Universal Connector
One front door for any device, sensor, effector, unit, or partner system. Announce what you are and what you speak — get identity, permissions, and your exact endpoints in one response. Data flows to the COP within seconds. Kinetic actions always require a human.
Easy Connect — 3 steps
1Register
POST /api/connect/register with {name, partyClass, protocols}. You get a connection token, a permission template for your class, and the exact ingest endpoints for the protocols you declared.
2Send data
Your protocol, our adapters: CoT/TAK XML, USEIF JSON, acoustic spectra, ADS-B, MQTT, field cues. Add header X-Atlas-Connection: <token> for attribution.
3Watch it flow
Observations fuse into COP contacts (FUSION:*), stream out as TAK CoT, and feed intel BLUF automatically. Your connection health is tracked live below — heartbeat keeps it ACTIVE.
Copy-paste onboarding
Register a sensor:
curl -X POST https://secureassure.app/api/connect/register \
-H "content-type: application/json" \
-d '{"name":"3rd BCT SDR mast 2","partyClass":"sensor","protocols":["useif-json"]}'
Send an observation (attributed):
curl -X POST https://secureassure.app/api/observations/ingest \
-H "content-type: application/json" \
-H "X-Atlas-Connection: atlas_conn_..." \
-d '{"sensorType":"RF","position":{"lat":31.88,"lon":-81.60,"alt":120,"cep_m":150},
"velocity":{"heading_deg":210,"speed_mps":16,"climb_mps":0},
"identification":{"category":"UAS","specificType":"UNK-UAS","iff":"UNKNOWN","trackId":"demo-1","callsign":"DEMO"},
"confidence":0.7,"timestamp":"2026-07-12T13:00:00Z","protocol":"USEIF","sourceDomain":"AIR","signatureData":{}}'
Bulk unit onboarding (MTOE) — JSON or CSV
Don't register one device at a time. POST your unit's MTOE-style equipment manifest — every line item is auto-classified (Raven → sensor, PRC-163 → unit/CoT, SMASH → effector, ATAK EUD → partner-C2), qty expands into individually-tokened items, and the whole roster comes back in one response. Unit-level revocation kills everything under the UIC; item-level revocation kills one serial.
curl -X POST https://secureassure.app/api/connect/register-unit \
-H "content-type: application/json" \
-d '{"unit":{"name":"A Co, 3-15 IN","uic":"WABCA0","echelon":"company"},
"equipment":[
{"lin":"U09517","nomenclature":"RQ-11B Raven SUAS","qty":3},
{"lin":"R67890","nomenclature":"AN/PRC-163 leader radio","qty":12},
{"nomenclature":"Smart Shooter SMASH 2000L","qty":2},
{"nomenclature":"ATAK EUD","qty":24}]}'
# → unit token + per-item roster: connectionId, token, partyClass, and the exact ingest endpoint for each device
Or upload a spreadsheet export directly — CSV/TSV with a header row (columns lin, nomenclature, qty, serials — aliases accepted). The S4 exports MTOE to CSV; no reformatting needed:
curl -X POST "https://secureassure.app/api/connect/register-unit/csv?unit=A%20Co%203-15%20IN&uic=WABCA0" \
-H "content-type: text/csv" --data-binary @unit_mtoe.csv
# header row + data rows → same tokened roster as the JSON path
Identity: HMAC token or X.509 client certificate (PKI)
Every registration returns an HMAC token (send as X-Atlas-Connection). For stronger asymmetric identity, request a client certificate — signed by the ATLAS Connection Root CA, verified on every call, fingerprint stored server-side. Both are accepted; the cert wins when present.
curl -X POST "https://secureassure.app/api/connect/register?pki=1" \
-H "content-type: application/json" \
-d '{"name":"3rd BCT SDR mast 2","partyClass":"sensor","protocols":["useif-json"]}'
# → { token, pki: { certPem, privateKeyPem (shown ONCE), fingerprintSha256 } }
# then present the cert: -H "X-Atlas-Client-Cert: <base64 PEM>"
# CA for chain validation: GET /api/connect/ca.pem
Scope enforcement (runtime-flippable)
Permission templates are enforced by mode — inspect at
/api/connect/enforcement.
attribute (default) tracks every caller without blocking;
warn logs violations;
enforce returns 403 on missing identity or insufficient scope. Admin flips it live:
POST /api/connect/enforcement {"mode":"enforce"} with
X-Admin-Secret — no redeploy. Effector-class connections can never gain
observations:ingest; kinetic stays human-gated regardless of mode.
Party classes & permission templates
| Class | Scopes granted at registration | Note |
|---|
sensor | observations:ingest · heartbeat | RF / acoustic / EO-IR / radar nodes |
effector | cue:receive · heartbeat | Engagement never automatic — human approval via USEIF kill-chain gate (IRON RULE 5) |
unit | cop:read · tak:stream · observations:ingest · heartbeat | Squads, EOCs, coalition elements |
partner-c2 | cot:ingest · cot:stream · observations:ingest · heartbeat | TAK servers, partner C2, Unity/XR consumers |
feed | tracks:pull · heartbeat | Read-only consumers (dashboards, viz) |
citizen | cue:ingest · heartbeat | Phone field cues, personal safety lane |
Live connection registry
Conductor sweeps every 60s: ACTIVE (<5 min) → IDLE (<30 min) → STALE. Every transition writes an append-only audit row.
Conductor status ·
Registry JSON
| Name | Class | Protocols | Health | Last seen | Obs | Heartbeats | Source |
|---|
| Loading… |
Where the data goes
- Fusion: observations correlate across modalities → fused tracks at /api/fusion/tracks (CoT / Link-16 / VMF / GeoJSON via
?format=)
- COP: fused tracks appear as
FUSION:* contacts on /cop; CoT ingest lands on the inbound layer
- TAK: everything streams out at
GET /api/tak/stream (SSE) and datapackage.zip for ATAK/WinTAK
- Intel: alerts raise BLUF + COA options — options presented, never executed; human decides
- Audit: registration, health transitions, and revocations are append-only ledger rows — a state change without an audit row is the product failing at its own thesis