Public API — Overview

The platform is driven entirely through a single authenticated REST API under /api/v1 — one API across every module (EASM, DAST, Cloud/CSPM). This page explains the authentication model and the integration concepts; the API Reference documents every endpoint, and the API Usage Guide is a step-by-step walkthrough with curl examples.

Three-key authentication

Key	Sent on	Held by	Purpose
X-Master-Key	every request	the platform deployment	global top gate / kill switch
X-Admin-Key	every request	your UI backend	operator identity
X-Org-Key	org-scoped requests	your UI backend (one per org)	selects and authorizes the org

• Create org needs master + admin and returns the org key once.
• Org actions need master + admin + org key.
• A key is never placed in a URL. The org is chosen by the X-Org-Key header; admin routes address an org by your own customer_id.

How the UI knows which org it is talking to

You never need the platform's internal UUID:

• Per-org work (domains, scans, findings, feedback) — send only the org key header. It uniquely selects the org. No id in the URL.
• Admin lookups (view an org, rotate its key) — address it by your own customer_id (for example CUST-100), the identifier you assigned.

So your UI backend stores, per customer: your customer_id and the org key (treat it like a password). That is all.

Identity model

• Org = tenant. Each org gets its own isolated database schema. Strong data separation between customers, one codebase.
• Shared config. Each org record holds customer_id, customer_name, the hashed org key, and modules_enabled (easm, later dast). Both modules read it.
• Domains. An org's domains are what scans run against. Add, change, or remove them through the org domain endpoints.

Scan control and the feedback loop

• Start / stop / progress. Start a scan, poll stage-based progress, and stop cooperatively (the in-flight tool finishes its step, nothing new starts).
• Feedback validation. Customers answer findings; a full rescan reconciles those answers and reports confirmed-fixed / regressed / still-open / newly-found.

Hardening

• Rate limit: 300 requests/minute per admin key (429 when exceeded).
• Audit: every mutating call is recorded (key prefixes only, never full keys).
• Secrets: keys are shown once and stored only as salted hashes; rotation is supported.

Read next

• API Reference — every endpoint, headers, request/response shapes, errors.
• API Usage Guide — the full integration walkthrough with curl.