/overview

name: "Liongard Overview"
description: >
  Liongard platform fundamentals: the entity model (environments, agents,
  inspectors, launchpoints, systems, detections, metrics, timeline,
  dataprints, asset inventory), X-ROAR-API-KEY authentication against
  instance-scoped URLs, the split between the v1 and v2 APIs, and the
  shared pagination, filtering, and rate-limit conventions.
when_to_use: >-
  When orienting in the Liongard/ROAR API for the first time, resolving Liongard
  terminology, setting up credentials, or deciding which API version and shared
  request conventions apply. Use when: liongard, liongard overview, liongard platform, liongard
  api, roar api, liongard terminology, liongard authentication, or liongard capabilities.

Liongard Platform Overview

What Is Liongard?

Liongard is an automated IT documentation and configuration management platform built for Managed Service Providers (MSPs). It continuously inspects and documents IT environments across hundreds of technology platforms, providing:

• **Automated documentation** of customer IT infrastructure
• **Change detection** to identify configuration drift and anomalies
• **Compliance monitoring** to enforce security baselines
• **Cross-platform visibility** from a single dashboard
• **Historical snapshots** of system configurations over time

Liongard replaces manual documentation processes with automated, scheduled inspections that capture the state of servers, firewalls, cloud services, and more.

Anti-triggers

• **"Agent" meaning an endpoint sensor** — a Liongard agent is one piece

of software per customer *site* that runs inspections against many targets. It is not a per-endpoint monitor and reports nothing about the machine it sits on. For endpoint agents use `atera-agents`, `syncro-assets`, `ncentral-devices`, or `immybot-endpoint-management`; in `halopsa-agents` an agent is a human technician.

• **Doing something about what Liongard found** — Liongard documents and

detects; it does not remediate. Action belongs to the RMM (`ncentral-monitoring-tasks`, `superops-runbooks`, `immybot-script-execution`) or the PSA.

• **Working with a specific entity** — this skill only orients. Go

straight to `liongard-environments`, `liongard-inspections`, `liongard-systems`, or `liongard-detections`.

Key Terminology

Environments

Environments represent customer organizations or sites being monitored. Each environment contains agents, launchpoints, systems, and detections, and can be organized into groups and tiers for logical management. See [references/api.md](references/api.md) for the environment core field table.

Agents

Agents are lightweight software deployed to customer sites that execute inspections. Each agent connects back to the Liongard platform and runs configured inspection tasks on a schedule.

• Agents can be installed on Windows, Linux, or macOS
• Each agent is associated with one or more environments
• Agents report status (Online, Offline, Error)
• Dynamic installer generation available via API

Inspectors

Inspectors are templates defining what to inspect. Liongard provides hundreds of built-in inspectors for common platforms:

• **Active Directory** - Users, groups, policies, domain controllers
• **Microsoft 365** - Tenants, users, licenses, security settings
• **Cisco Meraki** - Networks, devices, VPN, firewall rules
• **VMware vSphere** - Hosts, VMs, datastores, networking
• **Fortinet FortiGate** - Firewall policies, VPN, interfaces
• **SonicWall** - Security policies, VPN, zones
• **Datto** - Backup status, agents, recovery points
• And hundreds more across networking, security, cloud, and backup platforms

Launchpoints

Launchpoints are configured inspection instances that tie together an inspector template, a target environment, an agent, credentials, and a schedule. They represent "run this inspector against this target on this schedule."

| Component | Description | |-----------|-------------| | Inspector | What to inspect (template) | | Environment | Where it belongs (customer) | | Agent | Who runs it (deployed software) | | Credentials | How to authenticate to the target | | Schedule | When to run (cron expression) |

Systems

Systems are discovered items from inspections. When a launchpoint runs, it discovers systems such as servers, firewalls, cloud services, user accounts, and other entities. Each system contains detailed configuration data captured during inspection.

Detections

Detections are automated change and anomaly alerts generated when inspections find differences from previous runs. They enable MSPs to:

• Monitor configuration changes across all clients
• Identify unauthorized modifications
• Track compliance drift
• Alert on security-relevant changes

Metrics

Custom metrics allow MSPs to define and track specific values across systems and environments. Metrics can be evaluated per-system or aggregated across environments.

Timeline

The timeline provides an audit trail of all events and changes within Liongard, including inspection runs, detection triggers, user actions, and system events.

Dataprints

Dataprints provide JMESPath-evaluated data extraction from system details. They allow precise querying of nested configuration data captured during inspections.

Asset Inventory

Asset Inventory (v2) provides identity and device profile management across all inspected environments, aggregating user accounts and devices discovered through inspections.

Authentication

Liongard uses API key authentication via the `X-ROAR-API-KEY` header:

GET /api/v1/environments
X-ROAR-API-KEY: YOUR_API_KEY
Content-Type: application/json

**Required Headers:**

| Header | Value | Description | |--------|-------|-------------| | `X-ROAR-API-KEY` | `{api_key}` | API key from Liongard portal | | `Content-Type` | `application/json` | For POST/PUT requests |

Instance-Based URLs

Liongard uses instance-base