DomainGuard Monitor · Integration recipes

Make the alert land where the work already happens.

DomainGuard Monitor exposes customer APIs plus signed HTTPS webhooks. The examples below show how a monitoring event can become a ticket, automation step, script input or dashboard signal without giving another system access to the underlying Zeah host.

REST API

List monitored domains with curl

Use a customer programmatic API key for scripts or automation tools.

curl -sS -H "X-DomainGuard-Key: dgmon_..." https://api.zeah.ai/api/public/domain-monitor/domains

PowerShell

Read current portfolio status

Useful for MSP automation, scheduled jobs or a lightweight internal dashboard.

$headers = @{ "X-DomainGuard-Key" = "dgmon_..." }
$status = Invoke-RestMethod -Uri "https://api.zeah.ai/api/public/domain-monitor/status" -Headers $headers
$status.account
$status.average_score
$status.events_last_7d

Python

Pull recent change events

Only change events are returned here; routine stable rescans stay in history without creating noise.

import requests

headers = {"X-DomainGuard-Key": "dgmon_..."}
r = requests.get(
    "https://api.zeah.ai/api/public/domain-monitor/events",
    headers=headers,
    timeout=15,
)
r.raise_for_status()

for event in r.json()["events"]:
    print(event["severity"], event["domain"], event["summary"])

Signed webhook

Verify delivery integrity

Webhook receivers should verify the timestamped HMAC signature before creating a ticket or triggering automation.

import hashlib, hmac

signed = timestamp + "." + raw_body.decode()
expected = "v1=" + hmac.new(
    verification_secret.encode(),
    signed.encode(),
    hashlib.sha256,
).hexdigest()

if not hmac.compare_digest(expected, signature_header):
    raise ValueError("Invalid DomainGuard signature")

MSP automation patterns

Turn posture drift into an operational event.

The webhook payload includes the affected domain, severity, old/new score and individual changes. A receiver decides what should happen next.

PSA / ticketingHIGH or CRITICAL event → create a ticket in HaloPSA, ConnectWise, Autotask or another PSA through its API or an automation platform.

Teams or SlackMEDIUM+ event → route to an operations/security channel with the domain, change summary and remediation guidance.

Client review workflowMonthly automation → fetch report data or CSV → include affected domains and recent events in the client's recurring review.

Website deployment QAAfter a deployment or DNS change → trigger a manual Monitor scan → compare the new posture against the established baseline.

Escalation policyCertificate threshold at 14 days → standard ticket; 7 days → urgent; 3 days → critical escalation.

Security boundary: customer API keys are isolated from DomainGuard service credentials. Webhook targets must use HTTPS on public/global addresses, and webhook events are signed with per-account HMAC-SHA256 verification secrets.

Open DomainGuard Monitor OpenAPI definition →Example MSP report →