LykanShield protection layer

REST API

Share attack intelligence and retrieve aggregated protection data over hardened HTTPS.

Read integration guide View source on GitHub →

Overview

Signed communication with resilient delivery

The Lykan client sends JSON to the HTTPS-only service endpoint. Every call includes the API key, normalized host, minute-based timestamp signature, strict TLS verification, timeouts, response validation, and redirect rejection. Security reports are queued locally so blocking a request does not depend on network latency.

Request lifecycle

How it works

  1. 01

    Sign request

    SHA-512 binds the API key, normalized host, and current minute.

  2. 02

    Send securely

    cURL enforces HTTPS, TLS peer verification, timeouts, and no redirects.

  3. 03

    Recover safely

    Reports are queued with limits and retried after the response or by a worker.

Implementation

Technical details

  • Supports GET, POST, and bounded DOWNLOAD operations.
  • Accepts only explicit HTTP 2xx responses.
  • Rejects redirects to prevent credentials reaching another endpoint.
  • get_lock() retrieves decoded aggregate data for a domain and time window.

Retrieve statistics

<?php
require __DIR__ . '/includes/lykan.class.php';
lykan_config::$config['apikey'] = getenv('LYKAN_API_KEY');
$statistics = lykan::get_lock(30, 10);
if ($statistics === null) {
    error_log('Lykan API request failed');
}