Developers

API reference

Use the platform API to automate scoring workflows, report operations, and integration-driven signal ingestion with strict tenant-scoped access controls.

Client integrations should treat API responses as tenant-scoped data, enforce encrypted transport, and retain immutable report artifacts for downstream governance and compliance evidence.

For job-style ingestion and retry-safe integration guidance, see Ingestion API patterns.

Authentication

API routes require authenticated session context or an API key, plus tenant authorization checks. Transport wrappers return structured error envelopes and avoid leaking sensitive internal state.

API keys must be created with explicit scopes and are evaluated per endpoint.
Authentication failures are rate-limited and monitored to contain brute-force attempts.
Sensitive ingestion management operations require session-based authenticated users.

Header	Example	Notes
Cookie	crp_session=<session_token>	Required for authenticated requests.
Authorization	Bearer crp.<lookup>.<secret>	Alternative to session cookies for service-to-service access.
x-api-key	crp.<lookup>.<secret>	Equivalent API key header option.
x-tenant-id	<tenant_id>	Server-resolved tenant selection header.

Core endpoints

Method	Path	Summary	Purpose
GET	/api/v1/api-keys	List API keys	List API keys created by the authenticated user for a tenant.
POST	/api/v1/api-keys	Create API key	Create a new API key. The raw key is shown only once in the create response.
DELETE	/api/v1/api-keys/[apiKeyId]	Documented endpoint	Endpoint available in public API route catalog.
DELETE	/api/v1/assessments/[assessmentId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assessments/[assessmentId]/calculate-score	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assessments/[assessmentId]/download	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assets/blast-radius	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assets/blast-radius	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/audit/events	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/audit/events/export	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/compliance-evidence	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/compliance-evidence	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/dashboard/summary	Dashboard summary	Fetch tenant-scoped dashboard summary metrics.
GET	/api/v1/dashboard/trends	Dashboard trends	Fetch score and exposure trend-series for selected range.
GET	/api/v1/frameworks/[frameworkCode]/alignment	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/frameworks/[frameworkCode]/prompts	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/frameworks/[frameworkCode]/prompts	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/frameworks/mapping-suggestions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/frameworks/mapping-suggestions	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/apps	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/apps	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/discord/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/executions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/actions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/callback	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/test-connection	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/microsoft-teams/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/rules	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/rules	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/integrations/rules/[ruleId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/rules/simulate	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/securityscorecard/actions/trigger-correlation	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/securityscorecard/signal-ingest	Ingest SecurityScorecard signals	Ingest and normalize external risk signals.
POST	/api/v1/integrations/slack/test-connection	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/webhook/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/internal/decision-traces	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/internal/phase2-health	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/profile/update	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs	Documented endpoint	Endpoint available in public API route catalog.
DELETE	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/extract	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/finalize	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]/preview	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/validate	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]/verification	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/scope-keys	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/reports	List reports	List report artifacts for the selected tenant context.
GET	/api/v1/reports/[reportId]/download	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/reports/generate	Generate report	Generate report snapshot for an assessment context.
GET	/api/v1/system/origin	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/tenants/[tenantId]/branding	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/tenants/[tenantId]/branding	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/third-party-risk/campaigns/[campaignId]/evidence-export	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns/[campaignId]/responses	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns/[campaignId]/workflow	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/vendors	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/threat-intelligence	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/threat-intelligence	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/vulnerabilities/[vulnerabilityId]	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/vulnerabilities/[vulnerabilityId]/status	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/vulnerabilities/[vulnerabilityId]/status	Documented endpoint	Endpoint available in public API route catalog.

Request/response examples

GET/api/v1/api-keysauth, api-keys

Request

GET /api/v1/api-keys?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "items": []
  }
}

POST/api/v1/api-keysauth, api-keys

Request

POST /api/v1/api-keys
{
  "tenantId": "<tenant_id>",
  "name": "CI runner",
  "scopes": ["read:dashboard"],
  "expiresInDays": 90
}

Response

{
  "success": true,
  "data": {
    "apiKey": "crp.<lookup>.<secret>",
    "apiKeyMeta": {
      "id": "<api_key_id>",
      "name": "CI runner"
    }
  }
}

DELETE/api/v1/api-keys/[apiKeyId]unclassified

DELETE/api/v1/assessments/[assessmentId]unclassified

POST/api/v1/assessments/[assessmentId]/calculate-scoreunclassified

GET/api/v1/assessments/[assessmentId]/downloadunclassified

GET/api/v1/assets/blast-radiusunclassified

POST/api/v1/assets/blast-radiusunclassified

GET/api/v1/audit/eventsunclassified

GET/api/v1/audit/events/exportunclassified

GET/api/v1/compliance-evidenceunclassified

POST/api/v1/compliance-evidenceunclassified

GET/api/v1/dashboard/summarydashboard

Request

GET /api/v1/dashboard/summary?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "overallScore": 72,
    "riskLevel": "Moderate"
  }
}

GET/api/v1/dashboard/trendsdashboard

Request

GET /api/v1/dashboard/trends?tenantId=<tenant_id>&range=3y

Response

{
  "success": true,
  "data": {
    "range": "3y",
    "scoreSeries": []
  }
}

GET/api/v1/frameworks/[frameworkCode]/alignmentunclassified

GET/api/v1/frameworks/[frameworkCode]/promptsunclassified

POST/api/v1/frameworks/[frameworkCode]/promptsunclassified

GET/api/v1/frameworks/mapping-suggestionsunclassified

POST/api/v1/frameworks/mapping-suggestionsunclassified

GET/api/v1/integrations/appsunclassified

POST/api/v1/integrations/appsunclassified

POST/api/v1/integrations/discord/test-connectionunclassified

GET/api/v1/integrations/executionsunclassified

POST/api/v1/integrations/jira/actionsunclassified

POST/api/v1/integrations/jira/callbackunclassified

POST/api/v1/integrations/jira/test-connectionunclassified

POST/api/v1/integrations/microsoft-teams/test-connectionunclassified

GET/api/v1/integrations/rulesunclassified

POST/api/v1/integrations/rulesunclassified

PATCH/api/v1/integrations/rules/[ruleId]unclassified

POST/api/v1/integrations/rules/simulateunclassified

POST/api/v1/integrations/securityscorecard/actions/trigger-correlationunclassified

POST/api/v1/integrations/securityscorecard/signal-ingestintegrations, securityscorecard

Request

POST /api/v1/integrations/securityscorecard/signal-ingest
{
  "tenantId": "<tenant_id>",
  "signals": []
}

Response

{
  "success": true,
  "data": {
    "ingested": 0,
    "linked": 0
  }
}

POST/api/v1/integrations/slack/test-connectionunclassified

POST/api/v1/integrations/webhook/test-connectionunclassified

GET/api/v1/internal/decision-tracesunclassified

GET/api/v1/internal/phase2-healthunclassified

POST/api/v1/profile/updateunclassified

GET/api/v1/report-ingestion/jobsunclassified

POST/api/v1/report-ingestion/jobsunclassified

DELETE/api/v1/report-ingestion/jobs/[jobId]unclassified

GET/api/v1/report-ingestion/jobs/[jobId]unclassified

PATCH/api/v1/report-ingestion/jobs/[jobId]unclassified

POST/api/v1/report-ingestion/jobs/[jobId]/extractunclassified

POST/api/v1/report-ingestion/jobs/[jobId]/finalizeunclassified

GET/api/v1/report-ingestion/jobs/[jobId]/previewunclassified

POST/api/v1/report-ingestion/jobs/[jobId]/validateunclassified

GET/api/v1/report-ingestion/jobs/[jobId]/verificationunclassified

GET/api/v1/report-ingestion/scope-keysunclassified

GET/api/v1/reportsreports

Request

GET /api/v1/reports?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "items": []
  }
}

GET/api/v1/reports/[reportId]/downloadunclassified

POST/api/v1/reports/generatereports

Request

POST /api/v1/reports/generate
{
  "tenantId": "<tenant_id>",
  "assessmentId": "<assessment_id>",
  "reportType": "BOARD_PACK"
}

Response

{
  "success": true,
  "data": {
    "reportId": "<report_id>",
    "status": "AVAILABLE"
  }
}

GET/api/v1/system/originunclassified

GET/api/v1/tenants/[tenantId]/brandingunclassified

PATCH/api/v1/tenants/[tenantId]/brandingunclassified

POST/api/v1/third-party-risk/campaignsunclassified

GET/api/v1/third-party-risk/campaigns/[campaignId]/evidence-exportunclassified

POST/api/v1/third-party-risk/campaigns/[campaignId]/responsesunclassified

POST/api/v1/third-party-risk/campaigns/[campaignId]/workflowunclassified

POST/api/v1/third-party-risk/vendorsunclassified

GET/api/v1/threat-intelligenceunclassified

POST/api/v1/threat-intelligenceunclassified

PATCH/api/v1/vulnerabilities/[vulnerabilityId]unclassified

PATCH/api/v1/vulnerabilities/[vulnerabilityId]/statusunclassified

POST/api/v1/vulnerabilities/[vulnerabilityId]/statusunclassified

Error envelope

Failed requests return a stable envelope containing status, machine-readable code, and user-safe message.

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "You are not authorized for this tenant context."
  }
}