Developer reference

API Reference

Build a complete offensive-security workflow: register a target, launch and monitor scans, retrieve evidence, export reports, and recheck remediation.

Try the API Create API key

Connect safely

Create a paid-plan key with api:access, store it as a masked CI secret, and send it with every request. Mutating operations require an editor or owner role in the selected workspace.

Authentication

Automation (paid plans): create an API key in Settings → Security → API keys. Keys must include the api:access scope for REST endpoints. Send the secret as either:

Request header

X-API-Key: ab_YOUR_KEY
# Alternative: Authorization: Bearer ab_YOUR_KEY

Free plan: you cannot create or use REST API keys. CI / PR result ingestion uses the ci:scan:write scope and the /ci-scans/... routes. One API key may include both ci:scan:write and api:access.

Workspace header

Targets, scans, findings, and reports are scoped to a workspace (personal or team), same as the dashboard:

Request header

X-Org-Context: personal
# or the team's normalized organization domain, for example example.com

Base URL

https://agentbreach.com/api/v1

Append the endpoint paths below to this URL. The reference automatically uses the current Agent Breach API origin.

Interactive OpenAPI

Use Swagger to try public routes and ReDoc to inspect their schemas. This guide adds workflow, report, and recovery behavior that a raw schema cannot explain.

Swagger UI ReDoc

From target to verified result

The usual automation flow has five steps. Each card links to a complete request and representative response.

1
Register the target
Define the authorized paths and save the returned target id.
2
Queue a scan
Choose a profile and save the new scan id before doing anything else.
3
Wait for a terminal state
Poll the scan record with a timeout until it completes, fails, or is cancelled.
4
Consume evidence
Paginate findings, inspect confirmation metadata, then export the report.
5
Export the report
Download a machine-readable result with run quality, evidence, coverage, and framework mappings.

Fields that matter in automation

These fields prevent a pipeline from treating activity, candidates, or advisory observations as confirmed security impact.

Scan state and coverage

Use status to control polling. progress and completed_summary_eligible are not coverage guarantees; inspect run_assessment and its reason codes.

Confirmed vulnerability gate

Gate on report_assessment.validation_confirmed == true. Severity, scan counters, and included_in_current_report alone are unsafe because candidates and hardening advice may also be stored.

Evidence and reproducibility

Finding detail exposes reproduction_steps, proof_of_concept, and evidence_documentation. reproducibility: not_assessed means the API describes recorded evidence without claiming an independent replay.

Pagination

Findings return items, total, skip, and limit. The limit is capped at 100, so continue until every item in total has been read.

Requests and responses

Examples use placeholder ids and a masked API key. Responses show the fields most useful to the next pipeline step; consult OpenAPI for every optional field.

POST/targets

Create an authorized target

Define the URL and scanning boundary. Set cross-domain consent only when you are authorized to scan a target outside the account domain.

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/targets" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal" \
  -H "Content-Type: application/json" \
  --data '{
  "name": "Production API",
  "url": "https://api.example.com",
  "scope": {
    "include_hosts": [
      "api.example.com"
    ],
    "include_paths": [
      "/v1"
    ],
    "exclude_paths": [
      "/v1/admin"
    ],
    "include_subdomains": false,
    "allow_reverse_ip_discovery": false,
    "ip_ranges": [],
    "exclude_hosts": []
  },
  "cross_domain_consent": true
}'

Response201 Created

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Production API",
  "url": "https://api.example.com/",
  "target_domain": "api.example.com",
  "scope": {
    "include_hosts": [
      "api.example.com"
    ],
    "include_paths": [
      "/v1"
    ],
    "exclude_paths": [
      "/v1/admin"
    ],
    "include_subdomains": false
  },
  "cross_domain_consent_accepted": true,
  "status": "active",
  "created_at": "2026-09-11T16:00:00Z",
  "updated_at": "2026-09-11T16:00:00Z"
}

Save id as the target id for scan creation. The API validates reachability and can reject invalid scope, plan capacity, or missing cross-domain consent.

POST/scans

Create and queue a scan

Built-in profiles are quick, standard, and deep. Add active auth_profile_ids when the assessment needs authenticated coverage.

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal" \
  -H "Content-Type: application/json" \
  --data '{
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "profile": "standard",
  "auth_profile_ids": [],
  "options": {}
}'

Response201 Created

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "profile": "standard",
  "status": "queued",
  "progress": 0,
  "findings_count": 0,
  "critical_count": 0,
  "high_count": 0,
  "created_at": "2026-09-11T16:01:00Z",
  "run_assessment": {
    "contract_version": 1,
    "status": "queued",
    "recorded_status": "queued",
    "completion_recorded": false,
    "execution_detail_status": "not_loaded",
    "completed_summary_eligible": false,
    "coverage_assurance": "not_assessed",
    "freshness": "unknown",
    "reason_codes": [
      "run_not_completed",
      "execution_details_not_loaded",
      "activity_not_recorded"
    ]
  }
}

POST /scans has no idempotency key. Persist the returned scan id and never blindly repeat an uncertain creation request, because that can queue a duplicate scan.

GET/scans/{scan_id}

Monitor scan state

Repeat this single status request with a bounded delay. Active states are queued, running, and paused; terminal stored states are completed, failed, and cancelled.

Request

curl -fsS "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "progress": 100,
  "display_progress": 100,
  "findings_count": 3,
  "critical_count": 0,
  "high_count": 1,
  "medium_count": 1,
  "low_count": 0,
  "info_count": 1,
  "current_tool": null,
  "completed_at": "2026-09-11T16:22:14Z",
  "run_assessment": {
    "contract_version": 1,
    "status": "completed",
    "recorded_status": "completed",
    "completion_recorded": true,
    "execution_detail_status": "not_loaded",
    "failed_execution_count": null,
    "incomplete_execution_count": null,
    "unclassified_execution_count": null,
    "completed_summary_eligible": null,
    "coverage_assurance": "not_assessed",
    "freshness": "historical",
    "last_activity_at": "2026-09-11T16:22:14Z",
    "evaluated_at": "2026-09-11T16:25:00Z",
    "reason_codes": [
      "execution_details_not_loaded"
    ]
  }
}

A completed status records lifecycle completion. Read run_assessment for freshness and execution caveats; progress 100 by itself does not prove coverage.

GET/findings?scan_id={scan_id}&severity=critical,high&limit=100&skip=0

List and filter findings

This request fetches one page. Filter by scan, target, severity, status, host, or classification, then advance skip until every item in total is downloaded.

Request

curl -fsS "https://agentbreach.com/api/v1/findings?scan_id=7a243f5d-d539-40d7-986c-0f460adc79a6&severity=critical,high&limit=100&skip=0" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "items": [
    {
      "id": "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c",
      "scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
      "target_id": "550e8400-e29b-41d4-a716-446655440000",
      "title": "SQL injection in order search",
      "severity": "high",
      "status": "confirmed",
      "type": "sql_injection",
      "source_tool": "nuclei",
      "confidence": "high",
      "validation_status": "confirmed",
      "url": "https://api.example.com/v1/orders?query=test",
      "method": "GET",
      "parameter": "query",
      "report_assessment": {
        "record_kind": "finding",
        "included_in_current_report": true,
        "validation_confirmed": true,
        "route_existence": null
      }
    }
  ],
  "total": 1,
  "skip": 0,
  "limit": 100
}

Use report_assessment.validation_confirmed for vulnerability gates. A nonexistent scan filter currently returns an empty page rather than 404.

GET/findings/{finding_id}

Retrieve recorded evidence and PoC

The detail response contains the recorded steps, proof of concept, observed result, remediation, validation, and report classification for one finding.

Request

curl -fsS "https://agentbreach.com/api/v1/findings/6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c",
  "scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "title": "SQL injection in order search",
  "severity": "high",
  "status": "confirmed",
  "type": "sql_injection",
  "source_tool": "nuclei",
  "description": "The query parameter changed the database response during validation.",
  "reproduction_steps": [
    "Send the recorded GET request to /v1/orders with the saved query value.",
    "Replay the same request with the recorded validation value.",
    "Compare the response status, body signature, and elapsed time."
  ],
  "proof_of_concept": {
    "method": "GET",
    "url": "https://api.example.com/v1/orders",
    "parameter": "query",
    "payload": "test' OR '1'='1",
    "request": "GET /v1/orders?query={{RECORDED_TEST_VALUE}} HTTP/1.1",
    "observed_result": "The response changed consistently across the validation controls.",
    "observed_at": "2026-09-11T16:18:02Z"
  },
  "validation_actions": [
    {
      "action": "control_comparison",
      "evidence": "The recorded payload and false-condition control produced different response signatures."
    }
  ],
  "remediation": "Use a parameterized query and validate the query input server-side.",
  "url": "https://api.example.com/v1/orders?query=test",
  "method": "GET",
  "parameter": "query",
  "discovered_at": "2026-09-11T16:18:02Z",
  "evidence_documentation": {
    "recorded_step_count": 3,
    "supporting_material_present": true,
    "observed_result_present": true,
    "validation_notes_present": true,
    "missing_fields": [],
    "reproducibility": "not_assessed"
  },
  "report_assessment": {
    "record_kind": "finding",
    "included_in_current_report": true,
    "validation_confirmed": true,
    "route_existence": null
  }
}

Sensitive values can be redacted. Evidence documentation reports what is present or missing and does not independently certify reproducibility.

PATCH/findings/{finding_id}

Update triage state

Set status, notes, and assignment. Supported application states are new, confirmed, false_positive, accepted_risk, and fixed.

Request

curl -fsS -X PATCH "https://agentbreach.com/api/v1/findings/6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal" \
  -H "Content-Type: application/json" \
  --data '{
  "status": "accepted_risk",
  "notes": "Accepted for release 2026.09; compensating control documented in SEC-184.",
  "assigned_to": "security@example.com"
}'

Response200 OK

{
  "id": "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c",
  "status": "accepted_risk",
  "assigned_to": "security@example.com",
  "notes": "Accepted for release 2026.09; compensating control documented in SEC-184.",
  "report_assessment": {
    "record_kind": "finding",
    "included_in_current_report": false,
    "validation_confirmed": false,
    "route_existence": null
  }
}

Accepted-risk, false-positive, and fixed records are excluded from active vulnerability reports. Setting fixed records the fixed timestamp.

GET/reports/scans/{scan_id}?format=json

Download the machine-readable report

JSON contains the run assessment, evidence-gated findings, execution summary, URL coverage, and framework mappings.

Request

curl -fsS "https://agentbreach.com/api/v1/reports/scans/7a243f5d-d539-40d7-986c-0f460adc79a6?format=json" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "report_type": "security_scan",
  "run_assessment": {
    "contract_version": 1,
    "status": "completed",
    "recorded_status": "completed",
    "completion_recorded": true,
    "execution_detail_status": "available",
    "failed_execution_count": 0,
    "incomplete_execution_count": 0,
    "unclassified_execution_count": 0,
    "completed_summary_eligible": true,
    "coverage_assurance": "not_assessed",
    "freshness": "historical",
    "last_activity_at": "2026-09-11T16:22:14Z",
    "evaluated_at": "2026-09-11T16:25:00Z",
    "reason_codes": []
  },
  "run_assessment_notice": "Run state: Completion recorded. Completion was recorded. The saved results do not establish complete coverage or that the target is secure. Last recorded run activity: 2026-09-11T16:22:14+00:00.",
  "executive_summary": {
    "scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
    "total_findings": 1,
    "material_findings": 1,
    "validation_confirmed": 1,
    "informational_hardening": 0,
    "severity_breakdown": {
      "critical": 0,
      "high": 1,
      "medium": 0,
      "low": 0,
      "info": 0
    },
    "risk_score_basis": "confirmed_vulnerabilities_only"
  },
  "findings": [
    {
      "id": "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c",
      "severity": "high",
      "validation_status": "confirmed"
    }
  ],
  "test_execution_summary": {
    "total_tests": 18,
    "successful_tests": 18,
    "failed_tests": 0,
    "total_duration_seconds": 1284,
    "tools_used": [
      "nuclei",
      "browser_agent"
    ]
  },
  "urls_tested": [
    {
      "url": "https://shop.example.com/",
      "authenticated": false
    },
    {
      "url": "https://shop.example.com/account",
      "authenticated": true
    }
  ],
  "total_urls_tested": 18,
  "framework_mappings": {
    "owasp_top_10": [
      "A03:2021 Injection"
    ],
    "cwe": [
      "CWE-89"
    ]
  },
  "generated_at": "2026-09-11T16:25:00Z"
}

Filter by severity and locale; JSON also accepts include_frameworks. CSV, Markdown, Jira, PDF, and evidence-pack are available. Use template=developer for a synchronous PDF; the default AI PDF may return 202 with email delivery.

POST/scans/{scan_id}/verification-rerun

Recheck existing open findings

Queue a verification pass on the same scan and finding set after remediation work.

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/verification-rerun" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "queued",
  "progress": 0,
  "execution_phase": "verification_rerun",
  "findings_count": 3,
  "options": {
    "verification_rerun": {
      "tools": [
        "nuclei"
      ],
      "finding_ids": [
        "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c"
      ],
      "requested_at": "2026-09-11T16:30:00Z",
      "previous_status": "completed",
      "parent_scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6"
    }
  },
  "run_assessment": {
    "contract_version": 1,
    "status": "queued",
    "recorded_status": "queued",
    "completion_recorded": false,
    "execution_detail_status": "not_loaded",
    "completed_summary_eligible": false,
    "coverage_assurance": "not_assessed",
    "freshness": "unknown",
    "reason_codes": [
      "run_not_completed",
      "execution_details_not_loaded"
    ]
  }
}

This does not consume a new scan quota or create new findings. Rediscovered findings remain vulnerable; absence from broad tool output stays inconclusive.

CI / PR result ingestion

These endpoints track a pull-request check and accept results produced by your CI tools. They do not launch a web or API DAST scan.

Open the full CI/CD integration guide

POST/ci-scans/start

Create the CI tracking record

Create one record for the repository, pull request, commit, and workflow run before uploading scanner results. This route requires ci:scan:write.

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/ci-scans/start" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal" \
  -H "Content-Type: application/json" \
  --data '{
  "provider": "github",
  "repository": "acme/storefront",
  "pr_number": 184,
  "base_sha": "68f070f",
  "head_sha": "0d5a8ee",
  "branch": "fix/order-search",
  "workflow_run_id": "9876543210",
  "options": {}
}'

Response201 Created

{
  "id": "7c3d2f48-76a7-4df8-9b17-90bd8b175bf8",
  "user_id": "9be5688a-f23b-46d1-94b4-6a9d8682492e",
  "provider": "github",
  "repository": "acme/storefront",
  "pr_number": 184,
  "base_sha": "68f070f",
  "head_sha": "0d5a8ee",
  "branch": "fix/order-search",
  "workflow_run_id": "9876543210",
  "status": "queued",
  "policy_result": null,
  "findings_count": 0,
  "critical_count": 0,
  "high_count": 0,
  "medium_count": 0,
  "low_count": 0,
  "info_count": 0,
  "options": {},
  "results_summary": null,
  "error_message": null,
  "created_at": "2026-09-11T16:40:00Z",
  "started_at": null,
  "completed_at": null
}

Persist the returned id. This is an ingestion/check lifecycle record; use POST /scans for Agent Breach web or API scanning.

POST/ci-scans/{ci_scan_id}/results

Submit CI findings

Upload normalized code findings and the pipeline policy decision to the existing CI record.

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/ci-scans/7c3d2f48-76a7-4df8-9b17-90bd8b175bf8/results" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal" \
  -H "Content-Type: application/json" \
  --data '{
  "findings": [
    {
      "title": "Hardcoded deployment token",
      "severity": "high",
      "type": "secret_exposure",
      "description": "A live deployment token is committed in a workflow file.",
      "file_path": ".github/workflows/deploy.yml",
      "line": 24,
      "rule_id": "secrets/live-token",
      "source_tool": "gitleaks",
      "evidence": "Token fingerprint ending in 4f2c"
    }
  ],
  "policy_result": "fail",
  "summary": {
    "files_scanned": 312,
    "rules_run": 48
  }
}'

Response200 OK

{
  "id": "7c3d2f48-76a7-4df8-9b17-90bd8b175bf8",
  "repository": "acme/storefront",
  "pr_number": 184,
  "status": "running",
  "policy_result": null,
  "findings_count": 0,
  "high_count": 0,
  "results_summary": null,
  "started_at": "2026-09-11T16:41:00Z",
  "completed_at": null
}

The immediate response may remain running while asynchronous processing updates counters and policy_result. Poll GET /ci-scans/{ci_scan_id} for the final record.

Choose the correct reprocessing action

These operations all keep the existing engagement, but they solve different problems. They take no request body and return the updated scan or finding.

POST/scans/{scan_id}/retry

Retry an interrupted scan

Use for queued, failed, paused, or demonstrably stale running scans. Recoverable checkpoints are preserved.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/retry" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "queued",
  "progress": 0,
  "resume_count": 1,
  "worker_id": null,
  "completed_at": null
}

A healthy running scan and other terminal states return 400. The response is the same scan queued again; resume_count increments.

POST/scans/{scan_id}/resume

Resume from checkpoints

Recover orchestration from saved checkpoints and artifacts. A paused target must be reachable first.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/resume" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "queued",
  "progress": 62,
  "resume_count": 2,
  "worker_id": null,
  "execution_phase": null
}

The response preserves existing progress and queues orchestration. An unreachable paused target or unsupported state returns 400.

POST/scans/{scan_id}/verification-rerun

Recheck open findings

Uses the same scan and existing finding ids without new-scan quota. Missing broad-tool output remains inconclusive.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/verification-rerun" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "queued",
  "progress": 0,
  "execution_phase": "verification_rerun",
  "options": {
    "verification_rerun": {
      "tools": [
        "nuclei"
      ],
      "finding_ids": [
        "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c"
      ],
      "requested_at": "2026-09-11T16:30:00Z",
      "previous_status": "completed",
      "parent_scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6"
    }
  }
}

Requires a completed or failed scan with eligible open findings. Otherwise the API returns 400 instead of starting an empty verification.

POST/scans/{scan_id}/tools/{tool_name}/rerun

Rerun one scanner

Replaces that tool's retained output and reconciles newly observed results into the same scan.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/tools/nuclei/rerun" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "queued",
  "completed_at": null,
  "options": {
    "tool_rerun": {
      "tool": "nuclei",
      "requested_at": "2026-09-11T16:32:00Z",
      "previous_status": "completed"
    }
  }
}

Use a canonical tool id from GET /scans/available-tools. An unknown tool or unsupported scan state returns 400.

POST/scans/{scan_id}/rehydrate-findings

Recover stored findings

Rebuilds database findings from retained artifacts. It does not send new security traffic to the target.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/scans/7a243f5d-d539-40d7-986c-0f460adc79a6/rehydrate-findings" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "progress": 100,
  "findings_count": 3,
  "critical_count": 0,
  "high_count": 1,
  "medium_count": 1,
  "low_count": 0,
  "info_count": 1
}

Use only when retained output exists. If stored outputs contain no findings, the API returns 400 and leaves the scan unchanged.

POST/findings/{finding_id}/verify-fix

Replay one PoC

Queues a scoped worker replay of recorded control and proof exchanges for a differential SQL-error finding.

Show request and response

Request

curl -fsS -X POST "https://agentbreach.com/api/v1/findings/6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c/verify-fix" \
  -H "X-API-Key: ab_YOUR_KEY" \
  -H "X-Org-Context: personal"

Response200 OK

{
  "id": "6ed1e606-0ed8-4528-bd7d-3df0cbe9b97c",
  "scan_id": "7a243f5d-d539-40d7-986c-0f460adc79a6",
  "target_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "confirmed",
  "fix_verification_status": "still_vulnerable",
  "fix_verified_at": "2026-09-11T16:35:00Z",
  "report_assessment": {
    "record_kind": "finding",
    "included_in_current_report": true,
    "validation_confirmed": true,
    "route_existence": null
  }
}

The initial response is pending; poll GET /findings/{finding_id}. A verified fix moves the finding to fixed. Missing evidence, unreachable targets, and unsupported classes remain inconclusive.

Common endpoints

This compact catalog covers the main automation workflow. Use Swagger or ReDoc above for authentication profiles, schedules, API keys, webhooks, usage, live events, tool outputs, and public route schemas.

Targets

GET /targetsList targets
POST /targetsCreate target
GET /targets/{target_id}Get target
PATCH /targets/{target_id}Update target
DELETE /targets/{target_id}Soft-delete a never-scanned or six-month inactive target

Scans

GET /scans/available-toolsTool catalogue
GET /scansList scans
POST /scansCreate and queue scan
GET /scans/{scan_id}Get scan state and run assessment
POST /scans/{scan_id}/cancelCancel an active scan
POST /scans/{scan_id}/retryRecover a queued, failed, paused, or stale-running scan
POST /scans/{scan_id}/verification-rerunRecheck existing open findings
POST /scans/{scan_id}/tools/{tool_name}/rerunRerun one tool
POST /scans/{scan_id}/resumeResume from saved checkpoints and artifacts
POST /scans/{scan_id}/rehydrate-findingsRebuild findings from retained output

Findings

GET /findingsList findings (filters: target_id, scan_id, severity, status)
GET /findings/{finding_id}Get evidence and reproduction detail
GET /findings/{finding_id}/tool-outputGet retained source-tool output (404 if absent or expired)
PATCH /findings/{finding_id}Update triage fields
POST /findings/{finding_id}/verify-fixReplay one concrete PoC

Reports

GET /reports/scans/{scan_id}Export JSON, CSV, PDF, Markdown, Jira, or evidence pack
GET /reports/targets/{target_id}Consolidate active findings; latest scan anchors report metadata

CI / PR scans

These routes ingest PR/code results and require ci:scan:write. POST /ci-scans/start creates a tracking record; it does not launch web/API DAST. One key may include both CI and REST scopes.

POST /ci-scans/startCreate a PR/check record for result ingestion
POST /ci-scans/{ci_scan_id}/resultsSubmit results
GET /ci-scans/{ci_scan_id}Poll the processing result

Errors

Errors use a detail field. It can be a string, a structured consent error, or a list of field-validation problems.

Invalid authentication401

{
  "detail": "Could not validate credentials"
}

Missing scope or role403

{
  "detail": "Missing required API key scope: api:access"
}

Invalid request body422

{
  "detail": [
    {
      "type": "missing",
      "loc": [
        "body",
        "url"
      ],
      "msg": "Field required"
    }
  ]
}

400

Invalid filters, state transition, scope, consent, or request semantics.

401

Missing, expired, revoked, or otherwise invalid credentials.

403

Valid identity without the required plan, scope, workspace role, or entitlement.

404

The target, scan, finding, CI record, or retained tool output does not exist in this workspace.

429

Mutation rate exceeded. Read Retry-After and the X-RateLimit headers before retrying.

Rate limits

Mutating requests can return 429 with X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After headers.

Treat the response headers as authoritative and use bounded backoff. Scan creation can have stricter limits than ordinary mutations.

Retry-After: 3600

More help

Browse the documentation hub, OpenAPI links above, or contact support.

API Reference

Connect safely

Authentication

Workspace header

Base URL

Interactive OpenAPI

From target to verified result

Register the target

Queue a scan

Wait for a terminal state

Consume evidence

Export the report

Fields that matter in automation

Scan state and coverage

Confirmed vulnerability gate

Evidence and reproducibility

Pagination

Requests and responses

CI / PR result ingestion

Choose the correct reprocessing action

Retry an interrupted scan

Resume from checkpoints

Recheck open findings

Rerun one scanner

Recover stored findings

Replay one PoC

Common endpoints

Errors

Rate limits

More help