference material describing how the API behaves
Agent Surfaces 4
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 6
Pagination, idempotency, versioning, errors, and events
Build 3
SDKs, sample code, and the tooling you integrate with
Access & Security 4
Authentication, authorization, and security posture
Operate 2
Status, limits, changes, and where to get help
Commercial 3
Pricing, plans, and the legal terms of use
Company 2
The organization behind the API
Other 1
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/armor · machine-readable index on apis.io
This is an independent, third-party profile of Armor, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.