Developers

API reference

Use the platform API to automate scoring workflows, report operations, and integration-driven signal ingestion with strict tenant-scoped access controls.

Client integrations should treat API responses as tenant-scoped data, enforce encrypted transport, and retain immutable report artifacts for downstream governance and compliance evidence.

For job-style ingestion and retry-safe integration guidance, see Ingestion API patterns.

Authentication

API routes require authenticated session context or an API key, plus tenant authorization checks. Transport wrappers return structured error envelopes and avoid leaking sensitive internal state.

API keys must be created with explicit scopes and are evaluated per endpoint.
Authentication failures are rate-limited and monitored to contain brute-force attempts.
Sensitive ingestion management operations require session-based authenticated users.

Header	Example	Notes
Cookie	crp_session=<session_token>	Required for authenticated requests.
Authorization	Bearer crp.<lookup>.<secret>	Alternative to session cookies for service-to-service access.
x-api-key	crp.<lookup>.<secret>	Equivalent API key header option.
x-tenant-id	<tenant_id>	Server-resolved tenant selection header.

Core endpoints

Method	Path	Summary	Purpose
GET	/api/v1/api-keys	List API keys	List API keys created by the authenticated user for a tenant.
POST	/api/v1/api-keys	Create API key	Create a new API key. The raw key is shown only once in the create response.
DELETE	/api/v1/api-keys/[apiKeyId]	Documented endpoint	Endpoint available in public API route catalog.
DELETE	/api/v1/assessments/[assessmentId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assessments/[assessmentId]/calculate-score	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assessments/[assessmentId]/download	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assessments/runs	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assessments/runs/[id]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assessments/runs/[id]/responses	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assessments/runs/[id]/result	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assessments/runs/[id]/submit	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assessments/templates	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/assets/blast-radius	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/assets/blast-radius	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/audit/events	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/audit/events/export	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/compliance-evidence	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/compliance-evidence	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/cra/payments/[paymentRef]/status	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/cra/payments/initiate	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/cra/payments/payfast/itn	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/cra/payments/payfast/itn	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/cra/unlock-requests	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/cra/unlock-requests/[requestId]	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/dashboard/summary	Dashboard summary	Fetch tenant-scoped dashboard summary metrics.
GET	/api/v1/dashboard/trends	Dashboard trends	Fetch score and exposure trend-series for selected range.
GET	/api/v1/frameworks/[frameworkCode]/alignment	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/frameworks/[frameworkCode]/prompts	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/frameworks/[frameworkCode]/prompts	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/frameworks/mapping-suggestions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/frameworks/mapping-suggestions	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/apps	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/apps	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/discord/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/executions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/actions	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/callback	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/jira/test-connection	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/microsoft-teams/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/integrations/rules	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/rules	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/integrations/rules/[ruleId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/rules/simulate	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/securityscorecard/actions/trigger-correlation	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/securityscorecard/signal-ingest	Ingest SecurityScorecard signals	Ingest and normalize external risk signals.
POST	/api/v1/integrations/slack/test-connection	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/integrations/webhook/test-connection	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/internal/decision-traces	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/internal/phase2-health	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra-submissions	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra-submissions/[id]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra-submissions/[id]/generate-report	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra/entitlements	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra/entitlements/[entitlementId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/activate	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/approve	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/bridge-disable	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/bridge-enable	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/expire	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/hold	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/platform-approve	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/reject	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/request-created	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/revoke	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/submit	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/entitlements/[entitlementId]/supersede	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra/unlock-requests	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/operator/cra/unlock-requests/[requestId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/unlock-requests/[requestId]/approve	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/unlock-requests/[requestId]/decline	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/unlock-requests/[requestId]/expire	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/unlock-requests/[requestId]/review	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/operator/cra/unlock-requests/[requestId]/supersede	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/profile/update	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs	Documented endpoint	Endpoint available in public API route catalog.
DELETE	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/report-ingestion/jobs/[jobId]	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/extract	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/finalize	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]/preview	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/report-ingestion/jobs/[jobId]/validate	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/jobs/[jobId]/verification	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/report-ingestion/scope-keys	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/reports	List reports	List report artifacts for the selected tenant context.
GET	/api/v1/reports/[reportId]/download	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/reports/generate	Generate report	Generate report snapshot for an assessment context.
GET	/api/v1/system/origin	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/tenants/[tenantId]/branding	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/tenants/[tenantId]/branding	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/third-party-risk/campaigns/[campaignId]/evidence-export	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns/[campaignId]/responses	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/campaigns/[campaignId]/workflow	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/third-party-risk/vendors	Documented endpoint	Endpoint available in public API route catalog.
GET	/api/v1/threat-intelligence	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/threat-intelligence	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/vulnerabilities/[vulnerabilityId]	Documented endpoint	Endpoint available in public API route catalog.
PATCH	/api/v1/vulnerabilities/[vulnerabilityId]/status	Documented endpoint	Endpoint available in public API route catalog.
POST	/api/v1/vulnerabilities/[vulnerabilityId]/status	Documented endpoint	Endpoint available in public API route catalog.

Request/response examples

GET/api/v1/api-keysauth, api-keys

Request

GET /api/v1/api-keys?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "items": []
  }
}

POST/api/v1/api-keysauth, api-keys

Request

POST /api/v1/api-keys
{
  "tenantId": "<tenant_id>",
  "name": "CI runner",
  "scopes": ["read:dashboard"],
  "expiresInDays": 90
}

Response

{
  "success": true,
  "data": {
    "apiKey": "crp.<lookup>.<secret>",
    "apiKeyMeta": {
      "id": "<api_key_id>",
      "name": "CI runner"
    }
  }
}

DELETE/api/v1/api-keys/[apiKeyId]unclassified

DELETE/api/v1/assessments/[assessmentId]unclassified

POST/api/v1/assessments/[assessmentId]/calculate-scoreunclassified

GET/api/v1/assessments/[assessmentId]/downloadunclassified

POST/api/v1/assessments/runsunclassified

GET/api/v1/assessments/runs/[id]unclassified

POST/api/v1/assessments/runs/[id]/responsesunclassified

GET/api/v1/assessments/runs/[id]/resultunclassified

POST/api/v1/assessments/runs/[id]/submitunclassified

GET/api/v1/assessments/templatesunclassified

GET/api/v1/assets/blast-radiusunclassified

POST/api/v1/assets/blast-radiusunclassified

GET/api/v1/audit/eventsunclassified

GET/api/v1/audit/events/exportunclassified

GET/api/v1/compliance-evidenceunclassified

POST/api/v1/compliance-evidenceunclassified

GET/api/v1/cra/payments/[paymentRef]/statusunclassified

POST/api/v1/cra/payments/initiateunclassified

GET/api/v1/cra/payments/payfast/itnunclassified

POST/api/v1/cra/payments/payfast/itnunclassified

POST/api/v1/cra/unlock-requestsunclassified

GET/api/v1/cra/unlock-requests/[requestId]unclassified

GET/api/v1/dashboard/summarydashboard

Request

GET /api/v1/dashboard/summary?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "overallScore": 72,
    "riskLevel": "Moderate"
  }
}

GET/api/v1/dashboard/trendsdashboard

Request

GET /api/v1/dashboard/trends?tenantId=<tenant_id>&range=3y

Response

{
  "success": true,
  "data": {
    "range": "3y",
    "scoreSeries": []
  }
}

GET/api/v1/frameworks/[frameworkCode]/alignmentunclassified

GET/api/v1/frameworks/[frameworkCode]/promptsunclassified

POST/api/v1/frameworks/[frameworkCode]/promptsunclassified

GET/api/v1/frameworks/mapping-suggestionsunclassified

POST/api/v1/frameworks/mapping-suggestionsunclassified

GET/api/v1/integrations/appsunclassified

POST/api/v1/integrations/appsunclassified

POST/api/v1/integrations/discord/test-connectionunclassified

GET/api/v1/integrations/executionsunclassified

POST/api/v1/integrations/jira/actionsunclassified

POST/api/v1/integrations/jira/callbackunclassified

POST/api/v1/integrations/jira/test-connectionunclassified

POST/api/v1/integrations/microsoft-teams/test-connectionunclassified

GET/api/v1/integrations/rulesunclassified

POST/api/v1/integrations/rulesunclassified

PATCH/api/v1/integrations/rules/[ruleId]unclassified

POST/api/v1/integrations/rules/simulateunclassified

POST/api/v1/integrations/securityscorecard/actions/trigger-correlationunclassified

POST/api/v1/integrations/securityscorecard/signal-ingestintegrations, securityscorecard

Request

POST /api/v1/integrations/securityscorecard/signal-ingest
{
  "tenantId": "<tenant_id>",
  "signals": []
}

Response

{
  "success": true,
  "data": {
    "ingested": 0,
    "linked": 0
  }
}

POST/api/v1/integrations/slack/test-connectionunclassified

POST/api/v1/integrations/webhook/test-connectionunclassified

GET/api/v1/internal/decision-tracesunclassified

GET/api/v1/internal/phase2-healthunclassified

GET/api/v1/operator/cra-submissionsunclassified

GET/api/v1/operator/cra-submissions/[id]unclassified

POST/api/v1/operator/cra-submissions/[id]/generate-reportunclassified

GET/api/v1/operator/cra/entitlementsunclassified

POST/api/v1/operator/cra/entitlementsunclassified

GET/api/v1/operator/cra/entitlements/[entitlementId]unclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/activateunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/approveunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/bridge-disableunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/bridge-enableunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/expireunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/holdunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/platform-approveunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/rejectunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/request-createdunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/revokeunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/submitunclassified

POST/api/v1/operator/cra/entitlements/[entitlementId]/supersedeunclassified

GET/api/v1/operator/cra/unlock-requestsunclassified

GET/api/v1/operator/cra/unlock-requests/[requestId]unclassified

POST/api/v1/operator/cra/unlock-requests/[requestId]/approveunclassified

POST/api/v1/operator/cra/unlock-requests/[requestId]/declineunclassified

POST/api/v1/operator/cra/unlock-requests/[requestId]/expireunclassified

POST/api/v1/operator/cra/unlock-requests/[requestId]/reviewunclassified

POST/api/v1/operator/cra/unlock-requests/[requestId]/supersedeunclassified

POST/api/v1/profile/updateunclassified

GET/api/v1/report-ingestion/jobsunclassified

POST/api/v1/report-ingestion/jobsunclassified

DELETE/api/v1/report-ingestion/jobs/[jobId]unclassified

GET/api/v1/report-ingestion/jobs/[jobId]unclassified

PATCH/api/v1/report-ingestion/jobs/[jobId]unclassified

POST/api/v1/report-ingestion/jobs/[jobId]/extractunclassified

POST/api/v1/report-ingestion/jobs/[jobId]/finalizeunclassified

GET/api/v1/report-ingestion/jobs/[jobId]/previewunclassified

POST/api/v1/report-ingestion/jobs/[jobId]/validateunclassified

GET/api/v1/report-ingestion/jobs/[jobId]/verificationunclassified

GET/api/v1/report-ingestion/scope-keysunclassified

GET/api/v1/reportsreports

Request

GET /api/v1/reports?tenantId=<tenant_id>

Response

{
  "success": true,
  "data": {
    "items": []
  }
}

GET/api/v1/reports/[reportId]/downloadunclassified

POST/api/v1/reports/generatereports

Request

POST /api/v1/reports/generate
{
  "tenantId": "<tenant_id>",
  "assessmentId": "<assessment_id>",
  "reportType": "BOARD_PACK"
}

Response

{
  "success": true,
  "data": {
    "reportId": "<report_id>",
    "status": "AVAILABLE"
  }
}

GET/api/v1/system/originunclassified

GET/api/v1/tenants/[tenantId]/brandingunclassified

PATCH/api/v1/tenants/[tenantId]/brandingunclassified

POST/api/v1/third-party-risk/campaignsunclassified

GET/api/v1/third-party-risk/campaigns/[campaignId]/evidence-exportunclassified

POST/api/v1/third-party-risk/campaigns/[campaignId]/responsesunclassified

POST/api/v1/third-party-risk/campaigns/[campaignId]/workflowunclassified

POST/api/v1/third-party-risk/vendorsunclassified

GET/api/v1/threat-intelligenceunclassified

POST/api/v1/threat-intelligenceunclassified

PATCH/api/v1/vulnerabilities/[vulnerabilityId]unclassified

PATCH/api/v1/vulnerabilities/[vulnerabilityId]/statusunclassified

POST/api/v1/vulnerabilities/[vulnerabilityId]/statusunclassified

Error envelope

Failed requests return a stable envelope containing status, machine-readable code, and user-safe message.

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "You are not authorized for this tenant context."
  }
}