Endpoints

Summary

This is a catalog of the endpoints a developer or integrator most commonly uses. Every route is available both un-prefixed (/scans) and under a version prefix (/api/v1/scans). Requests and responses are JSON unless noted; some report endpoints return binary files.

Note

GET /api/versions returns the current and available API versions. Errors return a structured body with a correlation_id; every response also carries an X-Correlation-ID header.

Health & metrics (public)

Method	Path	Purpose
GET	/health	Basic liveness
GET	/health?deep=true	Component diagnostics (DB, disk, gcloud, posture)
GET	/metrics	Prometheus metrics
GET	/api/versions	API version info

Authentication

Method	Path	Purpose
POST	/auth/login	Email/password login (+ optional TOTP)
POST	/auth/refresh	Rotate tokens
GET	/auth/me	Current user
POST	/auth/switch-tenant	Re-issue a token for another tenant

Scans

Method	Path	Purpose
GET	/scans	List scans (tenant-scoped)
POST	/scans	Start a scan (202; honors Idempotency-Key)
POST	/scans/{gcp|aws|azure|m365|workspace}	Provider-specific launchers
GET	/scans/{id}	Scan status
POST	/scans/{id}/cancel · /resume	Control a scan
GET	/scans/{id}/summary · /findings	Results
GET	/checks · /profiles · /capabilities	Catalog of checks, profiles, capabilities
POST	/preflight	Pre-scan permission check

Scan reports & exports

Method	Path	Purpose
GET	/scans/{id}/report · /report/ccpr	Reports (CCPR = bilingual Hebrew)
GET	/scans/{id}/export/{excel|docx|csv|sarif|jsonlines}	Export findings
GET	/scans/{id}/audit/report/{en|he}	Audit report (English / Hebrew)

Findings management

Method	Path	Purpose
POST	/findings/{id}/status	Update finding status
POST	/findings/{id}/acknowledge	Acknowledge a finding
POST	/findings/mute · /mute/bulk	Mute findings
POST	/findings/{id}/revalidate	Revalidate a finding
GET	/findings/delta	What changed between scans

Cloud accounts

Method	Path	Purpose
GET	/cloud/accounts	List connected accounts
POST	/cloud/connect · /connect/aws · /connect/azure	Connect a provider
POST	/cloud/test-credentials	Verify credentials

License, scheduler, pentest, AI

Method	Path	Purpose
GET	/license/status	License status (public)
POST	/scheduler/start · /scheduler/schedules	Scheduler control / schedules
POST	/pentest/orchestrate	Launch an orchestrated pentest
POST	/ai/chat/stream	AI assistant (requires chat.use)

Admin

Method	Path	Purpose
GET/POST	/admin/users · /admin/roles	User / role management (admin.*)
GET/POST	/admin/api-keys	API key management
GET	/admin/audit-logs	Audit log (audit.view)
GET/POST	/api/tenants/	Tenant management

Notes & limitations

• This catalog highlights common endpoints; the platform exposes many more (ASPM, IaC, secrets, SBOM, containers, FinOps, compliance, etc.).
• Auth, permissions, MFA, and license-feature gates apply per Authentication and Permissions & Scopes.
• Rate limits apply — see Rate Limits.