REST API

Everything in the UI is backed by a REST API under /api/v1 - ~390 endpoints across ~60 modules. This page covers authentication and the module map; the interactive schema is always available at /docs (Swagger / OpenAPI) on your instance.

Live schema

Open https://<your-host>/api/v1/docs for the auto-generated, try-it-out OpenAPI explorer with every endpoint, parameter and model.

Authentication

Two credential types, both sent as a bearer token:

Type	Prefix	Use
Session JWT	-	Browser sessions (login → MFA).
API token (PAT/SAT)	apt_	Programmatic / CI/CD. Scoped + revocable.

curl -H "Authorization: Bearer apt_xxx" https://<host>/api/v1/vulnerabilities

• Create tokens under Account Security. A token carries scopes; a read-only token is rejected by write/expense endpoints (e.g. starting a CI run).
• Session JWTs respect MFA, token_version revocation and the pre-MFA challenge.

Conventions

• Base path: /api/v1
• Content: JSON (multipart for source/SARIF uploads on CI/import).
• Errors: standard HTTP codes + { "detail": "..." }.
• Paging: list endpoints take limit / offset; many take filters (application_id, status, severity, …).
• Audit: state-changing calls are written to the Audit Log.

Module map

Area	Base	What it covers
Auth & accounts	/auth, /users, /tokens, /sso, /rbac	login, MFA, users, API tokens, SSO, roles/permissions
Assets	/applications, /targets, /projects, /target-groups, /discovery, /integrations	inventory, repos, recon, SCM links
Findings	/vulnerabilities, /findings, /assessments, /imports, /mutes, /acceptances	unified findings, triage, import, risk acceptance
DAST / scans	/scans, /schedules, /events, /exploit	crawl + active scan, autonomous pentest, scheduling
Code security	/sast, /sca, /secrets, /iac, /containers, /repositories	SAST, SCA, secrets, IaC, container/image
API security	/api-security	OpenAPI audit, OWASP API Top 10
Kubernetes	/k8s-posture, /k8s-runtime	CIS posture + runtime detections
Intelligence	/threat-intel, /graph, /threat-models	KEV/EPSS, attack-chain graph, threat models
CI/CD	/ci, /gate, /scm/webhook	pipeline agent, security gate, webhook scanning
Governance	/policies, /rules, /compliance, /sla	policies, rule engine, compliance, SLA
Reporting	/reports, /posture, /bi, /evidence	reports, posture score, BI, evidence packages
AI	/assistant	NL query, copilot, briefings
Admin	/branding, /templates, /notifications, /health_monitor, /backups, /audit	branding, templates, notifications, health, backup/DR, audit

Quick examples

# list open critical vulnerabilities for an app
curl -H "Authorization: Bearer apt_xxx" \
  "https://<host>/api/v1/vulnerabilities?application_id=APP&severity=critical"

# evaluate the CI gate
curl -X POST -H "Authorization: Bearer apt_xxx" \
  -d '{"application_id":"APP","commit":"HEAD"}' \
  https://<host>/api/v1/gate/evaluate

# trigger a scan
curl -X POST -H "Authorization: Bearer apt_xxx" \
  -d '{"target_id":"TGT","profile":"standard"}' \
  https://<host>/api/v1/scans

See the CLI & CI Agent for the pipeline agent, and the in-app /docs explorer for the full, typed schema.