Classify Getting Started: Account Setup & First API Call (2026)

Getting started overview

This guide provides a rapid onboarding path for Classify, focusing on the essential steps to get an account operational and make an initial API request. Classify is an API security platform designed for real-time threat detection, sensitive data discovery, and automated API inventory management. Its agentless architecture facilitates integration with existing cloud infrastructure and API gateways.

The primary steps for getting started with Classify include:

1. Account Creation and Credential Retrieval: Registering for a Classify account and obtaining the necessary API keys or tokens for authentication.
2. Initial Configuration: Setting up the data ingestion mechanism, which typically involves integrating with cloud service provider logs or an API gateway.
3. First API Interaction: Making a programmatic call to verify connectivity and authentication.

A successful initial setup confirms that the Classify platform can receive and process API traffic data, enabling its core functions. For a comprehensive understanding of Classify's capabilities, consult the Classify official documentation.

Here's a quick reference table outlining the key steps:

Create an account and get keys

To begin using Classify, the first step is to create an account. Classify offers custom enterprise pricing, which typically involves a direct engagement process to set up an account tailored to specific organizational needs. This usually begins by contacting their sales team via the Classify website to initiate the onboarding process.

Once an account is provisioned, you will gain access to the Classify dashboard. Within this dashboard, API credentials are provided for programmatic interaction. These credentials typically include:

• API Key: A unique identifier for your application or integration.
• API Secret: A confidential token used in conjunction with the API Key for authentication. This secret should be treated with the same security considerations as a password.

The exact location for retrieving these credentials within the Classify dashboard may vary but is commonly found under sections like "Settings," "API Keys," or "Developer Access." It is critical to store these credentials securely, following best practices for API key management, such as using environment variables or a secure vault system, rather than embedding them directly in code. For example, Google Cloud recommends using environment variables for API keys to prevent accidental exposure.

After obtaining your API key and secret, the next step involves configuring data ingestion. Classify's agentless deployment means it integrates with existing infrastructure. This typically involves:

• Cloud Service Provider (CSP) Log Integration: Connecting Classify to the logging services of your cloud provider (e.g., AWS CloudWatch, Azure Monitor, Google Cloud Logging) to ingest API traffic logs.
• API Gateway Integration: Configuring your API gateway (e.g., Kong Gateway, AWS API Gateway, Google Cloud Endpoints) to forward API traffic data to Classify.

Detailed guides for these integrations are available in the Classify documentation, which provides specific instructions for various cloud environments and API gateways. This setup is crucial for Classify to begin monitoring your API landscape.

Your first request

After creating your account, obtaining API credentials, and configuring data ingestion, the next step is to verify that Classify is receiving and processing your API traffic. While Classify's primary interaction model is agentless monitoring of your existing API traffic, you can make an API request to an endpoint that Classify is configured to monitor to ensure data flow.

The specific API endpoint you would interact with is not an endpoint on Classify itself for direct data submission, but rather one of your own application's APIs that Classify is monitoring via your configured log or gateway integration. The goal here is to generate traffic that Classify should detect.

Let's assume you have configured Classify to monitor an API served through an AWS API Gateway. You would then make a test call to one of your endpoints:

curl -X GET \
  "https://your-api-gateway-url/your-endpoint" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_APPLICATION_AUTH_TOKEN"

Replace https://your-api-gateway-url/your-endpoint with the actual URL of an API endpoint that Classify is configured to monitor. The Authorization header would contain any necessary authentication token for your API, not Classify's.

Upon making this request, Classify, through its integration with your API gateway's logs, should detect this traffic. You can then verify this by logging into your Classify dashboard:

1. Navigate to the API Inventory section.
2. Look for the API endpoint you just called. It should appear, often with initial traffic data.
3. Check the Threats or Analytics sections for any initial insights or classifications related to the traffic.

This verification step confirms that the data ingestion pipeline is functioning correctly and that Classify is successfully collecting and analyzing your API traffic. For specific API calls or interactions with Classify's own management API (if applicable for advanced configurations), refer to the Classify API Reference.

Common next steps

Once you have successfully integrated Classify and verified data ingestion, several common next steps can enhance your API security posture:

1. Review API Inventory: Explore the automatically generated API inventory within the Classify dashboard. This inventory provides a comprehensive view of all discovered APIs, their endpoints, and traffic patterns. This helps identify shadow APIs or undocumented endpoints.
2. Analyze Data Classification: Examine the data classification reports to understand what types of sensitive data (e.g., PII, financial data) are being transmitted through your APIs. This is crucial for compliance and data protection efforts.
3. Configure Alerting: Set up custom alerts based on detected anomalies, policy violations, or specific threat patterns. Classify can integrate with existing security information and event management (SIEM) systems or notification channels to streamline incident response.
4. Define Security Policies: Create and enforce API security policies within Classify. These policies can define acceptable behavior, data handling rules, and access controls, helping to prevent misconfigurations and enforce security best practices.
5. Integrate with CI/CD: For a proactive security approach, integrate Classify into your continuous integration/continuous deployment (CI/CD) pipeline. This allows for early detection of API changes that might introduce vulnerabilities or expose sensitive data. Tools like Tray.io for DevOps automation can facilitate such integrations.
6. Explore Advanced Threat Detection: Familiarize yourself with Classify's advanced threat detection capabilities, including behavioral analytics and machine learning models, to identify sophisticated attacks like API abuse, unauthorized access, and data exfiltration attempts.

Regularly reviewing the Classify dashboard and reports is essential to maintain an up-to-date understanding of your API attack surface and to respond promptly to potential threats. The Classify documentation provides detailed guides for each of these advanced features.

Troubleshooting the first call

Encountering issues during the initial setup or when verifying your first API call with Classify is not uncommon. Here are some common troubleshooting steps:

• No Data in Classify Dashboard:
  • Verify Integration Status: Double-check that your cloud provider log integration or API gateway integration is correctly configured and showing an active status in the Classify dashboard. Refer to the specific Classify integration guides.
  • Check Log Forwarding: Ensure that your cloud provider's logging service is correctly configured to forward API access logs to Classify. For API gateways, confirm that the traffic mirroring or logging export is active and directed to the Classify collector.
  • Time Delay: There might be a short delay (a few minutes) for logs to propagate through your cloud infrastructure and for Classify to process them. Wait a few minutes and refresh the dashboard.
  • Traffic Volume: Ensure that actual traffic is being sent to the monitored API endpoints. If no traffic is generated, Classify will have no data to analyze.
• Authentication Errors (if interacting with Classify's management API directly):
  • Invalid API Key/Secret: Confirm that the API key and secret used are correct and have not been revoked or expired. Regenerate them if necessary from the Classify dashboard.
  • Incorrect Header Format: Ensure that authentication headers are formatted precisely as required by the Classify API Reference.
  • Permissions: Verify that the API credentials have the necessary permissions for the actions being attempted.
• Network Connectivity Issues:
  • Firewall Rules: Ensure that any firewalls or network security groups allow outbound connections from your API gateway/logging service to Classify's ingestion endpoints.
  • Proxy Configuration: If you are behind a corporate proxy, ensure it is correctly configured to allow traffic to Classify's services.
• Dashboard Data Discrepancies:
  • Filtering: Check if any filters are applied in the Classify dashboard that might be hiding the data you expect to see.
  • Time Range: Adjust the time range filter in the dashboard to ensure you are looking at the correct period when the API traffic occurred.

If issues persist after reviewing these steps, consult the Classify support documentation or contact their technical support team for further assistance. Providing logs from your API gateway or cloud provider can help expedite the troubleshooting process.